Artificial Intelligence
Secure Generative AI for Business
Generative AI arrives in an organization whether or not anyone approves it. By the time the question reaches a security team, the useful version of it is rarely whether to allow it, but how to make the allowed path bette...
AI Identity and Access Management
The governing principle is one sentence, and almost every failure in this area is a departure from it. An AI system must not become a way around the authorization model an organization already has.
That sounds obvious. ...
Securing AI Agents in the Enterprise
An agent is an AI system permitted to act rather than only to answer. It can send the mail, update the record, open the ticket, move the file. Everything else about it is a variation on that one change, and that one chan...
What Is AI Governance?
AI governance is the system an organization uses to decide what artificial intelligence it will adopt, who owns each system, what data may go into it, who reviews what comes out, and what happens when something goes wron...
AI Governance Framework for Organizations
A governance framework is a list of the things a program has to cover, so that gaps are visible rather than discovered. This one has fourteen domains. Few organizations start with all of them, and the order they are buil...
How to Create an AI Governance Program
This is the order to build an AI governance program in, and the reasoning for the order. What the program has to contain is a different question, answered by the AI governance framework. This page assumes you have read t...
AI Inventory and Use-Case Management
An AI inventory is a current record of the AI systems an organization uses, who owns each one, and what data goes into it. It is the first thing a governance program builds and the thing every other control depends on.
T...
AI Risk Assessment
An AI risk assessment answers a narrow question: for this use of this system, what could go wrong, how badly, who would be affected, and what are we going to do about it.
This page is about the method. What the risks act...
AI Vendor Risk Assessment
Most AI in most organizations was never bought as AI. It arrived inside a product purchased for another reason, under terms agreed before the feature existed, and was switched on by an update.
That is the central fact of...
AI Governance Checklist
A checklist for working out where an AI governance program actually stands. Every item is a statement that is either true today or is not, which makes it usable in a meeting in a way a maturity score is not.
It is derive...