Copilot readiness checklist

Why run this

What this checklist is for

Copilot reaches whatever the person asking can reach. It does not create a permission problem — it audits the one you already have, in public, on the first day of the pilot.

In healthcare that matters more than most sectors, because the content most likely to be overshared is exactly what a clinician might reasonably ask about.

Run it with

CIO or IT Director

And with

SharePoint and Microsoft 365 administrators

And with

Privacy or compliance officer

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Licensing and prerequisites

The things that stop a deployment before it starts.

Microsoft 365 E3 or E5 confirmed for every intended Copilot userCopilot requires a qualifying base licence. Check entitlement rather than assuming, particularly for clinical staff on shared or frontline plans.
SharePoint Advanced Management licensed and the admin role assignedFile-level governance reporting needs the SharePoint Advanced Management Administrator role, which must be assigned explicitly — global admins do not hold it by default.
Purview Audit enabled tenant-wideWithout audit, you cannot evidence what Copilot reached or what was sent in a prompt. This is a prerequisite, not a follow-up.
A named executive sponsor with authority to delay the rolloutIf the assessment cannot change the timeline, it is a formality. Establish this before you start looking.
Pilot group agreed, including at least one clinical functionAn IT-only pilot proves the technology works and tells you nothing about whether it is safe in clinical hands.

Section 2

Permission and oversharing position

Where almost every paused pilot has been paused.

Sharing links report exported and reviewedExport rather than review on screen; the row counts defeat a dashboard. Look for anonymous and organization-wide links first.
Everyone Except External Users exposure quantifiedThis is the single most common oversharing pattern and the one that surfaces fastest in a Copilot query.
Sites with broken permission inheritance identifiedInheritance broken years ago has been drifting since. These are usually a small number of sites carrying disproportionate risk.
Every in-scope site has a named, responsive ownerOrphaned sites block remediation entirely, because nobody is willing to approve a permission change without an accountable owner.
Guest and external access reviewed against current needAccess granted for a project that ended is the most common finding and the easiest to remediate.

Section 3

Data classification and protection

What determines whether an answer is safe as well as accurate.

Sensitivity label taxonomy defined and under five top-level labelsMore than five and misclassification becomes routine, which produces false confidence rather than protection.
Auto-labelling simulated for at least one full week before enforcementSimulation tells you what would have been labelled. The first simulation is almost always wrong, which is the point of running it.
PHI locations identified through Content ExplorerYou cannot protect what you have not located. Expect the distribution to surprise you.
Encryption tested against your clinical application setEncryption is the label capability that breaks integrations. Test with the actual applications before enforcing.
Retention applied so superseded and draft content is disposed ofAn assistant that can reason across your content will reason across material you should have deleted, including superseded clinical drafts.

Section 4

Governance and adoption

The half that determines whether it delivers value.

Acceptable-use position agreed and communicatedWhat Copilot may and may not be used for clinically. Write it before the licences arrive, not after an incident.
A route for users to report a wrong or inappropriate answerWithout one you will not hear about problems until they escalate. Monitor the reports weekly during the pilot.
Measurement defined in tiers: usage, then time and quality, then business outcomesAnyone promising business KPIs before usage data exists is guessing. Set the tiers before the pilot starts.
Champions identified in each pilot function, not only in ITAdoption travels through trained peers faster than through central communications, and clinical peers carry more weight than IT.
A re-baseline of the oversharing position scheduled post-remediationContent keeps arriving. Without a recurring review the position you established will drift within a year.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

Oversharing not yet quantified

Run the assessment before assigning licences. It typically adds six weeks to the timeline and it is considerably cheaper than an incident during a clinical pilot.

No sensitivity labelling

Start with a five-label taxonomy and auto-apply to the two or three highest-volume sites. Perfect coverage is not the prerequisite; a defensible baseline is.

Site ownership incomplete

This blocks everything downstream. Reconcile ownership first — it is administrative rather than technical and it is usually the longest part of the project.

No measurement plan

Define the three tiers now. A pilot with no baseline cannot demonstrate value, and the programme loses its sponsor at the first budget review.

Want a second opinion on your score?

We run this assessment as a scoped, fixed-price engagement. The findings report is yours whether or not you take the remediation work further with us — including if it tells you to delay.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

defender

healthcareReadiness

Ransomware readiness checklist

Twenty checks framed around the only question that matters in a provider organization: how long can you deliver safe care without systems?

May 23, 2026 · 20 checksOpen

azure

healthcareReadiness

Cloud workload security review

Twenty checks on an Azure workload holding patient data, covering network, identity, keys and the evidence an auditor will ask for.

May 2, 2026 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Licensing and prerequisites

Permission and oversharing position

Data classification and protection

Governance and adoption

Read this against the number above

If you could not tick these, start here

Oversharing not yet quantified

No sensitivity labelling

Site ownership incomplete

No measurement plan

Want a second opinion on your score?

Related checklists

Ransomware readiness checklist

Cloud workload security review

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email