Every term, defined

A written document defining which AI tools are approved for use, what data may be submitted to them, and what process applies when staff want to use an unapproved tool.

A maintained list of AI tools sanctioned for use, with the data-handling constraints, vendor compliance status, and regulatory applicability for each.

A structured process by which staff request the use of an unapproved tool, the request is reviewed and approved or denied, and the decision is recorded with an expiry date.

AI tool usage outside the approved register. Tools chosen by staff independently without IT approval. Industry data suggests 40–60% of AI use is shadow.

The gradual divergence of a governance configuration from its certified or documented state. Approved tool lists go stale, sensitivity labels lose coverage, exception approvals expire without review.

A structured, exportable report produced for client Quarterly Business Reviews. Shows AI tools in use, PHI/PII detection events, policy compliance summary, exception activity, and posture trend.

Network-level control that blocks or allows access to web destinations based on domain. Used in shadow AI detection as a tool-level access signal.

A network control point that intercepts requests to AI providers, inspects the content (prompts, attachments), and applies policy before the request reaches the model boundary. Distinct from DNS in that it operates at the content level, not just the destination.

The aggregation of governance-relevant events from multiple signal sources (DNS, RMM, Purview, backup, SIEM) into a unified event stream that can be monitored and reported on as a coherent posture indicator.

Programmatic identification of Protected Health Information or Personally Identifiable Information in content. CyberSentriq uses a hybrid Presidio NER + PyTorch/ONNX 1D-CNN pipeline producing three severity tiers.

Identification of malicious files on backup data, with family classification across 14 named categories and severity tiering. Two-stage LightGBM pipeline.

International standard for information security management systems. Widely adopted by managed service providers and clients in regulated verticals.

International standard for AI management systems, published 2023. Increasingly appearing in enterprise procurement questionnaires.

Regulation (EU) 2024/1689. In force. Requires risk-based classification, documentation, and human oversight for AI systems used in EU markets.

US Health Insurance Portability and Accountability Act. Requires Business Associate Agreements (BAAs) for any vendor processing Protected Health Information, including AI tools.

UK Financial Conduct Authority guidance on AI use in financial services emphasising explainability, non-discrimination, human oversight, and governance documentation.

UK government-backed cybersecurity certification scheme. 2024 update introduced instant failures for configuration drift, raising the standard for ongoing maintenance.

UK legislation progressing through Parliament. Expected to expand security obligations across essential services.

Managed Service Provider. Delivers IT services (typically including endpoint management, cloud administration, security, backup) to client businesses on a recurring basis.

Professional Services Automation. The platform an MSP uses to manage tickets, time, billing, and service delivery. Common examples: HaloPSA, Autotask, ConnectWise, Kaseya BMS.

Remote Monitoring and Management. The platform an MSP uses to remotely deploy, monitor, and manage client endpoints. Common examples: NinjaOne, Datto RMM, ConnectWise Automate.

In M365 and similar multi-customer SaaS, the customer's isolated administrative scope. An MSP typically manages many tenants.

Microsoft's cloud identity platform (formerly Azure Active Directory). The identity store backing M365 and many integrated SaaS applications.

A pre-deployment audit of an M365 tenant's permission, classification, and DLP configuration before enabling Microsoft Copilot. The most direct commercial entry point for MSP AI governance services.

A strategic map developed by Simon Wardley. Components are positioned on a 2D plane with visibility (how close to user need) on the Y axis and evolution (how commoditised) on the X axis.

The dependency hierarchy of components from user need down through to infrastructure.

Genesis → Custom-built → Product (+ rental) → Commodity (+ utility). Each component has a position along this axis.

Patterns of change that affect all components on the map (e.g., "everything evolves", "no choice on evolution", "competitor moves shift the map").

Universal principles of strategy applicable regardless of the specific map.

Specific strategic moves available given the current map state.

CyberSentriq's category positioning (previously "fourth category"). Distinct from Group 1 (policy/risk tooling), Group 2 (technical/model governance), and Group 3 (advisory). Defined by the day-one output: a dashboard showing which AI tools are in use across all client tenants, with PHI/PII classifications from backup data and a QBR-ready evidence report.

A market positioning diagnostic. Defines a product by what concrete output the buyer has the day after purchase. Source: jcarmona86, r/AI_Governance taxonomy.