AI applications can expose sensitive data, mishandle permissions or follow malicious instructions embedded in untrusted content. Reviews examine prompt injection and unsafe tool execution, access and identity, model and data supply chains, output validation, logging and monitoring, and human oversight.
Governance work can include vendor assessment, risk classification, policies and accountability. NIST AI Risk Management Framework and ISO/IEC 42001 may inform an agreed review. Framework mapping is advisory and does not imply certification. Controls are evaluated against the actual system and its consequential decisions.
What we focus on
- Sensitive data protection
- Prompt injection and tool boundaries
- Vendor and supply-chain review
- Human oversight
- Governance and accountability
Clear, useful deliverables.
The final scope determines the deliverables included in your engagement.
- AI system and risk inventory
- Threat and control review
- Policy and ownership recommendations
- Evaluation and monitoring plan
A considered engagement process.
- 01Map AI systems and data flows
- 02Classify risk and decisions
- 03Review controls and vendors
- 04Define governance and evaluation
- 05Validate improvement actions
Your questions, answered.
What will we agree before work begins?
We define objectives, assets and data involved, access requirements, deliverables, exclusions and acceptance criteria. Availability and the delivery team are confirmed before a written scope is agreed.
What can our team expect to receive?
The agreed deliverables can include ai system and risk inventory, threat and control review, policy and ownership recommendations, evaluation and monitoring plan. Recommendations identify priorities and next steps; implementation and follow-up are scoped separately unless included in the agreement.
How do we start?
Book an initial consultation to discuss ai security & governance. The consultation clarifies needs and scope; it does not constitute a completed assessment, certification or implementation.
Reference: NIST AI Risk Management Framework.