AI & Cryptography Controls Evidence Pack Sprint
A fixed-scope 2-week engagement that produces an audit-ready evidence pack for AI systems and data security: model/agent integrity, secrets & key custody, encryption governance, certificate lifecycle controls, and operational runbooks.
Designed for CEOs, CISOs, GRC leads, and platform/security teams who need to prove control — not just buy another tool.
Why you need this (executive primer)
What boards & customers ask
- Who can change AI models/agents and approve releases?
- How do you prevent tampering and prove provenance?
- Where do secrets/keys live and who controls them?
- Can you prove encryption and lifecycle controls?
What goes wrong
- Audit findings and remediation programmes
- Delayed deals due to evidence requests
- Outages from unmanaged certificate renewal
- Untraceable AI changes and incident blame
What you get
- A control map + evidence pack (reproducible)
- Key custody & approvals model (SoD)
- Runbooks and ownership (RACI)
- A prioritised remediation backlog
Works with your existing vendors and platforms (cloud KMS/HSM, PKI, CLM, CI/CD, MDM/EDR, etc.).
Deliverables (audit-ready)
- Controls Map: AI + cryptography controls, owners, evidence sources, and control gaps
- Evidence Pack: exports/screens/config references + “how to reproduce” notes
- Key Custody & SoD Matrix: roles, approvals, break-glass, ceremony/runbook (where relevant)
- Encryption Governance: standards, exceptions process, and alignment across environments
- Certificate Lifecycle Controls: ownership, renewal runbooks, automation plan, outage paths
- Risk Register + Remediation Backlog: prioritised actions with timelines and dependencies
AI-heavy scope (what we actually verify)
- Model/Agent Integrity: who can modify, sign, approve, and deploy artifacts
- Provenance: traceability from training data → build pipeline → deployment
- Secrets Management: API keys, tokens, certs, encryption keys used by agents and services
- Least Privilege & Identity: human and workload identities, access paths, approvals
- Release Governance: CI/CD controls, signing gates, rollback, and emergency change rules
- Logging & Non-repudiation: what is logged, retained, and provable in incidents
Ideal for AI agents operating in production: decision automation, customer data workflows, edge SLM/LLM deployments, or regulated environments.
How it works (2 weeks)
Week 1 — Discovery & evidence collection
- System scoping: AI pipelines, agent runtimes, data flows, PKI/KMS/HSM, CLM
- Identify control owners: GRC, platform, security, dev teams, vendors
- Collect evidence: configs, screenshots/exports, logs, policies, approvals
- Gap analysis: missing controls, weak approvals, unclear key custody, unmanaged certs
Week 2 — Evidence pack & remediation plan
- Produce the controls map + evidence pack
- Define SoD model, break-glass, runbooks, and RACI
- Prioritise fixes: “stop-the-bleed” actions vs strategic improvements
- Handover: leadership summary + technical backlog
Who this is for
Executives
You need defensible proof for customers, auditors, and boards — without a 6-month programme.
GRC & Security
You need control mapping, evidence, SoD, and runbooks that stand up to scrutiny.
Platform / Engineering
You need practical remediation steps: CI/CD gates, signing, renewal automation, secrets hygiene.
FAQ
Is this a compliance service or a technical service?
Both — we produce governance evidence that is technically grounded. You get a board/audit-ready pack plus a practical remediation backlog for engineering teams.
Do you require us to buy specific tools?
No. We work vendor-neutrally and build a coherent controls story across your existing platforms (cloud, PKI, KMS/HSM, CI/CD, security tooling).
What do you need from us to start?
A list of AI systems/agents in scope, where they run, who owns them, where secrets live, where certificates terminate, and any existing policies or audit findings (if available).
Can this include PQC readiness?
Yes — we can add a PQC exposure summary (crypto-agility gaps and priority systems) as an optional module at the end of the sprint.