Engagement Options

Controls

You already have a security control list.

We add a short AI list beside it. The security list stays as it is.

Reference data

You already have an approved AI tools list.

We add what each tool is for, what data it sees, and who hosts it.

Risk management

You already have a way to score security risk.

We add how that AI can affect people, before you turn it on.

Review tracking

You already have reviews of policies and documents.

We add a check before a new AI tool goes live.

Evidence management

You already have the evidence.

We add what data is sent to each AI vendor, and how long they keep it.

Reference data

You already have the data named, and who owns it.

We add why you keep it, who receives it, and where it goes.

Controls

You already have the security list.

We add a privacy list beside it.

Risk management

You already have risks and threats tracked.

We add a check on how a new use of personal data affects people.

Communications

You already have a way to take requests.

We add a request from a person to see, correct, or delete their own data.

Review tracking

You already have a data owner named.

We add whether you decide how the data is used, or you handle it for someone else.

Risk management

You already have the systems that matter.

We add which business activities must keep going, how soon they must be back, and how much data you can afford to lose.

Initiatives

You already have a way to plan the work.

We add how you will get each activity back.

Reference data

You already have your processes.

We add a list of the plans, each one linked to the process and the document.

Review tracking

You already have practice with tabletops and backup checks.

We add tying each practice to a plan, not only to the equipment.

Controls

You already have security covered during a disruption.

We add a short checklist beside that: impact, recovery choice, plans, and practice.

Controls

You already have a security list.

We add a short quality checklist beside it: what the customer asked for, how you release the work, and what you do when it misses.

Reference data

You already have documentation for how the work is done.

We add what the customer asked for, and how you confirm you met it.

Review tracking

You already have security goals you measure.

We add quality goals beside them.

Evidence management

You already have problems and the correction recorded.

We add when the work itself misses what the customer asked for.

Communications

You already have a review of the program on a rhythm.

We add what customers say about the work.

Reference data

You already have systems and vendors listed.

We add the IT services you provide, and who they are for.

Communications

You already have reviews of your suppliers.

We add the service levels you promised your customer, and whether you met them.

Risk management

You already have security incidents tracked.

We add problems in the service that keep coming back.

Change management

You already have a way to run changes.

We add keeping each service change with that service.

Review tracking

You already have a review on a rhythm.

We add a simple report of how the service did.