Assessments

An assessment is a structured walk through the questions of your framework packs. New assessment asks two things first: what you are assessing (your organization's program, or one system), and which kind: an AI governance assessment or a HIPAA assessment. A system is offered the kinds its flags call for: AI governance when it uses AI, HIPAA when it handles ePHI. A system's own page starts each kind with the subject already chosen. Each question is answered Yes, No, Partial, or N/A, with optional notes and supporting evidence.

The Assessments list shows each assessment's subject, the frameworks it selects beyond its kind's core packs, and, once you hold assessments of both kinds, a Kind column and filter.

Running an assessment

Create an assessment and name it, and choose the frameworks it reports against. Every AI governance assessment asks the NIST AI RMF 1.0 and NIST AI 600-1 (Generative AI Profile) questions (the generative AI ones only where generative AI is in use). Every HIPAA assessment asks the HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06) and HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06) questions on Premium and Enterprise; on the Free plan it asks the HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06) questions only. Each also asks the questions of each pack you select; a pack you do not select is not asked. A renewal starts with the selection of the assessment it renews. You can change the frameworks later with Manage beside the assessment's frameworks while the assessment is open: removing a pack hides its questions and keeps any answers (they come back if you add the pack again), and you confirm how many answered questions it hides before anything is saved. A completed assessment's question set stays as it was completed.
Work through the questions, answering Yes / No / Partial / N/A with optional notes. Answers save as you go — you don't need to finish in one sitting. Marking a question **N/A requires a short justification** (e.g. "we operate no on-prem servers") so an auditor can tell a deliberate scoping decision from a skipped question — the note saves automatically once you enter it. You can also mark a whole section N/A with one shared justification.
Attach evidence to questions that an auditor would expect to see documented.
Optionally mark the assessment In review, an interim state that signals it's ready for an internal check while answers stay editable and no findings are generated yet. Then Complete when finished: completing locks answers and turns every gap (a "no" or "partial") into a tracked finding. An assessment with nothing answered cannot be completed. If some questions are still unanswered, completing asks you to confirm how many will be skipped: no finding is raised for an unanswered question, and the report covers only what was answered. You can reopen a completed assessment until its report is final (signed, and on a guided review countersigned by our team too); a final report stays as it was signed, and a renewal continues the work. Reopening a guided assessment revokes our countersignature (kept on record), since its answers may change: once completed again, the report waits for a new one. Your organization's own signature stays in place unless you revoke it on the report.

Start with the Critical questions

While an assessment is open, Start with the Critical questions lists the next unanswered questions the question bank marks Critical, and how many of them are answered. A No on one raises the most severe finding, and severe findings weigh the most in your HIPAA or AI governance score (the assessment score, a pass rate, counts every question alike), so answering them first gives you a useful picture early: each links to its question, and the list moves on as you answer. A contributor sees the Critical questions they answer. Nothing is skipped or filtered out; every other question is still asked, in any order you like.

Gaps so far

You do not have to wait for completion to act on a gap. While an assessment is open, Gaps so far lists every question answered No or Partial, by section. Create task raises a remediation task for one (named for the question, high priority for a No, assigned to you, with the answer's notes), or shows the task already raised (a contributor opens it when it is assigned to them). When the assessment is completed and the answer is still a gap, the finding raised for it takes that task, so the work you started is not lost or duplicated.

Assignment

Org admins can assign whole sections or individual questions to a teammate. Assigned users can edit only the questions assigned to them; everyone else sees the assessment read-only. The "Assigned to me" filter narrows the list to your work.

Delegating a section to an outside helper

Some sections are best answered by someone outside your organization, such as the vendor that supplies a system or a consultant. Invite external helper (on the assessment view, admins only) emails them a private link to answer just that section, no account needed. The link covers every question in that section of this assessment (on a system assessment, that includes the system-level questions), expires after 14 days, and can be revoked at any time; their answers are labeled with their name on the question ("answered by … — external helper") and in the audit trail. Guest links come with a paid plan; they are not on the Free plan.

A guided review

In a guided review, our team reviews your answers, flags any that need your attention on the report, and countersigns it, and the report is final only once both you and our team have signed. It is priced by quote. An org admin asks for one from the assessment's page (Request a guided review) while it is still being answered (for a completed one, ask on its renewal); our team then contacts you about pricing and next steps, and makes the assessment guided once the engagement is agreed. Our team may also make an assessment guided as part of an engagement agreed with you directly. Asking again while a request is open records nothing new. Only our team can make an assessment guided. A guided review starts only once your organization has recorded whether it handles protected health information (Settings, Organization, What your organization does): the answer decides whether a business associate agreement is owed first.

Deleting an assessment

An org admin can delete an assessment from the bottom of its page, after reading what it does and typing DELETE to confirm. A deleted assessment leaves your assessments, reports and scores: its report and certificate can no longer be opened, its findings leave the findings register, its exports, the auditor portal and every count, and every public badge issued for it is revoked at once. Its remediation tasks stay on Tasks until you close them, and its evidence files stay in your library. Nothing is erased, though: if an assessment was deleted by mistake, contact us and our team can restore it as it was, its findings with it (it needs a new badge).

Renewal & comparison

Completed assessments can be renewed into a new run that carries prior answers and section assignments forward. On a renewal, use Compare to prior run to see exactly what improved or regressed since last time.

While answering, each question shows a Prior assessment panel when a previous answer exists — the verdict (Yes/No/Partial/N/A), the date, and the prior note — with a Use this answer button that carries it forward in one click. The source is the renewal parent if set, otherwise your most recent completed assessment of the same kind and subject. The panel opens automatically on questions you haven't answered yet, so a year-over-year reassessment is mostly review-and-confirm.

AI help on a question (when AI is enabled)

Watney's helpers appear on each question:

Explain this requirement — a plain-language explanation of what the cited control asks for, examples of evidence that satisfy it, and the common pitfalls. It is grounded strictly in the requirement's stored framework text and recommended solution, and is cached per question so your whole team reuses one generation.
Draft with Watney — a non-binding starting point: a suggested answer value, editable draft notes, and the evidence you'd need to support it. It reflects an honest reading of what you've shown (it won't claim compliance you haven't demonstrated). You decide how to use it:
- Fill the fields drops the draft into the answer box for you to edit before saving — nothing is written until you click an answer.
- Apply to this answer saves the suggested answer and notes in one step. It asks you to confirm first, is recorded in the activity log, and can be edited or re-evaluated afterward — it's a faster path to the same save, not an automatic one.

What is sent is the requirement text, your own prior notes, and the AI summaries of evidence already attached to that control (so the draft reflects what's actually on file). Your notes are free text you typed, so they may contain personal or confidential information; keep it out of notes where you can. Watney's card page names the model provider and the models in use; its system card, which will describe how the provider handles what is sent, is not published yet.

Evaluate with Watney reads the answer you saved, your notes and the evidence attached to it, and says whether they support the answer.

After an AI evaluation, if the answer already has a finding (findings are generated from "no"/"partial" answers), the result offers a Draft remediation for this finding → link that takes you to the finding, where Watney can draft the remediation tasks to close it.