AI tool inventory
Important AI tools, owners, business use cases and approval status.
FOLLOW THE DATA
Review every point where AI meets your business.
People & data
Prompts, files and company information
Approved use & staff guidanceAI tools
Accounts, models and supplier settings
Access & data retentionConnected systems
Documents, integrations and outputs
Permissions & sharingThe review scope is agreed around the tools and integrations your organisation uses.
WHAT THIS HELPS SOLVE
Focus the review on decisions that matter.
Shadow AI
Employees may adopt AI tools before management has visibility, ownership or an approval process.
Sensitive data exposure
Prompts, files, connectors and generated outputs can create new paths for confidential or personal information.
Supplier and access risk
AI services introduce questions around accounts, permissions, retention, integrations and third-party terms.
WHAT WE REVIEW
Scope shaped around your organisation.
Data handling
Check whether prompts and uploaded files include customer details, contracts or internal documents; define which data may be used.
Identity & access
Review account ownership, authentication, shared access and connector permissions across the agreed AI tools.
Supplier considerations
Relevant data handling, retention, contractual and security questions for AI suppliers.
Employee practices
Define approved tools, prohibited data uses and an escalation route when staff are unsure what they can share.
Governance controls
Policies, approval workflows, risk review and ownership of ongoing AI decisions.
WHAT YOU RECEIVE
Useful outputs for management and delivery teams.
✓
AI risk summary
A management-friendly picture of the most important AI security themes.
✓
Priority findings
Specific gaps in visibility, data handling, access, supplier controls or employee use.
✓
Control recommendations
Practical technical and governance controls proportionate to your environment.
✓
Action roadmap
A prioritised sequence for improving AI security without blocking useful adoption.
PROCESS
Simple, transparent engagement.
01
Scope
Understand the business context and agree what the engagement should cover.
02
Review
Assess the agreed controls, practices, evidence and relevant technology.
03
Prioritise
Separate material issues from lower-value improvement opportunities.
04
Act
Use the roadmap internally or ask ISTA to support the improvement work.
FAQ
Common questions
Is ChatGPT or Copilot safe for company data?
It depends on the data, account type, configuration, supplier terms and use case. The assessment focuses on the controls and decisions needed for your environment.
What is shadow AI?
Shadow AI is the use of AI tools or services without appropriate organisational visibility, approval or governance.
Does an AI policy solve the problem on its own?
No. Policy is one control. Effective AI security also needs visibility, access controls, supplier review, employee guidance and ongoing governance.
NEXT STEP
Discuss the right scope for your business.
Tell us what is driving the review and we will discuss a sensible starting point.