This is deliberately not a newsletter summary. It is a working instrument. The questions below combine direct practices from U.S. Government Accountability Office technology-readiness, cost, schedule, and Agile guidance with NIST AI risk-management guidance and clearly labeled Assemble Teams synthesis. The source material is public; the value here is turning it into a compact pre-commitment test a mission owner can actually use.
A prototype can work without being ready for the environment, dependencies, schedule, operating model, or risk burden of the mission. Readiness should be evidenced, not narrated.
NIST says AI RMF 1.0 is being revised and its critical-infrastructure profile remains an ongoing project. This 12-question check remains an Assemble Teams synthesis, not the NIST profile, a compliance test or a certification.
Sources: NIST AI RMF status; NIST critical-infrastructure profile project.
The 12-question evidence check
What observable condition changes if this mission succeeds?
Name the outcome in operational terms—not the product, activity, grant, launch, or meeting.
Who must use, operate, approve, or maintain the result?
Separate the buyer, end user, operator, regulator, maintainer, and affected community when they are not the same person.
Which component can still fail because it is immature?
GAO readiness practice starts by identifying critical technologies rather than assigning one maturity label to the whole program.
Has the critical capability worked where the mission will actually use it?
Bench performance is not operational performance. State the relevant environment, interfaces, loads, constraints, and failure modes.
What has to connect for the mission to work end to end?
List technical, data, physical, organizational, vendor, and human dependencies. A component can be mature while the integrated system is not.
Which dependencies actually control the finish date?
A date is not a schedule. Identify the logic, critical path, handoffs, decision gates, and schedule risk.
What assumptions make the cost estimate true?
Expose quantities, rates, escalation, uncertainty, contingency, operating cost, and who owns each assumption.
Who can stop, approve, fund, certify, or materially change the mission?
Map decision rights before the work begins. Hidden authority is a common source of late-stage delay.
Which claims require independent verification?
Credentials, compliance, safety, security, privacy, and regulated performance should not be self-conferred by the team building the solution.
What happens when the model is wrong, unavailable, manipulated, or used outside scope?
NIST's AI RMF treats AI risk as an organizational governance and lifecycle problem, not just a model-accuracy problem.
Who owns the system after launch?
Commissioning is not sustainment. Define staffing, maintenance, training, support, data stewardship, cybersecurity, and lifecycle funding.
What evidence would make you stop?
A credible mission defines failure thresholds before sunk cost and institutional momentum make stopping politically or emotionally difficult.
How to read the result
| State | What it means | Next move |
|---|---|---|
| DISCOVER | The problem is credible, but the evidence base or owner is still forming. | Research, validate need, identify authority and affected operators. |
| DEFINE | Outcome and ownership are clear; critical dependencies remain unresolved. | Build the dependency, readiness, cost and schedule evidence. |
| DE-RISK | The mission is coherent, but one or more critical assumptions are unproven. | Run the smallest test that can retire the highest-consequence uncertainty. |
| EXECUTE | Critical evidence exists, decision rights are clear, and residual risks are explicitly owned. | Commit resources against measurable gates; keep the evidence current. |
This is not a universal certification or a substitute for sector-specific engineering, legal, safety, acquisition, or regulatory review. It is a pre-commitment discipline: a way to expose what the mission knows, what it assumes, and what still has to be proven.
Source map: what comes from where
Not every question below is a verbatim GAO or NIST requirement. This map separates direct source foundations from Assemble Teams synthesis so the tool does not borrow authority it has not earned.
| Questions | Primary foundation | How to read it |
|---|---|---|
| 03–05 | GAO Technology Readiness Assessment Guide (GAO-20-48G) | Directly grounded in identifying critical technologies, demonstrated maturity, relevant environment, and integration risk. |
| 06 | GAO Schedule Assessment Guide (GAO-16-89G) | Directly grounded in integrated, logically sequenced schedules, dependencies, critical path, and schedule risk. |
| 07 | GAO Cost Estimating and Assessment Guide (GAO-20-195G) | Directly grounded in technical baselines, assumptions, estimating methods, sensitivity/risk analysis, and estimate updates. |
| 01–02 | GAO Agile Assessment Guide (GAO-24-105506) + Assemble Teams synthesis | Outcome/user framing translates customer, mission-outcome, incremental-delivery, and program-monitoring practices into a cross-sector pre-commitment question. |
| 08–09, 11–12 | Assemble Teams synthesis informed by GAO program-control guidance and NIST governance concepts | These are operating controls we recommend; they should not be read as a claim that GAO or NIST mandates this exact checklist. |
| 10 | NIST AI RMF 1.0 + Generative AI Profile | NIST grounds lifecycle governance, risk identification, evaluation, monitoring, and incident considerations. The specific human-authority control reflects Assemble Teams' risk posture, not a universal NIST mandate. |
Primary-source foundation
- GAO-20-48G — Technology Readiness Assessment Guide: evidence-based assessment of critical technology maturity and integration risk.
- GAO-20-195G — Cost Estimating and Assessment Guide: characteristics and practices for credible program cost estimates.
- GAO-16-89G — Schedule Assessment Guide: practices for reliable, logically sequenced program schedules.
- GAO-24-105506 — Agile Assessment Guide: best practices for incremental delivery, quality, customer feedback, and implementation.
- NIST AI Risk Management Framework: governance and lifecycle risk-management guidance, including the Generative AI Profile and 2026 critical-infrastructure profile work.
Put a real mission through the check.
Use the interactive version to identify evidence gaps without creating an account or sending your answers to Assemble Teams.
Run the readiness check →Get the next evidence-backed release.
Subscribe for occasional Mission Intelligence, research and newly published articles from Assemble Teams. This subscription is separate from Directory listing consent and GameChangers reservations.
Optional. We use your email for requested publication updates. See the Privacy Policy. You can ask us to stop future messages at any time.