CISO Playbook: Turn SOC 2/ISO/HIPAA/FINRA into Runtime AI Policies in 30 Days

```yaml
version: 1.6
owner:
  team: Security Engineering
  control_owner: Compliance Operations
  approver_group: ServiceNow.CAB-AI
  escalation_pagerduty: ai-trust-layer-oncall
scope:
  apps: ["servicenow_kb_copilot", "internal_policy_assistant"]
  models_allowlist:
    us: ["azure-openai:gpt-4o-us", "aws-bedrock:claude-3-sonnet-us"]
    eu: ["azure-openai:gpt-4o-eu", "aws-bedrock:llama-3-70b-eu"]
  data_classes: ["PII", "ClientComm", "Internal"]
policies:
  rbac:
    description: Only approved roles may invoke models by data_class.
    rules:
      - role: Support.KB.Editor
        apps: ["servicenow_kb_copilot"]
        data_classes: ["PII", "Internal"]
      - role: Compliance.Analyst
        apps: ["internal_policy_assistant", "servicenow_kb_copilot"]
        data_classes: ["ClientComm", "PII", "Internal"]
    controls: ["SOC2:CC6.1", "ISO27001:A.5.18", "FINRA:3110"]
  dlp:
    description: Detect/minimize PII/PHI; block secrets; redact before send.
    detectors: ["pii_v3", "secrets_v2"]
    action: ["redact", "block_on_high"]
    controls: ["SOC2:CC6.6", "ISO27001:A.8.10", "HIPAA:164.312(e)"]
  residency:
    description: Route by user_region and data_class; no cross-region for PII.
    routes:
      - when: { user_region: "US", data_class: "PII" }
        to: "azure-openai:gpt-4o-us"
      - when: { user_region: "EU", data_class: "PII" }
        to: "aws-bedrock:llama-3-70b-eu"
    controls: ["ISO27001:A.5.12", "SOC2:CC1.1"]
  supervision:
    description: External-facing content requires review if confidence < 0.85.
    target: "ClientComm"
    threshold_confidence: 0.85
    approval_workflow: "ServiceNow.Flow.AI-Supervision"
    controls: ["FINRA:2210", "SOC2:CC5.3"]
  logging_retention:
    description: Log every prompt/completion with user, model, policy_version; retain per class.
    sinks:
      - type: snowflake
        database: RISK_EVIDENCE
        schema: AI_LOGS
        table: PROMPTS
      - type: s3
        bucket: s3://audit-evidence-immutable/
        kms_key: arn:aws:kms:us-east-1:123:key/ai-evidence
    retention:
      Internal: "2y"
      PII: "7y"
      ClientComm: "7y"
    controls: ["SOC2:CC3.2", "ISO27001:A.8.12", "FINRA:4511"]
  decision_ledger:
    description: Time-bound exceptions with approver and review date.
    store: "ServiceNow.Table.AI_DECISIONS"
    max_expiry_days: 90
    controls: ["ISO42001:8.3", "NIST-AI-RMF:MAP3"]
monitoring:
  slo:
    evidence_freshness_p95: "< 2h"
    log_coverage: ">= 99%"
  alerts:
    - name: residency_violation
      threshold: 1 per 24h
      action: ["page:oncall", "open:incident:P1"]
    - name: log_gap
      threshold: "> 0.5% requests without logs"
      action: ["open:incident:P2"]
security:
  encryption_in_transit: TLS1.2+
  encryption_at_rest: AES-256
  service_accounts:
    rotate_days: 60
    keys_in_hsm: true
  kill_switch:
    enabled: true
    owners: ["CISO", "HeadOfCompliance"]
reviews:
  cadence: weekly
  participants: ["CISO", "Compliance", "SecurityEng", "AppOwner"]
  artifacts: ["dpia_report", "control_attestation", "evidence_summary"]
```

{
  "title": "CISO Playbook: Turn SOC 2/ISO/HIPAA/FINRA into Runtime AI Policies in 30 Days",
  "published_date": "2025-11-07",
  "author": {
    "name": "Michael Thompson",
    "role": "Head of Governance",
    "entity": "DeepSpeed AI"
  },
  "core_concept": "AI Governance and Compliance",
  "key_takeaways": [
    "Translate frameworks into enforceable runtime policy (not slideware).",
    "Automate evidence: prompt logs, RBAC checks, and retention tied to controls.",
    "Use a 30‑day audit → pilot → scale motion to prove value safely.",
    "Adopt a single trust layer across AWS/Azure/GCP and SaaS systems.",
    "Never train on client data; capture full audit trails and approvals."
  ],
  "faq": [
    {
      "question": "How do we avoid slowing down delivery while adding AI controls?",
      "answer": "Start with two pilots and enforce controls at the gateway. Developers call a single SDK; the trust layer handles RBAC, DLP, routing, and logging. Evidence is automatic, so teams ship faster and you avoid last-minute audits."
    },
    {
      "question": "Can we keep data in-region and still use best-in-class models?",
      "answer": "Yes. We route by data class and jurisdiction to approved endpoints in Azure OpenAI or AWS Bedrock. High-risk data never leaves region; low-risk internal prompts can use global models if allowed."
    },
    {
      "question": "What if we already have a GRC tool?",
      "answer": "We integrate. Control IDs in your GRC map to policy checks and evidence tables. During audits, we export attestations and logs aligned to your existing controls."
    },
    {
      "question": "How do we supervise AI-generated client communications for FINRA?",
      "answer": "Responses tagged ClientComm below confidence 0.85 are queued for review in ServiceNow. Approved items are retained for 7 years with model and policy version, satisfying supervision and retention requirements."
    }
  ],
  "business_impact_evidence": {
    "organization_profile": "National broker-dealer (6,200 reps), AWS + Azure, Snowflake evidence warehouse, FINRA/SOC 2/ISO 27001 scope.",
    "before_state": "AI usage scattered with no centralized logging, manual exception spreadsheets, and ad-hoc approvals; audit requests took weeks.",
    "after_state": "Runtime trust layer enforced RBAC, DLP, and residency; 100% prompts logged; ServiceNow supervision workflow; Snowflake evidence automation.",
    "metrics": [
      "Audit prep hours cut 58% (≈420 hours/quarter returned)",
      "AI control findings reduced from 7 to 1",
      "Evidence freshness p95 < 2h; log coverage 100% for in-scope workflows",
      "Zero residency violations; 100% RBAC checks passed"
    ],
    "governance": "Legal and Security approved because controls were enforced at runtime with prompt logging, RBAC, data residency routing, expiring exceptions, and a guarantee we never train on client data; full audit trails with immutable evidence were demonstrated."
  },
  "summary": "CISOs: convert SOC 2/ISO/HIPAA/FINRA requirements into a runtime AI trust layer in 30 days. Enforce controls, automate evidence, and pass audits without slowing delivery."
}