Solutions

AI governance for IT teams: a policy people follow, and controls that back it up

Your people are already using AI, often through personal accounts. ianAsher LLC writes a practical AI acceptable use policy with your leadership, then designs the identity, data protection and network controls that make it stick. Fixed fee, done in weeks.

Book a 30-minute review

Banning AI doesn’t work. Neither does a policy on its own.

Two recent studies show the gap:

Cyberhaven’s 2026 AI Adoption & Risk Report found 39.7% of AI interactions involved sensitive data, and about a third of ChatGPT use ran through personal accounts that bypass company sign-in and logging (Cyberhaven, Feb 11, 2026).
A Neon Cyber survey of 227 US knowledge workers (fielded May 2026) found 68.7% had pasted internal, sensitive or regulated data into AI tools in the previous three months, and 48.3% of workers who understood their company’s AI policy knowingly broke it anyway.

Blocking everything pushes AI use onto phones and personal accounts. A policy with no controls behind it gets ignored. Governance works when the approved path is easy and the risky path is visible.

What good AI governance looks like for an IT organization

An approved-tools list

Which AI tools are approved, which need approval, and which are prohibited, with company accounts and sign-in required.

Data rules people can apply in the moment

What data classes can go into which tools: public, internal, confidential, regulated, and client data.

Human review and ownership

AI output treated as a draft; who signs off on what; who approves new tools, handles exceptions, and reviews the policy (we suggest every six months).

Controls that match the policy

Identity and sign-in, data loss prevention, sensitivity labels, browser and network controls for AI services, logging, and rules for agents and connectors.

We align the policy and controls with the NIST AI Risk Management Framework and its Generative AI Profile (NIST-AI-600-1), the OWASP Top 10 for LLM Applications (2026 edition published August 2026), and NIST’s draft Cyber AI Profile (IR 8596). Where you’re working toward ISO/IEC 42001, we map to it. We’re not a certification body, and this sprint isn’t a certification audit.

The AI Governance & Acceptable Use Policy Sprint

Policy Pack

$1,950 fixed

60–90 minute working session with leadership on how AI is used today
Short staff survey on actual AI use
Custom AI acceptable use policy (plain language)
Approved / restricted / prohibited tools and uses list
Data handling rules by data class
One-page staff summary and acknowledgment process
One revision round

Full Sprint

$4,950 fixed

Up to 250 users, one Microsoft 365 or Google Workspace tenant

Everything in the Policy Pack, plus:
Data protection controls review (sign-in, app consent, labels, DLP, sharing)
Network and browser controls review for generative AI services
AI tool register and a control-to-policy map
Prioritized fix list, a 60-minute readout, and a short staff rollout session

Larger, multi-tenant or regulated environments: quote. Card payments carry a 3% processing fee shown at checkout; debit and ACH have none. Not included: legal advice (have counsel review the final policy), implementing the control changes, or certification audits.

How it works

1. Buy online or book a free 30-minute review. We will confirm scope after we hear from you.
2. Kickoff session and staff survey.
3. Draft policy and, for the Full Sprint, a parallel read-only controls review.
4. Revision, readout and rollout.

Most AI policies are written by people who never touch the firewall or the tenant. We’re network and security engineers, so the policy we write is one your current tools can actually enforce. We also provision Microsoft 365 and Google Workspace, so we know where the AI settings live.

AI readiness · AI Readiness Assessment · Security solutions · Microsoft 365

FAQ

Should we just block ChatGPT?: Blocking one site rarely stops use; it moves to phones and personal accounts. Most organizations do better approving a company-managed tool, restricting the rest, and logging AI traffic.
Do we need a separate policy for Copilot or Gemini?: Usually not. One AI acceptable use policy covers them, and the controls review checks what those assistants can see in your tenant.
Is this legal advice?: No. We write an operational policy and recommend your counsel review it before adoption.
How often should the policy change?: Review it at least every six months; AI tools change faster than most policies.
What about attacks that use AI against us?: A dedicated AI threat protection page is coming next. The Full Sprint already flags data exfiltration paths through approved AI tools.

Talk to us

Tell us about the environment

This form emails sales@ianasher.com. We will confirm scope and next steps from there. Prefer a live conversation? Book 30 minutes.