Six-week AI Security and Compliance Initiative
AI risk assessment covering model security, data leakage exposure, prompt injection exposure (OWASP Top 10 for LLM Applications, LLM01:2025), shadow AI inventory, and regulatory alignment (NIST AI Risk Management Framework (AI RMF), EU AI Act Articles 9 to 15, US federal AI policy guidance, state AI laws, sector-specific guidance). Controls are designed to fit your existing security architecture. We design the architecture. Your team or your existing partners implement it.
Who this is for
An AI risk and compliance posture the board can review.
CISO
AI usage is expanding and you need a control architecture before the next audit or board review.
Chief Compliance Officer (CCO)
Regulatory exposure on AI is rising and you need a documented posture before new disclosure duties begin.
General Counsel (GC)
You need your AI governance posture documented in a form counsel and regulators can read.
Board / Audit Committee
You want AI risk reported in the same format you already use for other technology risk.
Scope
What this initiative delivers, and what it does not.
Scope is fixed at signing. Items marked TOP are available through the Technology Operating Partner (TOP) Program. Items marked with a firm type need a separate engagement with that kind of firm.
In scope
- Shadow AI inventory via tenant scans (Microsoft 365 Copilot, Microsoft 365 audit log, Azure AI Foundry, third-party SaaS AI features)
- Model security posture (which models, where, with what data access)
- Data leakage exposure mapping (prompt-to-storage paths, retention behavior, training-data inclusion risk)
- Prompt injection surface map, aligned to the Open Worldwide Application Security Project (OWASP) Top 10 for LLM Applications (2025), items LLM01, LLM02, and LLM06, across user-facing AI, agentic AI, and third-party AI inside SaaS
- Regulatory alignment review (NIST AI RMF; EU AI Act Articles 9 to 15 for high-risk systems and Article 50 for transparency; US federal AI policy guidance including OMB memoranda and FTC enforcement positions; state AI laws including the Colorado AI Act and NYC Local Law 144; sector-specific guidance), with the status of each item stated as of the delivery date
- Control architecture designed to fit existing security controls (identity, data loss prevention, logging, access)
- AI posture document written for board review
- Board presentation deck
Out of scope
- Implementation of control architectureTOP
- Red-team adversarial testing or model jailbreaking validationSpecialty firm
- Custom model security tuning or fine-tuningAI build firm
- Selecting AI vendors or replacing existing AI toolingTOP
- Litigation support or regulatory responseQualified counsel
Inputs
What we need from you
Provided at kickoff. Missing inputs delay the initiative; they do not change scope.
- Read-only access to Microsoft 365 / Azure tenant for shadow AI discovery
- Existing security architecture documentation
- List of approved AI tools and any current AI governance policy
- Four to six interviews (CISO, IT lead, GC or compliance lead, data lead, business AI sponsor if any)
- Recent audit findings or regulatory inquiries touching AI usage, if any
Timeline
Week by week
Status updates run throughout the work. The direction check with the CISO comes in week 2, well before the final posture document.
Week 1
Inventory and regulatory map
Shadow AI discovery via tenant scans. Regulatory inventory against NIST AI RMF, EU AI Act Articles 9 to 15, US federal AI policy guidance, state AI laws (Colorado AI Act, NYC Local Law 144), and sector-specific rules. Model-security inventory drafted.
Week 2
Risk surface and interviews
Data leakage paths and prompt-injection surface mapped. Four to six structured interviews. Direction check with the CISO.
Week 3
Control architecture design
Controls integrated with existing security architecture. Gaps against the current state documented. Architecture reviewed with CISO and IT lead.
Week 4
Posture document draft
AI posture document and board presentation deck drafted from the control architecture and risk surface work.
Week 5
Regulatory and sector alignment
Alignment summary completed against the frameworks in scope. Sector-specific work (healthcare, financial services, defense) and EU AI Act high-risk classification are covered here where they apply to the scope agreed at signing.
Week 6
Review, walkthrough, handoff
Final posture document, control architecture map, and deck delivered. Walkthrough with CISO and GC.
Output
What you walk away with
- Written AI security and compliance posture document
- Shadow AI inventory and risk classification
- Control architecture map integrated with existing security stack
- Regulatory alignment summary
- Board-presentation deck
- Walkthrough call
Limits
What this initiative is not
This initiative produces a posture document and a control architecture. Implementation is your responsibility or that of your existing security partners. Red-team adversarial testing, custom model fine-tuning, and active regulatory response are outside scope. Alignment covers the frameworks named in scope, and the status of each law or guidance is stated as of the delivery date. Sector-specific or jurisdictional advice may require qualified legal counsel. If this work may feed a legal matter, ask counsel whether to commission it through the legal department.
If you are a portfolio company
How the work fits a PE-backed company.
In a PE-backed company, the board and the sponsor read AI risk alongside other technology risk.
- Board cycle. The posture document and board deck are timed to land before the next quarterly board meeting.
- Add-on companies. AI tools that arrive with an acquired company are listed separately in the shadow AI inventory.
Related
Initiatives that pair with this one
FAQ
Questions buyers ask first
What is prompt injection and why does it matter?
Prompt injection means an attacker places instructions in content a model reads, and the model may follow them in place of the operator's. OWASP lists it first in its 2025 Top 10 for LLM applications (LLM01:2025). The initiative inventories the AI integrations it finds, maps the direct and indirect prompt injection exposure, and documents the controls each application has, mapped to the NIST AI RMF.
How do we secure AI agents in the enterprise?
AI agents need four controls: an identity, scoped permissions, action logging, and a way for the security team to stop an agent. The initiative designs those controls into your existing security architecture and maps the data each agent can reach. Your team or partners implement them.
For your role
Pages for your role
For Boards and Audit Committees →
What agentic AI means for board oversight, and what the board should ask before the first agent goes into production.
For Chief Compliance Officers →
The compliance officer view: OWASP Top 10 for LLM applications, NIST AI RMF mapping, EU AI Act transparency obligations, and prompt injection exposure mapping.
After the initiative
If you want the work to continue
This initiative is a one-time, fixed-price piece of work that ends with the posture document and control architecture. Implementing the controls and selecting AI vendors are available through the Technology Operating Partner Program. You choose the Program level after you have the document.
Ready to scope this
An AI risk posture document for your board. Six weeks.
Tell us the situation in a few sentences. We reply within one business day to confirm fit or point you to a better one.
Not sure this is the right initiative for your situation? Take the four-question path-finder for a personalized recommendation.