Free tools & reference

Glossary

Orientation, not a dictionary — every term connects to the obligation behind it.

AI governance: Oversight of how a firm adopts and uses AI: who owns it, what the policy says, and the evidence that someone is watching. Not the tools themselves.
NIST AI RMF: The U.S. National Institute of Standards and Technology's AI Risk Management Framework; functions GOVERN, MAP, MEASURE, MANAGE.
NIST CSF 2.0: NIST Cybersecurity Framework 2.0; functions GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER.
FINRA: Financial Industry Regulatory Authority; oversees broker-dealers.
FINRA 3110: FINRA's Supervision rule; requires a system to supervise the firm's business, including AI-assisted work.
SEC: U.S. Securities and Exchange Commission.
SEC 17a-4: SEC books-and-records retention rule; AI-assisted communications are records too.
Reg S-P: SEC Regulation S-P; privacy and safeguarding of customer financial information.
RIA: Registered Investment Adviser.
NYDFS: New York Department of Financial Services (e.g., Part 500 cybersecurity).
GRC: Governance, Risk, and Compliance.
Maturity level (L0–L4): How far a control has matured, from none (L0) to optimized (L4); assessments grade where you are vs. the target the rule expects.