# Glossary — CyberSentriq AI Governance ## Every term, _defined_ Plain-language definitions of every component, signal, market concept, and methodology term used across the CyberSentriq AI Governance framework. [Governance and Policy](/glossary#governance)[Technical and Signal Layer](/glossary#technical)[Compliance Frameworks](/glossary#compliance)[MSP Operating Model](/glossary#msp)[Wardley Mapping Methodology](/glossary#wardley)[Market Categories](/glossary#market) Governance and Policy AI usage policy A written document defining which AI tools are approved for use, what data may be submitted to them, and what process applies when staff want to use an unapproved tool. Approved tool register A maintained list of AI tools sanctioned for use, with the data-handling constraints, vendor compliance status, and regulatory applicability for each. Exception workflow A structured process by which staff request the use of an unapproved tool, the request is reviewed and approved or denied, and the decision is recorded with an expiry date. Shadow AI AI tool usage outside the approved register. Tools chosen by staff independently without IT approval. Industry data suggests 40–60% of AI use is shadow. Configuration drift The gradual divergence of a governance configuration from its certified or documented state. Approved tool lists go stale, sensitivity labels lose coverage, exception approvals expire without review. QBR evidence pack A structured, exportable report produced for client Quarterly Business Reviews. Shows AI tools in use, PHI/PII detection events, policy compliance summary, exception activity, and posture trend. Technical and Signal Layer DNS filtering Network-level control that blocks or allows access to web destinations based on domain. Used in shadow AI detection as a tool-level access signal. AI proxy / gateway A network control point that intercepts requests to AI providers, inspects the content (prompts, attachments), and applies policy before the request reaches the model boundary. Distinct from DNS in that it operates at the content level, not just the destination. Telemetry correlation The aggregation of governance-relevant events from multiple signal sources (DNS, RMM, Purview, backup, SIEM) into a unified event stream that can be monitored and reported on as a coherent posture indicator. PHI/PII detection Programmatic identification of Protected Health Information or Personally Identifiable Information in content. CyberSentriq uses a hybrid Presidio NER + PyTorch/ONNX 1D-CNN pipeline producing three severity tiers. Malware classification Identification of malicious files on backup data, with family classification across 14 named categories and severity tiering. Two-stage LightGBM pipeline. Compliance Frameworks ISO 27001 International standard for information security management systems. Widely adopted by managed service providers and clients in regulated verticals. ISO 42001 International standard for AI management systems, published 2023. Increasingly appearing in enterprise procurement questionnaires. EU AI Act Regulation (EU) 2024/1689. In force. Requires risk-based classification, documentation, and human oversight for AI systems used in EU markets. HIPAA US Health Insurance Portability and Accountability Act. Requires Business Associate Agreements (BAAs) for any vendor processing Protected Health Information, including AI tools. FCA AI guidance UK Financial Conduct Authority guidance on AI use in financial services emphasising explainability, non-discrimination, human oversight, and governance documentation. Cyber Essentials Plus UK government-backed cybersecurity certification scheme. 2024 update introduced instant failures for configuration drift, raising the standard for ongoing maintenance. UK Cyber Security and Resilience Bill UK legislation progressing through Parliament. Expected to expand security obligations across essential services. MSP Operating Model MSP Managed Service Provider. Delivers IT services (typically including endpoint management, cloud administration, security, backup) to client businesses on a recurring basis. PSA platform Professional Services Automation. The platform an MSP uses to manage tickets, time, billing, and service delivery. Common examples: HaloPSA, Autotask, ConnectWise, Kaseya BMS. RMM Remote Monitoring and Management. The platform an MSP uses to remotely deploy, monitor, and manage client endpoints. Common examples: NinjaOne, Datto RMM, ConnectWise Automate. Tenant In M365 and similar multi-customer SaaS, the customer's isolated administrative scope. An MSP typically manages many tenants. Entra ID Microsoft's cloud identity platform (formerly Azure Active Directory). The identity store backing M365 and many integrated SaaS applications. Copilot readiness A pre-deployment audit of an M365 tenant's permission, classification, and DLP configuration before enabling Microsoft Copilot. The most direct commercial entry point for MSP AI governance services. Wardley Mapping Methodology Wardley map A strategic map developed by Simon Wardley. Components are positioned on a 2D plane with visibility (how close to user need) on the Y axis and evolution (how commoditised) on the X axis. Value chain The dependency hierarchy of components from user need down through to infrastructure. Evolution stages Genesis → Custom-built → Product (+ rental) → Commodity (+ utility). Each component has a position along this axis. Climate Patterns of change that affect all components on the map (e.g., "everything evolves", "no choice on evolution", "competitor moves shift the map"). Doctrine Universal principles of strategy applicable regardless of the specific map. Gameplay Specific strategic moves available given the current map state. Market Categories Evidence layer CyberSentriq's category positioning (previously "fourth category"). Distinct from Group 1 (policy/risk tooling), Group 2 (technical/model governance), and Group 3 (advisory). Defined by the day-one output: a dashboard showing which AI tools are in use across all client tenants, with PHI/PII classifications from backup data and a QBR-ready evidence report. Day after you buy it test A market positioning diagnostic. Defines a product by what concrete output the buyer has the day after purchase. Source: jcarmona86, r/AI\_Governance taxonomy.