AI Project Starter Kit – THE PRAGMATIC GRC METHODOLOGY™

Quick Start

Create one Project for your GRC work.
Paste in the standing instruction from Part 1, filled in for your business.
Upload the files from Part 2, and leave out anything on the “do not upload” list.
Complete the checklist in Part 3 before you upload anything sensitive.
Run the Chapter 8 prompts inside that Project.

Part 1: Standing Instruction Template

Paste this into your Project’s instructions field and replace every [bracketed] item. Keep it under a page. Review it during your Monthly GRC Heartbeat™ so it stays current as your business changes.

You are a GRC assistant helping a small or medium-sized business maintain its Pragmatic GRC Methodology™ program. ABOUT THE BUSINESS: [Company name] is a [number]-person [industry] business based in [location]. Our team works [on-site / remote / hybrid]. KEY SYSTEMS: [For example: Microsoft 365, QuickBooks, a cloud file server, our line-of-business software, our MSP’s name]. WHAT WE PROTECT: [For example: customer records, financial data, client or patient information]. COMPLIANCE DRIVERS: [For example: customer contracts, cyber insurance requirements, HIPAA, PCI DSS, state privacy laws, or “none yet”]. WHO OWNS GRC: [Business Owner / Operations Manager / IT Manager or MSP]. HOW TO WORK WITH US: Our Three Living Documents (Master Asset Register, Enterprise Risk Register, and Unified System Security Plan) are in this Project’s files and are our system of record. Treat them as the source of truth. Write in plain, non-technical language sized for a small team, and keep answers short and actionable. If you are missing information or are unsure, say so and ask instead of guessing. Never invent regulations, citations, or facts about our systems. Flag anything a person should verify. You draft; we review and decide.

Part 2: What to Upload (and What to Keep Out)

Start small. A few current, accurate files beat a large pile of outdated ones.

Upload these

Your current Master Asset Register Your current Enterprise Risk Register Your current Unified System Security Plan (SSP) Your customized Implementation Guides (Navigate, Fortify, Sustain, and Cultivate), if you have adapted them Your standing instruction from Part 1 (keep a copy outside the Project too) Policies and procedures you want the AI to reference or update Vendor, contract, or insurance documents you need to analyze, with names and sensitive details redacted first

Do not upload these

Passwords, API keys, access tokens, MFA codes, or recovery codes Customer, client, patient, or employee personal information (use redacted or sample data instead) Payment card data or bank account details Raw vulnerability scan results, network diagrams, or configuration exports containing IP addresses, hostnames, or credentials, unless you have redacted them Anything covered by a confidentiality agreement that does not allow AI processing Outdated versions of your Living Documents (they confuse the results)

Housekeeping tips

Replace sensitive names and numbers with placeholders (for example, [Client A], [Server 1]) before uploading.
Put the date in each file name so you can tell which version the Project is using.
When you update a Living Document, remove the old version from the Project and upload the new one.

Part 3: Data-Handling Checklist

Answer these before you upload anything sensitive. Your registers and security plans describe how your business is protected, so treat them accordingly. You can find the answers in your AI tool’s settings, admin console, and the provider’s own terms and privacy documentation.

I am using a business or team account, not a free personal account. I know whether my files and conversations can be used to train the provider’s models, and I have set that option the way my business needs. I know how long uploaded files and conversations are kept, and how to delete them. I know who can see this Project and its files, and sharing is limited to people who need access. Every account with access uses multi-factor authentication. I have reviewed any connected apps or integrations and removed access I do not need. My customer contracts, insurance policy, and any regulations that apply to us permit this kind of AI use. I have named an owner for this checklist and will revisit it when our tools, vendors, or obligations change.

Important: This checklist is a practical starting point, not legal advice. If you are unsure whether a contract or regulation permits a particular use, ask your attorney or compliance advisor.