Framework connections explain relevant planning considerations, not a certification or a finding that a rule applies. Confirm scope and obligations with accountable stakeholders. Explore the ten framework references.
Cloud & AI
Establish a right-sized Azure foundation
Rapid product delivery can outpace cloud ownership, security baselines, and spending visibility.
Approach
Design a proportionate Azure foundation with scoped identities, environment separation, policy, budgets, and recovery requirements.
Deliverables
- Cloud foundation and deployment blueprint
- Ownership, budget, and readiness criteria
Success measures: Baseline coverage, budget variance, and environment readiness.
Requirements to consider
Scale controls to risk without bypassing isolation, access review, or customer data obligations.
Framework connections
- CISA ZTMMUse the five pillars to prioritize a right-sized cloud foundation, starting with accountable identities, workload boundaries, and data access.
Security
Protect customer data as the team grows
Early collaboration patterns and expanding access create gaps in customer-information handling.
Approach
Identify sensitive information and accountable owners, review access, and stage classification and sharing controls for supported systems.
Deliverables
- Customer-data handling assessment
- Access and protection-policy roadmap
Success measures: Excess permissions, owner coverage, and high-priority data gaps.
Requirements to consider
Do not claim certifications or compliance before appropriate assessment and evidence.
Framework connections
- GDPRWhere customer-data processing falls within GDPR scope, establish roles, permitted purposes, retention, and rights handling before scaling.
- ISO/IEC 27001:2022Define the management-system scope and ownership needed to sustain customer-data controls rather than treating a cloud configuration as certification.
Cloud & AI
Take an AI product beyond a prototype
A promising AI demo lacks a clear plan for data permissions, quality, reliability, and operating cost.
Approach
Define the product's permitted behavior, establish grounded context and scoped tools, and evaluate normal, denied, and failure cases before release.
Deliverables
- AI application and control architecture
- Evaluation, release, and operating requirements
Success measures: Task quality, safe failure, latency, and cost per useful interaction.
Requirements to consider
A prototype is not production assurance; consequential actions and customer-data use require explicit authorization.
Framework connections
- EU AI ActWhere the Act applies, determine the startup's provider or deployer responsibilities, use classification, and effective obligations before placing the AI product into service.
- NIST AI RMFMap intended use and affected people, evaluate limitations, and establish accountable release and monitoring decisions beyond the prototype.
AI Business Solutions
Make customer onboarding repeatable
Sales-to-delivery handoffs rely on informal steps and repeated manual updates.
Approach
Map the onboarding process, integrate approved business records, and define ownership, approval thresholds, and exception routing.
Deliverables
- Onboarding process and integration design
- Approval matrix and operational handover
Success measures: Onboarding completeness, handoff effort, and exception age.
Requirements to consider
Keep contractual commitments, charges, and access provisioning subject to agreed authorization.
Security
Establish joiner and leaver access controls
Fast team growth and contractor turnover leave excessive or ownerless access.
Approach
Define identity ownership, role-based access, strong authentication, and practical provisioning and retirement procedures.
Deliverables
- Workforce identity lifecycle baseline
- Access review and offboarding checklist
Success measures: Standing privilege and deprovisioning timeliness.
Requirements to consider
Preserve tested recovery access and avoid granting broad privileges for convenience.
Security
Create a proportionate incident-readiness plan
Early-stage teams lack agreed security triage and escalation responsibilities.
Approach
Prioritize critical assets and available signals, define manageable investigation workflows, and exercise decision and communication paths.
Deliverables
- Security operations readiness assessment
- Incident runbooks and improvement backlog
Success measures: Ownership clarity and high-priority coverage gaps.
Requirements to consider
Do not imply round-the-clock monitoring or emergency response without an explicit service arrangement.
Cloud & AI
Build trusted product and customer analytics
Product and commercial teams use inconsistent measures across disconnected data sources.
Approach
Define purpose-limited data products, agreed metrics, ownership, and quality checks for an initial reporting scope.
Deliverables
- Product analytics data model
- Quality and access acceptance criteria
Success measures: Metric consistency and reporting preparation effort.
Requirements to consider
Respect customer consent and privacy; avoid unnecessary individual profiling or unsupported investor claims.
AI Business Solutions
Enable useful internal Copilot workflows
Teams want AI productivity without a clear view of data readiness and useful tasks.
Approach
Choose bounded internal use cases, review approved knowledge access, and pilot with guidance and explicit expansion criteria.
Deliverables
- Copilot use-case and readiness assessment
- Pilot, enablement, and measurement plan
Success measures: Task quality, sustained usefulness, and readiness gaps closed.
Requirements to consider
Protect customer and confidential company information and verify generated material before external use.