AI, Security Assessments, Security Plans, and Sensitive Security Information (SSI)

Our contacts with the U.S. Coast Guard have recently told us that they have been getting numerous questions about the use of AI to conduct Cybersecurity Assessments, or to write Cybersecurity Plans or Facility Security Plans. THE ANSWER IS NO!!!

As I’m sure most of you will recognize, using AI for these activities is not a wise choice.

Because AI systems rely on existing material, your AI model would need to start with a large body of existing security assessments or plans. Hopefully, if everyone has been following proper SSI procedures (see below), there are few if any existing such documents floating out there on the internet. And if there are, they would certainly not reflect your operations, business activity, physical layout, or computer systems and networks. Any AI generated assessment or plan would have no relationship with your security needs or operations and would provide no value to you. Also, it is a good bet that the Coast Guard can easily detect AI written documents.

Any existing plans or assessments you may have, along with the raw information needed to produce new assessments and plans is Sensitive Security Information. Deliberately feeding an AI model those materials would be a direct violation of SSI regulations found in 49 CFR 1520. TSA even specifically addresses this at: https://www.tsa.gov/for-industry/sensitive-security-information.

So, while AI is a powerful tool for many business activities, smart assessments and effective security plans require smart people – let Seebald & Associates and CyberSurv be part of your smart team and I promise you will like the results!