Guides
Guides for managing AI risk
Step-by-step guides, templates, and checklists for AI permissions, policies, vendors, incidents, HIPAA, and law firm governance.
- How to audit AI permissionsA practical, step-by-step method for finding every AI tool and agent in your organization, mapping what each can read, write, send, and execute, and reducing access to what is actually needed.
- AI risk assessment templateA free, usable AI risk assessment template: organization-level governance questions, a per-system assessment table, a severity model, and a prioritization method you can use today.
- AI acceptable-use policy: what to includeWhat an effective AI acceptable-use policy covers — approved tools, data rules, agents, output review, disclosure, incidents — and how to roll it out so employees actually follow it.
- AI agent security checklistAn actionable security checklist for AI agents that send, write, delete, execute, or pay: identity, least privilege, approvals, prompt-injection defenses, logging, limits, and kill switches.
- Shadow AI discovery: find the AI tools employees already usePractical methods to discover unapproved AI tools and agents — OAuth grants, SSO logs, expenses, browser extensions, network data, code scanning, and surveys — and what to do with what you find.
- AI vendor risk review: questions to askA vendor review framework for AI tools: data use and training, retention, sub-processors, security posture, contracts (DPA, BAA), model behavior, agent capabilities, and exit.
- AI incident response planHow to extend your incident response plan for AI: common AI incident scenarios, detection, containment steps such as agent kill switches and credential revocation, notification considerations, and tabletop exercises.
- HIPAA and generative AI: a practical guideHow HIPAA applies when healthcare organizations use generative AI: when a BAA is required, minimum necessary, de-identification, workforce use, security rule safeguards, and a practical control checklist.
- Generative AI governance for law firmsHow law firms can adopt generative AI while protecting client confidences: professional duties, approved tools, confidentiality and privilege, supervision, client communication, billing, and a governance checklist.
- AI governance for small and mid-sized businessesA right-sized AI governance program for organizations without a dedicated security team: the five controls that matter most, a 90-day plan, and how to answer customer and insurer questions about AI.