AI Advisory Consultant

Client has selected ConsultNet to provide consulting services to establish an AI Governance Foundation (collectively the “Services”) as defined below.

Overall Objective: The overall objective of Phase 1 is to establish a governed foundation that lets Costar adopt AI faster and with confidence: a validated walled garden and secure connectivity model, a strengthened Acceptable Use Policy ( “AUP”) ready for legal review, an updated AI Risk Taxonomy and an AI Systems Plan, and a selective access model the team operates day to day. Phase 1 sets the base for the longer-term advisory relationship.

ConsultNet will deliver Phase 1 through five workstreams, each producing governed outputs that are ready to build on.

Workstream 1: AI Governance and Acceptable Use Policy (AUP) Review the current draft AUP and business feedback, strengthen it to incorporate the walled garden construct and clear data handling rules, for example keeping corporate work documents managed in the corporate environment rather than the AI subnetwork, and prepare it for legal review.

Workstream 2: Secure AI Connectivity Validate the separate AI subnetwork design and define the target connectivity model and reference architecture on an authenticate, do not crawl basis, enabling identity where appropriate while avoiding broad Office 365 content crawling. Review private and on premises Large Language Model (LLM) options for keeping sensitive data inside the boundary and managing token cost, weighed against the infrastructure cost of on premises deployment. ConsultNet may utilize Cybersecurity Maturity Model Certification (CMMC) style controls as the reference posture.

Workstream 3: Structured AI Risk Taxonomy and AI Systems Plan Review where Costar stands today, then build both artifacts to a rigorous level of completeness. Both align to the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF 1.0) and its four functions, Govern, Map, Measure, and Manage. ConsultNet will also use the Massachusetts Institute of Technology (MIT) AI Risk Repository as the reference database for identifying and classifying AI risks across the lifecycle. The AI Systems Plan inventories AI systems and use cases with their target architecture, tooling, controls, and ownership.

Workstream 4: AI Governance and Vendor Risk Workflow Review Review Client end to end AI governance and vendor risk workflow, from intake through AI use cases, questionnaires, assessments, risk evaluation, and risk acceptance. Map the manual activities, including tracking and submission review effort, and identify where new processes or technology capabilities you already license can replace manual work.

Workstream 5: Enablement, Quick Wins, and Hiring Baseline Plan for standing up the selective access model, intake, approval, tooling with guardrails, coaching, office hours, and repeat, identify a small group of champions, capture quick wins, and prepare a hiring profile baseline for the eventual internal AI resource.

Project Activities and Deliverables The following key activities and deliverables will be produced during this project.

• Strengthened AUP that is ready for legal review, incorporating the secure AI connectivity, walled garden and data handling constructs.
• Secure AI Connectivity or connectivity evaluation, including the authenticate, and a private/on-premises LLM options recommendations summary.
• Updated AI Risk Taxonomy aligned to NIST AI RMF 1.0 and the MIT AI Risk Repository. The AI Risk Taxonomy is a structured, standards-aligned catalog of the risks an organization’s AI systems can create (bias, privacy, security, misinformation, misuse, and so on), each mapped to its causes, potential impacts, mitigating controls, and monitoring metrics, so risks can be assessed and managed consistently across the AI lifecycle.
• Updated AI Systems Plan, an inventory of AI standards with architecture, tooling, controls, and ownership. The AI Systems Plan is an inventory of the organization’s AI systems and use cases that records, for each one, its purpose, target architecture, tooling, data, controls, and ownership, giving a single governed view of what AI is running, where, and under whose accountability.
• AI governance and vendor risk workflow map with manual effort analysis and automation recommendations using already licensed capabilities. New tools may also be considered.
• Hiring profile basel…