More than two decades running global IT and security functions in regulated industries. I owned the budget, the uptime and the audit date. Now I advise boards and executive teams on technology risk and AI governance. Most AI governance is written by people who never owned an audit. Mine comes from the other side.
Agentic automation for day-to-day M365 and Azure operations, with a full audit trail on every action. Approval workflows, rollback, permission boundaries. The model took a weekend; the governance took months. Internal tool that became a product.
Implementation in environments where audit readiness and risk mitigation are not negotiable. Control design, evidence discipline, and the unglamorous work of proving it — to assessors who do not accept intent as evidence.
Global IT and security functions with full operational and financial accountability. Large-scale integrations and offshore transitions — where the risk is never the technology, it is the six months where two estates run at once.
Translating technology complexity into structured oversight, measurable controls and informed decisions. Maturity reporting directors can act on, and risk framed against enterprise strategy rather than control counts.
Enterprise architecture and cloud programmes aligned to ISO 27001, NIST and HIPAA — delivered inside real constraints of legacy estate, budget cycles and audit calendars, not on a whiteboard.
The regulatory calendar that actually reaches the board agenda. Maintained weekly. If it moves, this moves.
Two caveats most consultants won't tell you. As of August 2026 the Data Protection Board still has no Chairperson and no Members — MeitY was advertising all five posts as recently as June. And the 12-month compression MeitY floated in January covers Significant Data Fiduciaries, not everyone, and has not been gazetted. Plan for May 2027. Watch November 2026.
Reporting this to a board? Cybersecurity board reporting — what belongs on the page, what to cut, and the cadence that holds →
I write regularly on LinkedIn. These four are the positions underneath — the ones I keep coming back to, and the ones I'll argue in a room.
The weekly posts, on LinkedIn ↗It is not what slows agents down. It is what lets you say yes to the next ten use cases without flinching.
An agent that cannot explain every action, name who approved it and produce evidence for an auditor is not enterprise-ready.
Most failed programmes were doomed at kickoff. Steering committees diffuse responsibility; shared ownership works right up until something breaks.
Agents reward the tightest guardrails, not the earliest mover. They surface every gap you have quietly tolerated — in production, at the worst moment.
Three conversations I'm having. Each is a different commitment, and I'd rather be explicit about which is which.
Non-executive and advisory roles where technology risk, AI governance and regulatory readiness need someone who has owned the outcome, not just reviewed the paper.
CIO, CISO and equivalent mandates — global functions, regulated environments, transformation or integration programmes carrying real operational and financial accountability.
A small number of engagements a year: AI governance frameworks, CMMC and GovRAMP readiness, and cyber maturity reporting that survives a board's second question.
Board, advisory, leadership or a scoped engagement. Tell me which and what the constraint is.
me@sarfarazchougule.com →Direct. No form, no gatekeeper, no autoresponder.