Own IT, Secure IT, Protect IT, and Monitor IT translate security practices into a cycle a person can repeat. This is an interpretive mapping of themes, not a compliance assessment, certification, or claim that a checklist satisfies a law or standard.
Own IT: purpose, context, and responsibility
Know the task, the information owner, the tools, identities, connections, and other recipients. These ideas connect to NIST Cybersecurity Framework 2.0 Govern and Identify, and the NIST AI Risk Management Framework's GOVERN and MAP functions.
Secure IT: access, configuration, and identity
Protect sign-in and recovery, update devices, limit permissions, and test the ability to stop. These ideas connect to CSF Protect, identity guidance in NIST SP 800-63B-4, and risk treatment in the AI RMF.
Protect IT: careful inputs and checked effects
Minimize information before the AI reads it. Treat retrieved content as untrusted. Review responses and independently authorize actions. OWASP's LLM application guidance highlights prompt injection, excessive agency, sensitive information disclosure, and improper output handling as application risks requiring enforceable controls.
Monitor IT: evidence, response, and recovery
Review activity, permissions, retained copies, and changed settings. Stop unexpected work, revoke source permissions, preserve evidence, and recover through the appropriate process. These practices connect to CSF Detect, Respond, and Recover, and the AI RMF's ongoing management and measurement.
Laws, contracts, and standards have different roles
HIPAA, privacy laws, and NYDFS requirements can impose obligations on organizations within their scope. ISO standards and voluntary frameworks organize management and controls. Contractual agreements assign duties for particular services. Mapping them together does not turn a regulation into a voluntary framework or demonstrate that an organization complies.
For regulated work, identify applicability, the actual requirement, the responsible owner, the implemented control, and evidence. Keep that organizational assessment separate from a personal reading guide. Confirm current versions, legal status, dates, and jurisdiction before relying on a requirement.
What the personal guide contributes
- Settings people can check themselves: training, memory, search, connections, and retained copies.
- A plain-text preparation workflow, consistent pseudonym labels, and a label key kept outside AI.
- A human review before consequential actions and a tested stop procedure with a manual fallback.
- Repeatable personal and family habits that complement an organization's technical controls.
Sources
- NIST Cybersecurity Framework
- NIST AI Risk Management Framework
- NIST SP 800-63B-4
- OWASP LLM application risks
- HHS HIPAA information for professionals
The mappings are the author's interpretation. They do not imply endorsement by a standards body.
The author develops commercial security tools in this area. These resources are tool-neutral and recommend no product. Product names, when used, are examples rather than endorsements. Own IT, Secure IT, and Protect IT draw on the 2019 Cybersecurity Awareness Month theme; Monitor IT extends the cycle into a repeatable personal habit. General educational information, not a scan, compliance assessment, or guarantee of safety. CC BY 4.0.
Apply this in your organization
We help connect applicable requirements and selected guidance to scoped controls, owners, remediation, and evidence. Explore requirements and frameworks, or discuss your priority by email.