Third-party AI service risk management, supply chain security, and vendor assessments.
Stand up vendor AI assurance, inventory every AI tool and service the organization consumes, and baseline the metrics that prove shadow AI adoption is decreasing.
Explore →Publish the priority compliance map and the minimum policy stack governing AI/HAI tools and services consumed from third parties, so every obligation reaches a named policy and a named owner.
Explore →Give the people who select, contract for and administer AI vendors the role-based AI security literacy and the practical guidance they need to make safe decisions without asking, in the Vendors domain.
Explore →Publish an archetype-level threat library for the Vendors domain, tagged to the HAI TTPs and MITRE ATLAS, so threat modelling starts from a reusable baseline rather than a blank page.
Explore →Publish a base security requirements pack per vendors archetype, every requirement carrying a testable acceptance criterion, so teams inherit requirements rather than negotiating them.
Explore →Publish reference architecture patterns and an antipattern catalogue for each vendors archetype, so the secure design is the default path rather than an achievement.
Explore →Establish a two-lane design review for vendors AI changes with a published checklist and service level, so review is predictable enough that teams route through it.
Explore →Review what was actually built against what was designed and required for vendors AI assets, at go-live, with findings tracked to closure.
Explore →Baseline a foundational security test battery per vendors archetype that asserts the controls actually hold, and run it before every release.
Explore →Run one backlog for vendors AI issues with an AI-aware severity taxonomy and published service levels, so AI findings age and escalate like everything else.
Explore →Publish and apply a hardening baseline for each vendors AI archetype, so the operating environment enforces the controls rather than documenting them.
Explore →Establish a logging baseline per vendors archetype and a detection set covering the top threats, with retention set by the longest applicable obligation.
Explore →