Category
AI governance
Governing AI systems and AI agents: ISO 42001, the NIST AI RMF, AI vendor reviews and the AI questions now appearing in security reviews.
11 articles
AI governance
Shadow AI: finding the tools your teams already use
Where to look for unapproved AI tools: identity grants, expenses, browser extensions, network logs, features in existing SaaS, code. Then how to triage.
6 min read
AI governance
Human approval for AI-drafted compliance work
How to approve AI-drafted policies, questionnaire answers, and control text so the approval means something: what to check, what to record, what not to draft.
6 min read
AI governance
Governing AI agents with scoped access
How to govern AI agents that act on your systems: their own identities, task-scoped permissions, approval gates for risky actions, and a usable trail.
6 min read
AI governance
Keeping an AI system inventory
What belongs in an AI system inventory, the fields worth keeping, where entries come from, and the change triggers that stop it going stale in months.
6 min read
AI governance
The AI questions now in security questionnaires
The AI questions customers add to security questionnaires, what each one is testing, the facts to gather before answering, and the answers that go wrong.
6 min read
AI governance
AI vendor risk: questions to ask before you adopt a model
The questions to add to vendor due diligence before adopting an AI model or AI feature: data use, retention, hosting, model changes, incidents, contracts.
6 min read
AI governance
Writing an AI acceptable use policy
How to write an AI acceptable use policy staff will follow: scope, approved tools, data rules by classification, output review, prohibited uses, upkeep.
6 min read
AI governance
The NIST AI Risk Management Framework, explained
What the NIST AI RMF 1.0 is, its trustworthiness characteristics, what Govern, Map, Measure, and Manage each ask for, and how it fits next to ISO/IEC 42001.
6 min read
AI governance
ISO 42001 Annex A controls explained
The nine ISO/IEC 42001 Annex A control areas: what each covers, the evidence an auditor samples, which ones are new work, and how to justify an exclusion.
6 min read
AI governance
Building an AI management system
A practical build order for an ISO/IEC 42001 AI management system: scope, policy, risk and impact methods, controls, and the first full audit cycle.
6 min read
AI governance
What ISO 42001 certifies
ISO/IEC 42001 certifies an AI management system, not a model. What the certificate attests, what it leaves out, and how to read one a vendor sends.
6 min read