Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Data and AI

Classifying information, setting terms for AI tools, and assessing the AI features you build.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we classify information without everything ending up "Confidential"?
  2. How do we assess the security of a GenAI feature we are building ourselves?
  3. How do we decide whether a proposed AI use case can go ahead?
  4. How do we find and record all the AI we use, including AI inside tools we already own?
  5. How do we assess the risk and impact of an AI use case before we approve it?
  6. How do we review an LLM feature or an AI agent for security before it goes live?
  7. How do we defend an LLM application against prompt injection?
  8. How do we check an AI vendor or model provider before we rely on it?
  9. How do we test an LLM application the way an attacker would?
  10. How do we configure a generative AI service securely before it goes live?
  11. How do we track AI security findings and the deviations we accept?

When do we…

Triggers and timing: when something has to happen.

  1. When does personal data make a security incident a GDPR breach?
  2. When must staff who use AI have training, and what must it cover?

Who decides…

Authority: who may approve, accept or act.

  1. Who is accountable for an AI decision, and who can stop an AI use?
  2. What should an AI agent be allowed to do on its own, and what needs a person's approval?

Is it…

Judgements with a yes or no at their centre.

  1. Should staff be allowed to use public generative AI tools, and on what terms?
  2. Does the EU AI Act apply to our use of AI, and are we a provider or a deployer?

If…, then how…

Situations: something has happened, what now.

  1. If an AI vendor may train on our data, then what do we require?
  2. If staff are already using AI tools nobody approved, then what do we do?
  3. If an LLM application leaks data or is manipulated into a harmful action, then what do we do?

Other categories