CyberReady architecture
A governance operating model built for K-12 cybersecurity and AI.
CyberReady separates external frameworks, operational compliance tracking, evidence-supported maturity, and software workflow so leaders can see what each measure does—and does not—mean.
Four layers
From external reference to operating record
External reference frameworks
NIST CSF 2.0 and NIST AI RMF 1.0 provide reference architecture. CyberReady does not own, certify, or speak for NIST.
Governance & Compliance
One district-scoped workspace tracks framework criteria as Met, Partially Met, Not Met, or Not Evaluated and maintains an AI-system inventory.
CyberReady maturity systems
CCRR 1.0 with CEAM 1.0 evaluates cybersecurity maturity. CAGR 1.1 with CAIRE 1.0 evaluates AI governance maturity.
Hall Monitor
The software implementation manages evidence, ratings, gaps, roadmaps, immutable submissions, administrator review, reassessment, and reporting.
Governance & Compliance
One workspace, two supported framework views
Operational status tracking is kept separate from maturity scoring.
All Frameworks
A combined, source-labeled view without inventing equivalence between criteria.
NIST CSF 2.0
Cybersecurity framework, category, and criterion tracking.
NIST AI RMF 1.0
AI governance tracking across GOVERN, MAP, MEASURE, and MANAGE using repository-supported mappings.
Compliance tracking: Met, Partially Met, Not Met, or Not Evaluated. These are CyberReady operational statuses—not NIST maturity levels, certifications, or legal determinations.
Self-Assessment
Two proprietary maturity systems with one shared vocabulary
Current maturity is evidence-supported operating state. Target maturity is desired future state and never increases the current score.
Cybersecurity
CCRR 1.0 + CEAM 1.0
Six NIST CSF-aligned Functions, 18 CyberReady Readiness Domains, evidence validation, confidence, seven gap types, sequential advancement, and reassessment.
AI governance
CAGR 1.1 + CAIRE 1.0
Four NIST AI RMF-aligned Functions, 19 categories, 67 mapped subcategory records, evidence-centered assessment, gaps, improvement actions, and reassessment.
LEVEL 1
Ad Hoc
LEVEL 2
Developing
LEVEL 3
Established
LEVEL 4
Measured
LEVEL 5
Resilient
CCRR and CAGR contain domain- and category-specific criteria. The shared labels do not make the methodologies interchangeable.
Assessment lifecycle
Draft → Saved → Submitted → Reviewed → Reassessed
District users retain their submitted rating while authorized administrators can record agreement or a separate auditor-supported rating and rationale.
Draft and edit
Save and resume
Immutable submission
Administrator review
New reassessment cycle
See the implementation layer.
Explore Hall Monitor or request a controlled acquisition briefing.