← All posts

Industry Verticals

257 posts on industry verticals.

AI Gateway for Government Agencies: Identity and Audit for Public-Sector AI

Public-sector AI use carries obligations most agency deployments cannot yet meet: zero-trust access, a defensible record of automated decisions, and evidence for oversight and public-records requests. This piece shows how an AI gateway extends identity-aware access control and per-decision logging to model traffic, so an agency can govern AI use and produce the record its accountability rules assume.

government'public-sector''zero-trust''ai-audit''compliance'
Read post →

HIPAA-Compliant AI Tools: The Criteria That Decide Whether a Tool Qualifies

A vendor badge that reads "HIPAA compliant" answers one question and stays silent on the two that an OCR review probes. This guide gives healthcare compliance teams the three-part Security Rule test for any AI tool (a signed BAA under 45 CFR 164.502(e), access control under 164.312(a), and audit controls under 164.312(b)), walks the tool categories a covered entity actually assembles, and shows where the residual access-control and audit obligation stays with the covered entity after every BAA is signed.

hipaahealthcareai-complianceai-securityidentity-and-authorizationauditpolicy-enforcement
Read post →

NYDFS AI Compliance: Applying Part 500 Access, Audit, and Third-Party Controls to LLM Traffic

The NYDFS Cybersecurity Regulation, 23 NYCRR Part 500, requires covered financial entities to enforce least-privilege access, maintain audit trails, monitor authorized user activity, and govern third-party service providers. When employees and AI agents send data to LLMs, those requirements apply to the prompt traffic. NYDFS issued specific guidance in October 2024 on AI-related cybersecurity risks, and it maps to controls already in Part 500. This piece walks the Part 500 sections that land on AI inference traffic and shows how to enforce access and produce the audit trail the regulation requires.

nydfscompliancefinancial-servicesai-securityidentity-and-authorizationai-audit-loggingthird-party-risk
Read post →

GLBA AI Compliance: How the Safeguards Rule Applies When Customer Data Reaches an LLM

The FTC Safeguards Rule under GLBA requires financial institutions to run a written information security program with access controls, monitoring of authorized user activity, and oversight of service providers. When an employee or an AI agent pastes customer nonpublic personal information into an LLM prompt, that data becomes AI traffic to a third party, and the Safeguards Rule follows it there. This piece walks the specific Safeguards Rule provisions that land on AI inference traffic, where standard controls miss it, and how to enforce access and produce the audit record the rule expects.

glbacompliancefinancial-servicesai-securityidentity-and-authorizationai-audit-loggingdata-protection
Read post →

CMMC AI Compliance: Applying the Access Control and Audit Families to LLM Traffic Handling CUI

The CMMC Program, established by the DoD final rule at 32 CFR Part 170 effective December 16, 2024, requires defense contractors handling Controlled Unclassified Information to meet the NIST SP 800-171 controls, with Level 2 assessed against those requirements. The Access Control and Audit and Accountability families apply directly when a contractor employee or agent sends CUI into an LLM prompt. This piece walks the 800-171 control families that land on AI inference traffic, where standard controls miss it, and how to enforce access and produce the audit record an assessor samples.

cmmccompliancegovernmentai-securityidentity-and-authorizationai-audit-loggingcontrolled-unclassified-information
Read post →