How to Address Gaps in your AI Governance | Cyber Resilience 202
AI adoption is outpacing governance, leaving critical gaps in security and policy—here is how to build a workable foundation.
Closing the gaps in your AI governance
Most organizations are adopting AI faster than they can govern it. Employees bring in tools before a policy exists, and generative outputs get treated as fact once they land in a report or decision memo. Each one widens what sits outside your control without anyone signing off.
Frameworks like NIST AI RMF and ISO/IEC 42001 give you a starting point, but they aren’t a governance program on their own. Turning them into policy, ownership, and controls is the hard part, and it needs to hold up as regulation catches up.
Si West, Director of Cyber Resilience at Resilience, moderates a conversation with Senior Technical Security Advisors Chuck Norton and Aaron O’Reilly of Resilience on where the gaps show up first and what a workable governance foundation looks like.
About Speakers
Chuck Norton
Senior Technical Security Advisor, Resilience
Charles “Chuck” D. Norton is a Senior Technical Security Advisor at Resilience. He is a seasoned enterprise technology leader with nearly two decades of expertise, specializing in implementing robust security frameworks and governance models that align risk mitigation with business objectives.
Throughout his career, Norton has leveraged extensive experience in systems architecture and policy development to partner with stakeholders and build resilient security programs.
Prior to his current role at Resilience, Norton held security leadership positions at Western Michigan University and across various local government organizations. He holds an MBA from Western Governors University, a B.S. from Western Michigan University, and CISSP certification.
Aaron OReilly
Senior Technical Security Advisor, Resilience
Aaron OReilly is a Senior Technical Security Advisor at Resilience. He brings more than two decades of experience in IT, security operations, and incident response, with a background spanning government, financial services, and industrial control systems.
Throughout his career, OReilly has built and led security operations centers, directed global incident response teams, and advised executive leadership on security program strategy across public and private sector organizations.
Prior to his current role at Resilience, OReilly held security leadership positions at Kyndryl, SAIC, and the U.S. Army Cyber Protection Brigade. He holds an M.S. in Cybersecurity and Information Assurance from Western Governors University, a B.A.S. from Dallas Baptist University, and several GIAC & ISACA security certifications.
Si West
Director of Cyber Resilience, Moderator, Resilience
Si West leverages over two decades of global security expertise to bridge the gap between technical risk and business strategy.
He partners directly with risk-focused CISOs to enable better decision-making while assisting brokers in mitigating client exposure. Si’s track record includes building out international security & risk services teams, advising on global underwriting teams, and developing critical incident response frameworks for large-scale, complex books of business. His credentials include 14 years of service in the Royal Marines, an NCSC Assured Instructor status, and an MSc in Cyber Security and Human Factors.
Any company that sells hardware or software with network connectivity into an EU member state has to report vulnerabilities and incidents affecting that product. The regulation calls these products with digital elements, and it applies to the manufacturer regardless of where the manufacturer is based, so a US firm with no EU presence is covered from the moment its first unit ships into the single market.