GenAI Incident Response Playbook + Tabletop — Regulated Enterprises
Kriv AI · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
No AWS Marketplace PS listing today offers a combined GenAI IR playbook + tabletop SKU for regulated enterprises. Big 4 delivers it at $150K–$1M off-Marketplace; Mandiant / Unit 42 / CrowdStrike / Kroll deliver tabletops $50K–$400K off-Marketplace. Kriv AI is first with a Marketplace-transactable, regulated-industry-anchored, NIST AI RMF + MITRE ATLAS + OWASP LLM Top 10 v2 + CISA AI IR integrated, Anthropic CPN-certified playbook-plus-tabletop SKU.
CISOs, Deputy CISOs, Heads of IR, CCOs, CROs, CPOs, GCs, and Heads of GRC + TPRM at top-50 health payers, top-100 hospital systems / IDNs, top-25 pharma + CROs, G-SIB + regional banks, top-50 P&C + life insurers, FINRA broker-dealers, SEC RIAs, '40 Act mutual funds, PE + hedge funds, credit unions, and mutual insurers face the same obligation: existing IR playbooks predate GenAI entirely, existing tabletops have never rehearsed AI scenarios, and regulator examinations (HHS OCR, FINRA 2025–2026, NYDFS, SEC, state DOIs) now ask whether covered entities have rehearsed AI incidents. NIST SP 800-61r2 is foundational but AI-silent. NIST AI RMF GenAI Profile Manage 4.1 calls for AI incident response. MITRE ATLAS catalogs adversarial AI TTPs. OWASP LLM Top 10 v2 lists 10 vulnerability classes. SEC Item 1.05 (4 business days), NYDFS §500.17 (72-hour), HIPAA §164.400–414 (60-day), and EU AI Act Article 73 (serious incident reporting Aug 2026) extend to AI.
Show the rest of the publisher’s description (5 more lines)
Engagement scope (3–5 weeks). Week 1 Current-state + scenario library (review existing IR playbook against NIST 800-61r2 PICERL; map to MITRE ATLAS; cross-reference NIST AI RMF Manage 4.1; build scenario library from N43 + vendor AI inventory). Week 2 Playbook authoring (per scenario: detection signals — CloudTrail Bedrock InvokeModel, Guardrails violations, SIEM correlation, DLP alerts; triage decision tree; containment — API key revocation, Guardrail tightening, agent kill-switch, MCP isolation; eradication — model rollback, prompt filter updates, fine-tuned model retraining; recovery; lessons learned). Week 3 Tabletop #1 (90-min facilitator-led, 3 escalating injects; CISO / CIO / Privacy / Legal / Comms / CFO / CEO observer; after-action report with CMM 1–5) — Foundation closes. Week 4 Standard — Vendor-breach cascade + Tabletop #2 (third-party AI vendor breach; TPRM cascade; Customer-facing statement). Week 5 Enterprise — Executive + Board + Regulator simulation (mock HHS OCR / SEC 8-K / NYDFS §500.17 / FINRA 4530 drill with external counsel dial-in; board-ready deliverable).
15-scenario GenAI library. Shadow-AI PHI/NPI/MNPI paste; vendor GenAI breach cascade; Bedrock Guardrails bypass; agentic AI misbehavior; prompt injection (direct + indirect RAG); model poisoning; deepfake CEO wire fraud (BEC 2.0); deepfake executive for M&A/IR; third-party AI supplier cascade; MCP server vulnerability; A2A unauthorized action; fine-tuned model weight leak; training-data PII leak (membership inference); public jailbreak.
