For AI startups
Answer the AI questions enterprise buyers now ask
Security reviews now ask how you train, where customer data goes, and who approves model changes. Answer with evidence, not a slide.
Your security review grew an AI section
Enterprise questionnaires used to stop at access control and encryption. Now they ask whether customer data trains your models, which subprocessors see prompts, and how a model change is approved.
Those are reasonable questions, and answering them from memory in every deal is how answers drift apart.
What we do about it
SOC 2 first, ISO 42001 next
Run SOC 2 for the deal in front of you, then reuse those controls for ISO 42001, the management system standard for AI.
Show where customer data goes
Records of processing, subprocessors, and data flows kept current, so the data handling answer is the same in every review.
Govern your own AI agents
Give agents scoped access over MCP, require a named approver for changes, and keep an audit trail of what each agent did.
Consistent answers to AI questions
Answer the new AI questions once, have them reviewed, and reuse them from your answer library.
Frameworks you can start with
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.