What it includes
- An AI use policy.
- A shadow AI review: which AI tools your people actually use, and what data went into them.
- An inventory of the AI tools in use.
- Vendor reviews of those tools, including supply chain risk: the models and third-party services each one depends on.
- A security review of the AI tools in use: prompt injection exposure, sensitive information disclosure and connector permissions. Least privilege: each assistant and connector should reach only the data its users need.
- Payment-verification controls, and a staff briefing on deepfake and voice-clone fraud.