Back to the CIO and CSO starting point
Security and GRC Advisory
Lightbridge security and GRC advisory helps enterprises adopt AI and meet defense and government compliance requirements without losing control of risk. Lightbridge is an independent advisory and program-management firm. Its work covers advisory, architecture, vendor selection, and program management, with hands-on delivery via vetted partners under Lightbridge program management. This page routes to the Lightbridge guides on the topic.
The decisions Lightbridge helps security leaders settle on AI.
The board wants AI. Legal and security are alarmed. The CIO or CSO has to move fast and still be able to defend every decision.
The decisions are concrete. Lightbridge helps leaders settle them in order.
- Which access paths to AI models are sanctioned, and which are shut.
- Which data classes may reach a model at all.
- Which controls enforce the policy: gateways, logging, retention terms.
- Who approves exceptions, and who answers to the board.
AI security guides on Lightbridge
The first question a security leader hears about AI is practical: who is already using it, and where does the data go. These Lightbridge guides start there and work through access paths, hosting, agents, identity, logging, contracts, and questionnaires.
- Shadow AI: How to Find It and What to Do About It
Discovery signals for unsanctioned AI use, what each one misses, and a 30-day plan.
- Same AI Model, Different Guarantees by Access Path
What eight AI access paths state on training use, retention, ZDR, residency, logging, and contracts.
- AI Hosting Options: Private Endpoints and Residency
What private endpoints, customer-managed keys, and residency settings cover on each cloud, and what self-hosting adds.
- AI Agent Security: Sandboxes, Permissions, Tools
Least privilege, approval gates, sandboxes, egress limits, prompt injection limits, and MCP tool authorization.
- AI Identity and Developer Access: SSO, FIDO2, Keys
SSO and SCIM, phishing-resistant MFA, API key custody, workload identity, and git guardrails.
- AI Observability and Audit Logging by Route
What each AI access route logs and omits, and the evidence auditors expect.
- AI Contracts and Legal Review: What to Check
Contract terms as five vendors state them, and what legal should negotiate.
- AI Security Questionnaires: What Is Asked
How questionnaires arrive, the recurring themes, and what a strong answer needs.
- AI Security Questionnaire Templates (Buyer, Vendor)
56 original buyer and vendor questions with evidence to request or prepare. CSV download.
- AI Security Questionnaire Resources and Standards
An index of the public standards and templates behind AI security questionnaires.
AI governance and compliance on Lightbridge Automation
Frameworks, standards, and controls for running AI under policy. These guides and services live on Lightbridge Automation, which owns the topic. Lightbridge Automation
- AI governance framework
What a governance framework is, its working components, and a staged path to stand one up. Hosted on Lightbridge Automation.
- NIST AI Risk Management Framework
The four functions, trustworthy AI characteristics, and the voluntary status of the framework. Hosted on Lightbridge Automation.
- ISO 42001 compliance guide
A plain-language look at the AI management system standard, its structure, and the certification path. Hosted on Lightbridge Automation.
- ISO 42001 vs NIST AI RMF
A certifiable standard set against a voluntary framework, with guidance on which to adopt first. Hosted on Lightbridge Automation.
- EU AI Act compliance guide
The risk-based tiers, who the Act applies to, core obligations, and how to prepare. Hosted on Lightbridge Automation.
- Claude compliance guide
How regulated enterprises consume Claude across Amazon Bedrock, the Anthropic API, and Claude.ai Enterprise. Hosted on Lightbridge Automation.
- Zero data retention (ZDR)
What a ZDR agreement covers and what to verify before trusting a vendor claim. Hosted on Lightbridge Automation.
- LLM gateways
The proxy layer between applications and model providers, and why enterprises adopt one. Hosted on Lightbridge Automation.
- AI audit
A structured assessment of an AI system against defined criteria, and how it differs from a risk assessment. Hosted on Lightbridge Automation.
- AI governance consulting
The Lightbridge Automation advisory service for building governance into AI programs. Hosted on Lightbridge Automation.
Defense and government security compliance on Lightbridge Cloud
For contractors handling federal information, Lightbridge Cloud publishes the readiness guidance. It covers CMMC, NIST 800-171, FedRAMP, export control, and the supply chain.
- CMMC compliance
The CMMC levels, what each protects, and how readiness work is sequenced.
- CMMC Level 2 readiness assessment
A free, scored self-assessment across the 14 NIST SP 800-171 control families. No certification claim.
