#technicalcontrols — Public Fediverse posts

@todd_a_jacobs This is insightful. #Cybersecurity isn't just about buying cool new enterprise software or (re-)designing new processes or #technicalcontrols. Sometimes it's just about understanding the tools you already have, and understanding how to access the data you need for #loganalysis, to correlate multi-system logs, or perform other core security functions.

This informative reference hurts my head, it’s not the words, it’s the depth and layering that it takes to build and test controls that an assessor can understand and verify. Policy stuff is not bad, it’s technical controls.

Establish AI risk management policies that explicitly address mechanisms for collecting, evaluating, and incorporating stakeholder and user feedback that could include:
Recourse mechanisms for faulty AI system outputs.
Bug bounties.
Human-centered design.
User-interaction and experience research.
Participatory stakeholder engagement with individuals and communities that may experience negative impacts.

also seems like I am the only one knee deep in learning all this AI compliance at an implementation level. That can’t be right, where you all at? #GRC #Compliance #AI #TechnicalControls