Three tiers. Foundation $45K (3 weeks; 10-scenario playbook + 1 vertical-specific tabletop; HIPAA OR GLBA OR NYDFS OR SR 11-7; CMM 1–5 scorecard). Standard $75K (4 weeks; 15-scenario playbook + Tabletop #2 vendor-cascade + TPRM cascade + regulator notification templates HHS OCR / SEC 8-K / NYDFS / FINRA; full HIPAA + GLBA + NYDFS + SR 11-7 + SOC 2). Enterprise $125K (5 weeks; Standard + Tabletop #3 executive + board + regulator-simulation with external counsel + board-ready deliverable + 12-month review option; framework suite incl. ISO 27001 + HITRUST + EU AI Act Art. 73 + EU NIS2 + CCPA + 50-state). Additional tabletop $20K each.
Regulator notification timing ladder. HHS OCR §164.400–414 60-day; SEC Item 1.05 4 business days from materiality; NYDFS §500.17 72-hour; FINRA Rule 4530; GLBA §314.4(h); CCPA/CPRA; 50-state variations; EU NIS2 tiered 24/72-hour/1-month; EU AI Act Article 73; CISA voluntary. EDP-eligible — playbook + tabletop engagement fees ($45K–$125K) count toward your AWS Enterprise Discount Program commitment (up to 25%). Contact info@kriv.ai to structure a Marketplace private offer against your EDP or PPA.
**Important disclosures.** Kriv is NOT an IR retainer. If Customer has active incident, route to Mandiant / Unit 42 / Kroll / CrowdStrike / Arete. Kriv authors playbooks and runs tabletops — does not respond to live incidents. No legal advice (Customer counsel retains all notification + materiality determinations + privileged communications). External counsel recommended for Standard / Enterprise tabletops. Does NOT replace HHS OCR Risk Analysis, FINRA WSP, NYDFS §500.02, SOC 2 Type II audit, ISO 27001, HITRUST. Does NOT displace existing IR retainer — coordinates, not replaces. Does NOT make regulator notifications on Customer's behalf. No CMM maturity-score guarantee. No regulator-penalty-mitigation outcome guarantee. Tabletop discussions attorney-client privileged when external counsel dials in. Anthropic CPN membership (April 9, 2026) — CPN partner, not Anthropic-authorized reseller.
Highlights
Highlighted by the publisher on AWS Marketplace.
First regulated-industry GenAI IR playbook + tabletop SKU on AWS Marketplace — NIST 800-61r2 + NIST AI RMF GenAI Profile Manage 4.1 + SANS PICERL + MITRE ATLAS + OWASP LLM Top 10 v2 + CISA AI IR + HITRUST CSF v11.3 AI overlay + ISO/IEC 27035 integrated. Big 4 charges $150K–$1M; Mandiant / Unit 42 / CrowdStrike tabletops $50K–$400K off-Marketplace. Kriv is first Marketplace-transactable at $45K–$125K. 6–12 month first-mover window.
15-scenario GenAI library: shadow-AI PHI/NPI/MNPI paste, vendor GenAI breach cascade, Bedrock Guardrails bypass, agentic misbehavior, prompt injection (direct + indirect RAG poisoning), model poisoning, deepfake CEO voice/video wire fraud (BEC 2.0), MCP server vulnerability, A2A unauthorized action, fine-tuned model weight leak, training-data PII leak, public jailbreak. CMM 1–5 maturity scorecard. After-action report. Detection signals tied to CloudTrail + Guardrails + SIEM + DLP.
Regulator notification timing ladder: HHS OCR 60-day (§164.400–414), SEC Item 1.05 4-business-day, NYDFS Part 500 §500.17 72-hour, FINRA Rule 4530, GLBA §314.4(h), CCPA/CPRA, 50-state variations, EU NIS2 24/72-hour/1-month tiered, EU AI Act Article 73 serious-incident reporting, CISA voluntary. $45K (3 wks / 1 TTX) / $75K (4 wks / 2 TTX / vendor-cascade) / $125K (5 wks / 3 TTX / board + regulator sim with external counsel dial-in). +$20K extra TTX.
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment · as of 2026-08-29
Sources
Publisher resources
3 linksLinked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.