Use AI with confidence, without a full-time CISO.
Your staff are already pasting work into AI tools, and your software vendors keep switching AI features on. I help you decide what is allowed, check the vendors, and put it in writing before a customer, an insurer or an inspector asks. For a fixed fee.
Why this lands on your desk now
You don’t need to be building AI to have an AI problem.
Shadow AI
People use free chatbots, note-takers and writing tools to get work done faster. Nobody told them which ones are safe, so client, patient or vessel information can end up in tools you never reviewed.
Vendors adding AI
Your EHR, email, accounting and fleet software may now process your data with AI features. Those features can change who sees your data and what the contract allows.
Customers and insurers asking
Security questionnaires and cyber-insurance applications are starting to ask how you govern AI. “We don’t have a policy” is a bad answer to write down.
What I do
Practical work you can show to a regulator, a customer or your insurer.
AI inventory
A list of every AI tool in use, including the ones inside software you already pay for, who uses it and for what.
Data-flow review
What information goes into each tool, where it is stored, whether it is used to train a model, and who can see it.
Policy and approvals
A short AI use policy in plain language, an approved-tools list, and a simple way for staff to ask before they adopt something new.
Vendor review
Contract and security review of your AI vendors, including business associate agreements where patient information is involved. This is the same third-party risk method I used at a global bank.
Risk assessment
Your AI use measured against the NIST AI Risk Management Framework and its Generative AI Profile, with the gaps ranked by what matters most.
Training and oversight
One practical session for your staff, and a regular check that the rules are being followed and the inventory is current.
What I measure against
There is no single AI law that covers every small business, so I anchor your program to frameworks that customers and insurers already recognize.
NIST AI Risk Management Framework
A voluntary framework from the National Institute of Standards and Technology for managing AI risk. Its Generative AI Profile (NIST AI 600-1) covers the risks specific to tools like chatbots and image generators. This is my main yardstick.
The rules you already follow
HIPAA for patient information, the Coast Guard maritime cyber rule for vessel operators, and your customer contracts. AI doesn’t replace them. It adds new ways to break them, and that is what I look for.
If a customer asks you to align with ISO/IEC 42001, the AI management system standard, I can map your program to it. I don’t issue certifications, and I’ll tell you when an independent audit is the right next step.
Fees
Fixed price, agreed in writing before work begins. Start with the assessment, or go straight to the kit if you already know what you need.
AI Readiness Assessment
Find out what you are actually using and where the risk sits.
- Inventory of AI tools and AI features in vendor software
- Data-flow map for each tool
- Risk assessment against the NIST AI RMF
- Ranked action plan and a readout call
- Typically two to three weeks, for organizations up to 50 staff
AI Policy & Approval Kit
For when you already know what you use and need the rules.
- AI use policy written for your business
- Approved and prohibited tools list
- Request-and-approval form for new tools
- One-page staff guidance
- One-hour staff training session
AI Governance Program
The whole thing, finished and documented.
- Everything in the Assessment and the Kit
- Review of up to five AI vendors, including BAAs
- AI risk register
- Leadership briefing, in writing
- Your assessment fee is credited if you add the program within 30 days
How we get started
20-minute call
You tell me which tools you use, what kind of data you handle and who is asking questions. I tell you what I’d do first.
Written scope
A one-page scope with the fixed fee and what is in and out. You approve it, or you walk away.
Documents you keep
You get the inventory, policy and reports in plain language. They are yours, whether or not we keep working together.
Questions people ask
Should we just ban AI tools?
Usually not. A ban pushes use out of sight, which is worse. A short list of approved tools and clear rules about what data can go in is easier to follow and easier to defend.
We are a small practice. Do we really need this?
If anyone on your staff uses a chatbot, a transcription tool or an AI writing aid, you have AI risk. The work is proportionate: for a small team it is an inventory, a one-page policy and a check on the contracts.
Can we use AI tools with patient information?
Only if the vendor will sign a business associate agreement and the tool is set up so the data is handled the way HIPAA requires. Many popular free tools won’t sign one. I check this for each tool you use.
Are you certifying us or giving legal advice?
No. My work is advisory. I don’t issue certifications, audits or legal opinions, and I’ll tell you when you need an attorney or an independent auditor.
Do you build or deploy AI systems?
This service is about governing the AI you use, not building it. If you are developing your own AI product, tell me on the call and I’ll say whether I’m the right fit.
How is this different from the Virtual CISO retainer?
The retainer is ongoing leadership for your whole security and compliance program, and it includes AI governance. This page is for organizations that want AI governance as a defined, one-time project.
Book a free AI governance call
Pick a time that works. I’ll ask what you’re running and what’s driving the timing, and I’ll tell you honestly whether I can help.
Talk to me directly
305.481.4386Call or text and we’ll find a time. Or send a note with your best times and I’ll confirm within one business day.
Send a requestNo pitch on the call. If you don’t need me, I’ll say so.
Spiral Security Advisors LLC · Miami, Florida · Privacy Policy
Spiral Security Advisors provides advisory services only. Nothing here is an audit, attestation, certification, or legal advice, and no outcome with a regulator is guaranteed. Prices are starting points; final fees are set in a written scope before work begins.
Sources
- NIST: AI Risk Management Framework (AI RMF 1.0, voluntary)
- NIST AI 600-1: Generative AI Profile, July 2024