AI governance and risk management consulting using the NIST AI RMF and ISO 42001, with gap assessments, policies, vendor reviews, and readiness evidence.
Customers now ask how you govern AI before they will buy, insurers ask at renewal, and new laws in several states and the EU are setting real deadlines. This core builds the program that answers all of them. The risk and gap assessment measures what you run today against the NIST AI RMF and its Generative AI Profile and hands you a prioritized roadmap. Policy and governance work turns that roadmap into decision rights, an acceptable use standard, an intake process, and an inventory of approved tools. The vendor review covers the AI you buy. ISO/IEC 42001 readiness builds a management system an independent body can certify. The incident playbooks and tabletop extend your response plan to AI-specific failures. Every engagement runs the same rhythm: understand the requirement, find the gaps, build the controls, organize the evidence, and rehearse the assessment. None of it is legal advice, and none of it is a certificate.
CISOs, compliance leads, and general counsel at companies that have adopted AI assistants and features across the business, and product owners shipping AI into regulated or high-stakes decisions. Most arrive after a customer questionnaire, an insurer question, or a new state or EU deadline lands on their desk.
We begin with whatever created the need: the customer questionnaire, the insurer’s renewal application, or the memo from counsel about a new AI law. From it we fix which systems, which framework, and which deadline matter. Then we write a scoping memo naming the AI systems in play, the owners we will interview, and the evidence we need.
We build the inventory from sign-in records, procurement data, and interviews. Then we measure what you run against the NIST AI RMF, rating each area as not implemented, partial, or implemented, with the evidence cited. Generative systems get a second pass against the Generative AI Profile. Nothing is rated from a questionnaire alone; we read the settings, the contracts, and the logs.
You keep a workbook that ties every finding to the NIST AI RMF and ISO/IEC 42001, plus a roadmap naming an owner and effort for each gap. You also keep the policies, questionnaires, and playbooks the focused services produce. After you close a gap we re-check it and update the evidence index, so the next questionnaire is answered from dated evidence rather than intent.
Your current AI practice measured against the NIST AI RMF and the Generative AI Profile, with a roadmap that names an owner and effort for every gap.
From $4,500
Scope, pricing & FAQsAn AI policy and acceptable use standard, a governance charter with decision rights, a use-case intake process, and an inventory of approved tools and models.
From $4,500
Scope, pricing & FAQsTraining and retention terms, subprocessors, autonomy limits, and breach notification reviewed for the AI you buy, with a reusable questionnaire and contract language.
From $4,500
Scope, pricing & FAQsScoping your AI management system, a gap assessment against the full ISO/IEC 42001 standard, control build-out, and an internal audit before the certification audit.
From $15,000
Scope, pricing & FAQsPlaybooks for prompt injection, agent misuse, model compromise, and AI-assisted data theft, built into your existing incident response plan and proven in a tabletop.
From $5,200
Scope, pricing & FAQsThe selected services, deliverables, access requirements, and any follow-up validation are agreed in your engagement scope.
A focused conversation. A clear scope. A practical path to stronger security.
