Adopt and operate generative AI safely — using the twelve risk categories in NIST AI 600-1 as the organizing spine, without building enterprise-scale governance overhead. A prioritized, owned, and scheduled risk treatment plan you can actually execute.
NIST AI 600-1 is voluntary guidance, and no body certifies against it. What this engagement produces is a documented, reasoned position on every one of the twelve generative-AI risks — and a plan a reasonable customer, insurer, or regulator would recognize as proportionate. It’s a strong framework, but a dense document written for a much larger organization. We do the translation.
Leadership has decided to roll out AI tools and wants controls in place before the launch — not after an incident.
AI arrived through individual staff subscriptions and embedded vendor features, and right now no one owns it.
Customers, insurers, and partners are asking AI governance questions in security reviews — and the answers are improvised.
Healthcare, finance, legal, education, or government supply chain — where AI use will eventually be examined.
Nobody can list which AI tools are in use, by whom, on what data. Risk can’t be assessed and questionnaires can’t be answered honestly.
The organization either does nothing, or attempts an enterprise program it can’t staff and abandons in month three.
AI decisions are made in conversation and never recorded. When a customer or insurer asks, there’s nothing to show.
Structured on the four AI RMF functions — Govern, Map, Measure, Manage. Every phase output is usable on its own if you stop early.
Executive alignment on risk appetite, decision rights, and who owns AI risk.
Discover every AI system and use case — sanctioned, shadow, and embedded.
Assess each of the twelve risks per use case: in scope, monitor, or out of scope.
The smallest effective control set, with owners, dates, and a costed roadmap.
Handover, a review rhythm tied to change events, and customer-facing assurance.
We don’t hand you a generic checklist. Each control is weighed on five practical dimensions — so the plan reflects what your business actually runs and where the real exposure sits.
Type · Ownership · Architectural Relevance · LLM Lifecycle · Threat Category
Security in AI is shared across the model provider, the application provider, and you as the AI customer. Our engagement makes that boundary explicit — then makes you strong on the parts you actually own.
Ownership, scope, risk appetite, and escalation. The document that makes AI risk somebody’s job.
A living register of every AI use, with owner, data classes, vendor, and contract position.
Each of the twelve NIST risks assessed per use case, with recorded reasoning. The core evidence artifact.
In-scope risks scored on likelihood, consequence, and controllability — with treatment decisions.
Plain-language policy on approved tools, data handling, and disclosure. Written for staff, not lawyers.
Selected actions mapped to Govern/Map/Measure/Manage, with the tests that prove each works.
Prioritized actions with owner, effort, and target dates across 90-day, 6-month, and 12-month horizons.
Board-ready summary of exposure, decisions taken, residual risk accepted, and investment required.
A two-page external statement of your AI governance position — sized for questionnaires and RFPs.
Fewer than ~50 staff and low-complexity, tool-only AI use. Establish ownership and a defensible baseline, fast.
Multiple business units or a regulated context. The full five-phase engagement across your AI footprint.
Custom builds, automation, or active customer scrutiny. Deeper testing, evidence, and ongoing support.
All tiers are fixed-fee and remote-first, with optional on-site workshops and recurring reviews.
Start with a free assessment. We’ll map where you stand against the twelve risks and scope the right tier — no pitch, no vendor agenda.
Request a Free Assessment