Security walkthrough

The security walkthrough introduces your admins and the people responsible for information security to Intric, its security functionality and the documentation behind it.

Suggested participants

• The project group
• The people responsible for information security

Areas covered

The walkthrough follows eight areas, from the goal of the day to who does what next. Each links to the articles that describe it in full, so you can go back to them when you write your own guidelines and assessments.

• Goal — A clear way forward for information security in Intric, both technically and organizationally.
• Legislation — The layers of legislation that apply to your organization: EU law such as GDPR, the AI Act and NIS2, national cybersecurity requirements, public law, and the laws specific to your sector. See GDPR and AI Act.
• Platform overview — What Intric offers technically for handling information securely, and how data moves through the platform. See Platform overview and Processing regions.
• Information classification — Security classifications, and how models and tools are classified in the platform. See Classifications and Configuration and ranking.
• AI adoption — The Staircase of AI Adoption, and why security needs grow as you climb it. See The Staircase of AI Adoption.
• Protective measures — The technical and organizational controls: model choice, classification, SSO and access, data retention and the audit log. See Technical and Organizational Measures, Best practices for secure configuration, Data retention policy and Audit log.
• Support resources — Documentation, DPIA and risk analysis support, and examples from organizations that have done it before. See Security & Compliance and the DPIA step-by-step guide.
• Next steps — Concrete actions, and who in your organization owns each of them.

Configure during or soon after the walkthrough

Configure these four before your users start building assistants. It gives everyone a clear frame from day one, and it is far easier than restricting what people already use.

1. Create your security classifications. Start with two, Open and Internal, or only Open. They go a long way during a pilot. See Classifications.
2. Review the sub-processors. Go through the third parties that process data when a model or tool runs, and turn off any your organization has not approved. See Sub-processors.
3. Add the models your organization should use. See Adding models.
4. Classify your models and tools. Assign each model and tool to the classifications it may handle. See Model classification and Tool classification.