AI Risk Assessment
shadow AI is the new shadow IT.
AI risk assessment for SoCal businesses with employees already using ChatGPT, Copilot, Gemini, and Claude — whether IT sanctioned it or not. WCC's assessment maps actual AI usage, identifies data exposure and IP leakage paths, and produces an acceptable use policy with technical controls. NIST AI Risk Management Framework alignment. Compliance frameworks (HIPAA, GLBA, NIST 800-171) addressed.
AI risk assessment — for the AI already inside your business
ChatGPT. Microsoft Copilot. Google Gemini. Claude. GitHub Copilot. Every modern AI assistant is already running inside your business — whether IT sanctioned it or not. Employees paste customer data into prompts. Engineers use AI to write code that touches production. Sales uses AI to draft proposals with confidential information. Shadow AI is the new shadow IT.
The visibility problem is real. Most businesses cannot answer basic questions: which employees use which AI tools, what data is being sent to which services, whether AI vendors retain or train on submitted data, whether AI-generated code touches regulated systems. Compliance frameworks have started to respond — the EU AI Act, NIST AI RMF, California SB 942, and sector-specific guidance from HIPAA, GLBA, and PCI. Most acceptable use policies and technical controls have not caught up.
This page covers WCC's AI risk assessment. For executive ownership of AI strategy, see vCISO services. For broader policy and training, see the cybersecurity hub. Start with a free IT consultation.
Three AI realities most acceptable use policies miss
AI tools changed faster than policy. Most acceptable use policies were written before ChatGPT existed. These are the three gaps that show up in nearly every assessment.
Shadow AI is the new shadow IT
Employees use AI tools their employer hasn't sanctioned — on personal accounts, browser extensions, mobile apps. Customer data, source code, financials, and IP get pasted into prompts. Most businesses have no visibility into which tools, what data, or what retention policies apply.
Vendor data handling varies wildly
ChatGPT free vs ChatGPT Team vs ChatGPT Enterprise have completely different data retention and training policies. Same for Copilot vs Copilot for Microsoft 365. The tier choice determines whether your data trains the next model. Most employees use the free tier.
Compliance frameworks are catching up
NIST AI Risk Management Framework, EU AI Act, California SB 942, and sector-specific guidance (HIPAA, GLBA, PCI, NIST 800-171) all impose obligations on AI use. The acceptable use policy from 2022 doesn't address any of them. The cyber insurance renewal asks about AI controls.
Why choose WCC for an AI risk assessment
AI risk assessment requires both regulatory framework expertise and operational visibility into what employees are actually doing. The right partner has both — not just AI hype, not just generic policy templates.
Framework-aligned assessment
WCC's AI risk assessment is structured around the NIST AI Risk Management Framework — the federal reference standard for AI risk — covering Govern, Map, Measure, and Manage functions.
Regulated infrastructure experience
Two decades of compliance-aware infrastructure work means AI risk gets evaluated against actual regulatory obligations (HIPAA, GLBA, NIST 800-171, PCI), not generic concern.
ChatGPT · Copilot · Gemini · Claude
All major AI platforms covered. Enterprise vs consumer tier data handling documented. Vendor data retention and training opt-outs mapped per tier.
Policy + technical controls
Assessment delivers an acceptable use policy and technical controls — not just a risk register. Implementation support available via vCISO services or managed engagement.
The six service areas of an AI risk assessment
Every AI risk assessment follows the same six-area structure. Each engagement is scoped to organization size, regulatory environment, and existing AI maturity.
AI Usage Discovery
Network and endpoint discovery of actual AI tool usage. Which platforms. Which employees. What data flow patterns. Includes consumer-tier usage and browser-based access outside sanctioned IT controls.
Data Flow Mapping
Mapping of what data is being sent to which AI services, vendor data retention policies, training opt-outs available, and regulated data exposure paths (PHI, PII, CUI, cardholder data, financial information).
