Topic map / Customers and the work
11 questions
NIST SP 1300, the Cybersecurity Framework 2.0 small-business quick-start guide published on 26 February 2024, is a standards guide. It is not a certificate and not a UAE law. After a pilot, many buyers add a security review. Ask which promises you have already made.
1.What customer data do you hold, and in which country does it sit?
2.Who can reach production, and how do you remove them the day they leave?
3.What is backed up, and when did you last restore it?
4.Which of NIST’s functions has a named person: govern, identify, protect, detect, respond, recover?
Pass 2 · strengthened
Where DIFC law applies, breach notification is as soon as practicable. An ADGM Data Controller notifies without undue delay and, where feasible, within 72 hours. Name who owns the incident under the regime that applies.
5.What would a day of downtime cost the customer who trusts you most?
6.Which vendor, if it disappeared on a Friday, would stop the product?
7.Which security sentence in a contract is stronger than your current practice?
8.Which AI tool receives customer data, and under what terms?
Pass 2 · strengthened
A fluent answer is not a legal opinion, and it is not automatically privileged. Decide what you will not paste, and what you will not delete.
9.What change can reach customers without a second person?
10.After this pilot, what security or procurement review will the buyer require?
11.What confidential or dispute-related material should not enter an AI tool, and which AI records must be preserved?
Pass 2 · new
Reliability, what you may paste, and what you must keep are three different questions.
NIST Cybersecurity Framework 2.0: small business quick-start guide · National Institute of Standards and Technology, NIST SP 1300
A supplement to the NIST Cybersecurity Framework 2.0 for small businesses, organised around Govern, Identify, Protect, Detect, Respond, and Recover. It is a published standards guide, not a certificate and not a UAE regulation.
Yes, your CEO’s AI prompts may be discoverable (and can be problematic) · Cooley Governance Beat, Broc Romanek
A law firm’s commentary. It says AI prompts may be discoverable and are not necessarily privileged, that in an earnout dispute the court quoted the CEO’s AI prompts, and that the CEO admitted deleting AI chat logs. It says the opinion does not establish a new legal standard. The reserved issues in the opinion itself are impairment and damages.
Fortis Advisors LLC v. Krafton, Inc. · Court of Chancery of Delaware
C.A. No. 2025-0805-LWW, Vice Chancellor Will. Submitted 9 January 2026, decided 16 March 2026. The opinion was read for this pass. Phase One entered judgment that Krafton breached the equity purchase agreement by terminating the key employees without valid cause and by seizing operational control of Unknown Worlds. The remedy is specific performance: Edward Gill is reinstated as CEO with operational authority, and the base earnout testing period is extended by 258 days to 15 September 2026. The opinion says whether Krafton’s actions wrongfully impaired the earnout, and whether any resulting money damages are owed, are reserved for the second phase. One Delaware dispute. Not a rule for other contracts, and not a current docket status.