The Foundation Your Governance Program Is Built On — Managed, Monitored, and Always Running.

Because most governance controls are enforced at the infrastructure layer. Access review, multi-factor authentication, encryption at rest, log retention and backup verification are all properties of how the environment is configured. A policy that promises them without control of the infrastructure is a description of someone else’s system. That is why we manage the environment rather than advising on it.

Operationally, usually yes. Evidentially, usually not. Most managed service agreements are written around uptime, response time and ticket resolution, none of which produce the artefacts an examiner asks for. The common gap is not that a control is missing but that nobody can show when it was applied, to which systems, and what the exceptions were. If your MSP can produce that, the layer is covered.

In practice: an inventory of systems holding regulated data, proof that access is provisioned and removed on a defined process, evidence that multi-factor authentication is enforced everywhere it is claimed with documented exceptions, backup restoration tested rather than merely scheduled, and log retention long enough to reconstruct an incident. The pattern is consistent — they ask for evidence the control operated over a period, not a screenshot from today.

An AI assistant inherits whatever the underlying environment allows. If a user can reach a folder they should not, so can the assistant acting for them, at machine speed and across everything at once. Most AI data exposure we see is not a novel AI problem; it is an existing permissions problem that AI made trivially easy to surface.

Rarely. Most environments do not need replacing so much as governing — configuration corrected, access rationalised, evidence collection made continuous. Where a component genuinely cannot support the controls a firm needs, we say so and scope the change deliberately rather than folding it into a migration nobody asked for.