NIST AI RMF Assessment
Structured assessment against the NIST AI Risk Management Framework four core functions: Govern, Map, Measure, Manage. Risk register with prioritized findings, regulatory mappings, and remediation recommendations.
Acceptable Use Policy
Written acceptable use policy covering sanctioned tools, prohibited use cases, data classifications, and required disclosures. Aligned with HR policy, IT policy, and applicable compliance frameworks. Board-approval ready.
Technical Controls
DLP rules for AI service traffic. Conditional access for AI platforms. Audit logging of AI access. Browser-based access controls. Approved-tool enforcement via Entra ID or Okta. See MFA management.
Workforce Training
Role-based AI training. Engineering, sales, marketing, HR, finance — each gets training tuned to actual use cases. Phishing-style AI prompt-injection simulations. Completion tracking and remediation.
AI risk assessment — common questions
The NIST AI Risk Management Framework (AI RMF 1.0, released January 2023) is the federal reference standard for managing AI risk. It defines four core functions: Govern (organizational AI risk culture and policy), Map (context and use case identification), Measure (risk analysis and assessment), and Manage (risk treatment and monitoring). WCC's AI risk assessment is structured around these four functions, with deliverables mapped to each — producing artifacts auditors and regulators recognize as framework-aligned.
ChatGPT Free and ChatGPT Plus (consumer) tiers can use submitted prompts and conversations for model training unless the user opts out. ChatGPT Team and ChatGPT Enterprise tiers contractually exclude submitted data from model training and add SOC 2 compliance, SSO, and audit logging. Same pattern for Copilot consumer vs Copilot for Microsoft 365, and Gemini consumer vs Gemini for Workspace. Most employees use the consumer tier — which means most submitted prompts are subject to consumer terms. WCC's assessment maps tier usage per platform per user group.
Yes — for almost every business. An acceptable use policy for AI defines which tools employees can use, what data classifications can be shared with each tool, prohibited use cases (regulated data, customer information without consent, source code with IP value), and required disclosures (AI-generated content marking). The policy is foundational for both compliance (NIST 800-171, GLBA, HIPAA) and cyber insurance. WCC's AI risk assessment produces a board-ready acceptable use policy as a deliverable.
AI use intersects every regulated data class. HIPAA covers PHI submitted to AI services — most consumer-tier AI is not HIPAA-eligible. GLBA Safeguards covers customer financial information in AI submissions. PCI DSS covers any cardholder data. NIST 800-171 covers CUI for federal contractors — submitting CUI to consumer AI is a 3.13 control violation. WCC's assessment maps AI usage against your applicable compliance frameworks and identifies exposure paths explicitly.
Several layers of technical controls are available. DLP rules can detect and block regulated data patterns in AI service traffic. Conditional access policies (via Entra ID or Okta) can restrict AI tool access to managed devices and approved users. Browser-based controls (via SSE/CASB platforms) can monitor and restrict consumer-tier AI usage. Audit logging captures who accessed what AI service when. Approved-tool enforcement makes sanctioned tools easy and consumer alternatives blocked. WCC's assessment identifies which controls fit your environment.
Pricing depends on organization size and scope. A standalone AI risk assessment for a small business (under 50 users) typically runs $6,500-$12,000 as a fixed-fee engagement covering discovery, mapping, NIST AI RMF assessment, acceptable use policy, and control recommendations. Mid-market businesses (50-300 users) typically run $12,000-$25,000. Enterprise engagements scope per assessment. Implementation of recommended controls is priced separately or rolled into broader vCISO services.
AI risk assessment across Southern California
WCC delivers AI risk assessments across all six SoCal counties — remote-first since assessment work is largely cloud-delivered. Headquartered in Chino.
Your employees already use it. Do you know what they're pasting in?
ChatGPT, Copilot, Gemini, and Claude are inside your business already. The question is what data is being sent, what vendors are doing with it, whether compliance frameworks are being violated, and whether the acceptable use policy from 2022 covers any of this. WCC will assess, map, and produce a policy with technical controls — NIST AI RMF-aligned.