AI Governance and Data Security for Gov/Defense Analytics

💡 Key concepts

• Tool tiers (generic model; your organization's policy decides):

  Tier	Examples	Typical allowed data
  Public/consumer AI	Free web chatbots, personal accounts	Public info + fictional data only
  Enterprise AI in your tenant	M365 Copilot / Copilot in Excel/Power BI if enabled and authorized	Whatever your organization approves for that tenant
  Agency-authorized platforms	Government-cloud or DoD-authorized AI services	Per authorization (e.g., the CUI level it's approved for)

• Why public tools are risky: Data leaves your boundary and may be logged, retained, or reviewed. Prompts can include identifying context. Outputs may be stored in chat history.
• CUI handling: Treat program financials, contract details, schedules, and technical data as potentially CUI until marked or confirmed otherwise. The CUI Registry (National Archives) defines categories. Your agency's implementing policy governs.
• Sanitization checklist: Remove program names and code names, contract numbers, vendor names, people, locations, and real dollar values. Swap in fictional placeholders. Keep only structure.
• Aggregation and inference risk: A table schema plus "unusual" field names plus a known program can still reveal sensitive information.
• Copilot specifics: Copilot inside your M365 tenant respects your permissions. It can surface anything you can access, so oversharing in SharePoint becomes an AI problem too. Per Microsoft's docs, Copilot in Power BI needs paid Fabric/Premium capacity and an admin setting, and isn't supported in sovereign clouds, which is relevant if you're on a government cloud. Check what your tenant actually has.
• Accountability: You own every number you publish, AI-assisted or not. Keep a record of how AI was used on significant deliverables if your organization requires it.

🛠 Hands-on exercise: Classify and Sanitize

For each of 8 (fictional) scenarios, decide: ✅ Safe as-is / 🟡 Sanitize first / ⛔ Not allowed in a public tool. Then rewrite the 🟡 ones.

1. "Explain how XLOOKUP's match_mode works."
2. "Here's our contract mod list with CLIN values for the KESTREL program; summarize changes."
3. "Write a DAX measure for cumulative CPI for a table with PeriodEnd, BCWP, ACWP."
4. "Paste of a vendor's proprietary cost proposal; find errors."
5. "Draft a Python function to parse money strings like $1.2M and 450K."
6. "Our real IMS export (attached); identify the critical path issues."
7. "Rewrite this paragraph from last month's internal status report (contains program name and schedule slip)."
8. "Explain the difference between TCPI and CPI."

📦 Mini-project: Team AI Use Guide (1 page)

Write a one-page guide for your team: approved tools, the safe/sanitize/not-allowed decision chart, the sanitization checklist, review requirements, and contacts (CUI office, IT, AI governance lead). Have it reviewed by the right authority before sharing.