- CMMC asset scoping and CUI enclaves
Asset categories, CUI enclave architecture, and assessment roles.
- DFARS 252.204-7012 and NIST 800-171
Safeguarding CUI, the 110 security requirements, SPRS scoring, and the ladder to CMMC.
- DoD zero trust for CMMC contractors
DoD zero trust concepts mapped to CMMC and NIST SP 800-171 CUI environments.
- C-SCRM and NIST SP 800-161
Supplier risk assessment, provenance, DFARS flow-down, and monitoring for the defense industrial base.
- ITAR vs EAR export control
USML defense articles, dual-use items, deemed exports, and cloud data-handling implications.
- FedRAMP readiness
Baseline selection, scoping, and gap assessment against NIST 800-53 before a third party steps in.
- Data sovereignty vs data residency
Why jurisdiction matters, the CLOUD Act, and the controls that enforce a sovereign cloud.
Contractor finance-system compliance on Lightbridge ERP
Government auditors review accounting and business systems as closely as IT. Lightbridge ERP owns that guidance.
- DCAA-compliant accounting
DCAA, the SF1408 pre-award survey, timekeeping rules, and what makes an accounting system adequate.
- Fixing DCAA audit deficiencies
How a material weakness is defined and how contractors respond to a DCAA report.
- DFARS contractor business systems rule
The six business systems under review and how a material weakness can trigger payment withholding.
- MMAS under DFARS
The material management and accounting system standard and how ERP configuration can support it.
- DFARS estimating system requirements
A documented methodology, supportable cost data, and comparing estimates to actuals.
- Segregation of duties for contractors
How sign-off gaps in timekeeping, labor, and purchasing can contribute to a material weakness.
Aerospace and defense security on Lightbridge.ai
Security in aerospace and defense is a leadership and deal question as much as a technical one. Three pages on this site cover it.
- Systems security strategy
Why contract-dependent CMMC and NIST 800-171 requirements call for strategy, not a checklist.
- Technology and cybersecurity due diligence
What to examine in aerospace and defense M&A: CMMC, NIST 800-171, ITAR data, and DCAA-relevant controls.
- Vendor risk governance for defense primes
Running contract-driven CMMC and NIST 800-171 obligations as an ongoing program.
How Lightbridge advises on security and GRC.
Lightbridge is an independent advisory and program-management firm. We cover advisory, architecture, vendor selection, and program management through delivery. Hands-on delivery runs via vetted partners under Lightbridge program management.
The standards on this page are subjects we explain and advise on. Where a sibling practice would deliver follow-on work, we disclose that up front, and you are free to take it elsewhere.
Lightbridge security and GRC advisory: frequently asked questions
What does Lightbridge do in security and GRC?
Lightbridge advises. It runs discovery and requirements, shapes the architecture, helps select vendors, and manages the program through delivery. Hands-on delivery runs via vetted partners under Lightbridge program management. Lightbridge stays accountable for the program and does not hand off after the selection.
Where should a CIO or CSO start when the board wants AI and security is worried?
Start with how people and systems actually reach AI models today. Find the unsanctioned use, then decide which paths to sanction. The Lightbridge shadow AI page covers the first step. Governance frameworks and audit work follow once the picture is clear.
Are the standards guides linked from Lightbridge certification services?
No. The standards pages are educational guides to what each standard requires and how to prepare. Lightbridge governance work is an advisory service offered to clients. Where a person on a project holds a technical certification, that is stated at the person level.
How does Lightbridge treat security vendor claims?
Treat a vendor statement as what the vendor says, not as verified fact. Lightbridge advises buyers to check each claim against the vendor documentation and contract terms.
Why are the guides spread across several Lightbridge sites?
Each topic has one owner. The AI standards and policy guides sit with Lightbridge Automation, defense security compliance with Lightbridge Cloud, and contractor finance systems with Lightbridge ERP. This page is the single entry point, and nothing is duplicated.
Is the CMMC readiness assessment a certification?
No. The Lightbridge Cloud assessment is a free, scored self-assessment across the NIST SP 800-171 control families behind CMMC Level 2. It supports readiness planning. It is not a certification, an official assessment, or a prediction of an assessment result.
Talk to Lightbridge about your security and GRC program.
Tell us where AI adoption, a defense contract, or an audit finding has put pressure on the program. We will help you decide what to do first.