Meridian Financial Group

Top 5 Control Gaps

• Q1.1 — Does your organization maintain a complete inventory of AI, GenAI, RAG, Copilot, and agentic systems currently in use?
• Q4.3 — Are prompt injection, tool misuse, and data exfiltration risks technically mitigated?
• Q5.2 — Is sensitive data classified and masked before entering training, fine-tuning, or retrieval corpora?
• Q6.1 — Can your organization produce evidence showing who approved an AI use case, what data it uses, what risks were reviewed, and what controls were implemented?
• Q3.3 — Are model, prompt, and tool versions recorded with each inference?

Recommended Actions

1. 1
   Deploy automated AI discovery across cloud, SaaS, and code repos; consolidate into a governed inventory.

   Does your organization maintain a complete inventory of AI, GenAI, RAG, Copilot, and agentic systems currently in use?
2. 2
   Deploy prompt-injection and egress guardrails with continuous red-teaming.

   Are prompt injection, tool misuse, and data exfiltration risks technically mitigated?
3. 3
   Classify and redact sensitive data before it enters training or retrieval corpora.

   Is sensitive data classified and masked before entering training, fine-tuning, or retrieval corpora?
4. 4
   Package per-use-case evidence with approvals, risks, and controls on demand.

   Can your organization produce evidence showing who approved an AI use case, what data it uses, what risks were reviewed, and what controls were implemented?
5. 5
   Version and log model, prompt, and tool artifacts per inference.

   Are model, prompt, and tool versions recorded with each inference?