Generative AI

NIST's Generative AI Profile is the most concrete control content we have for GenAI risk, but it is voluntary, and the attestation regimes buyers actually enforce have no native GenAI language. The fix for mid-sized firms is to feed the profile's controls into the SOC 2 machinery they already run, not to build a parallel governance program.