Data Security & AI Compliance
AIToolworx DSAC Framework™
Take control of AI, data, and cybersecurity risk before small gaps become serious business problems.
Through our DSAC Framework™, we assess how your company uses AI tools, stores sensitive data, manages vendors, protects remote access, and prepares for threats like ransomware, data loss, and breach events.
Our goal is simple: give leadership a clear view of what is exposed, what matters most, and what to fix first. We provide practical CISO-level advisory, realistic remediation roadmaps, and access to specialist expertise when deeper technical, compliance, legal, or incident-response support is needed.
AIToolworx brings disciplined, business-focused security guidance without unnecessary complexity — helping you protect your data, strengthen operations, and move forward with confidence.
Advisory engagements are by contract. Contact us to discuss scope.
NIST CSF 2.0 six-function alignment
Govern comes first
Govern is Pillar One of the NIST CSF 2.0 six-function alignment, and it is where the AIToolworx DSAC Framework™ begins. Before an organization can effectively identify, protect, detect, respond, or recover, leadership must first establish visibility, accountability, policy, risk tolerance, vendor expectations, AI usage boundaries, and data governance requirements.
DSAC aligns with the Govern function by helping organizations define who owns the risk, where sensitive data lives, how AI and platforms are being used, and what controls must be in place before technical remediation begins. The result is a security and compliance strategy driven by leadership, not just tools.
- 01
GOVERN
Set strategy, accountability, policy, risk tolerance, roles, oversight, vendor expectations, AI governance, and compliance requirements.
- 02
IDENTIFY
Map the environment and classify people, systems, platforms, processes, data, and known/unknown exposure.
- 03
PROTECT
Apply safeguards such as MFA, least privilege, encryption, secure configuration, policy enforcement, and AI/data handling rules.
- 04
DETECT
Monitor abnormal behavior, shadow IT, shadow AI, risky integrations, data leakage, unmanaged devices, and policy drift.
- 05
RESPOND
Define who acts, what gets contained, how communication happens, how vendors are engaged, and how operations continue.
- 06
RECOVER
Validate backups, restore systems, review root causes, close control gaps, update policies, improve training, and reduce future risk.
Organizational threats
Hidden risks. Real breaches. Real impact.
Data exposure frequently bypasses traditional security perimeters, occurring not just through malicious attacks, but through everyday business behavior. As teams adopt new workflows and tools to stay competitive, they inadvertently create critical blind spots.
The AIToolworx DSAC Framework™ is specifically designed to illuminate these hidden risks. We systematically evaluate how your data moves, where it resides, and who controls it across your entire operational landscape.
Organizations often suffer from dangerous security gaps without realizing it: unmanaged software subscriptions bypass IT oversight, sensitive intellectual property leaks into public AI models, unencrypted devices leave the premises unchecked, and unvetted third-party integrations silently expand the attack surface.
By gaining comprehensive visibility into these threat vectors, leadership can implement practical, business-aligned controls that secure the organization without slowing down progress.
- Shadow SaaS and unmanaged software subscriptions
- Public AI data leakage from individual or free accounts
- Unencrypted laptops, drives, SSDs, and USB devices
- Secure data travel exposure at borders and in foreign jurisdictions
- Vendor blind spots and disconnected third-party tools
- Compliance, privacy, contractual, and operational risk
Protect your data. Protect your future.
VisibilityControlEncryptionPolicyAwareness
DSAC and the frameworks you may be asked about
Different questions. Designed to work together.
Customers, auditors and regulators each ask something different. SOC 2, ISO/IEC 27001 and NIST CSF 2.0 each answer one of those questions. DSAC helps leadership see the whole picture first, and prepares you for the audits that apply to you.
SOC 2 asks
Can your customers trust the service you sell them?
It looks at one defined system or service, and ends in an independent CPA firm’s report with an opinion.
DSAC asks
Do you know and control all of your organization’s data, AI, vendors and people?
It looks at your entire data ecosystem, including internal data, intellectual property, AI use, vendors, devices and remote access, and ends in a clear leadership view of what is exposed and what to fix first.
The frameworks, in plain terms
SOC 2
An AICPA attestation. An independent CPA firm examines a service organization’s controls against the Trust Services Criteria: security always, and availability, processing integrity, confidentiality and privacy as chosen. A Type I report covers the design of controls at a point in time. A Type II report tests how they operated over a period. The result is a report, not a certificate.
ISO/IEC 27001
An international standard for an information security management system. An organization is certified by an accredited certification body after an audit.
NIST CSF 2.0
A voluntary framework built on six functions: Govern, Identify, Protect, Detect, Respond and Recover. DSAC uses it as guidance in every assessment.
Who needs which
- You sell software or services that handle customer data to businesses. Expect customers to ask for a SOC 2 report, usually a Type II.
- You sell internationally, or to buyers who expect a formal management system. ISO/IEC 27001 is the common request.
- You are worried about AI use, data exposure, vendors or a breach, whether or not anyone has asked for a report. That is where DSAC starts, at any size of organization.
- You need more than one. Many organizations do. DSAC is a practical first step, because it shows you the gaps before an auditor does.
Research
The TOPS Trap
AIToolworx research on whether local AI systems stay inside the evidence they are given: a reproducible evaluation of source grounding, hidden system instructions, and trust architecture in local AI. Every prompt, run and log is open to check.
Version 1.0, First Public Edition, October 2026. The paper, executive summary and evidence archive are free to download, with a hash for every file. Permanent, citable copy: doi.org/10.5281/zenodo.23423297 (CC BY-NC-ND 4.0).
The TOPS Trap: Local AI Models Hallucinated Facts, Cited Real Sources, and Sounded Confident Read the news article, the press release on PRLog, and the study.
Principal advisor
James Childers
James Childers is the founder of AIToolworx, where he works on AI architecture, data security, and private and edge computing. His career spans more than 40 years across IT, cybersecurity, authentication, encryption, networking, cloud and secure-access technologies, with a focus on identity assurance, multi-factor authentication, biometrics and smart cards.
He is a named co-inventor on two issued U.S. patents covering medical smart-card kiosk systems (US 8,733,641 B1 and US 8,783,566 B1, both granted in 2014), and has published on multi-factor authentication, including in NATO Defence Journal (2007), and spoken at security conferences in China, Washington, D.C., Dubai, London and Mumbai.
His work has included site-security and secure-authentication projects for U.S. government agencies, including U.S. military facilities; secure smart-card and encryption work with U.S. intelligence stakeholders; contracted support to the Government of Maharashtra, India, on counter-terrorism capabilities after the 2008 Mumbai attacks; and leading site and network security for an Olympic hospitality venue at the 2008 Beijing Games.
As Principal Advisor for the AIToolworx DSAC Framework™, he works from a core belief: true security must empower the business, not hinder it. He focuses on practical, actionable strategies that demystify compliance and build operational resilience for modern enterprises. He has postgraduate-level study in psychology and adult learning, which informs his emphasis on the human side of security.
ORCID: 0009-0005-6827-6921
Contact
Get in touch
Advisory engagements are by contract. Contact us to discuss scope.
James Childers
james.childers@aitoolworx.com
Research, press and corrections: write to the same address.