Guides

Guides are the practical half of Circuit & Capital. A briefing tells you what changed: a catalog entry, a filing deadline, a vendor statement, an analyst number. A guide tells you what to do about it on a normal working week, with the people and the budget you already have. Each one is written for a single job, such as answering a cyber insurance questionnaire, reading a software renewal before the notice date passes, or writing down what an AI agent is allowed to touch.

The guides cover the same ground as the rest of the site. Some deal with AI cost and control: how to separate AI spend from AI return, how to put a cost on one workflow, and how to write a one-page rule for AI use in a department. Some deal with security and software supply: how to ask a vendor for a software bill of materials, which extra questions to ask about AI components, and what a cloud provider does and does not secure. Some deal with regulation that lands on a buyer's desk, such as the EU AI Act transparency duties, processor clauses under Article 28 of the GDPR, and the Form 8-K clock for material cyber incidents. Others are spreadsheet work: a risk register, a risk exception register, and a software renewal tracker you can build in Excel or Google Sheets.

Every guide follows the same rules as our briefings. Figures and dates are tied to a named source, usually the regulator, the standards body, or the vendor's own page, and the source is linked where the claim appears. Where a guide gives an example, the example is labeled as one, and list prices are described as list prices. Guides are general information for operators. They are not legal, tax, or investment advice, and a contract, filing, or insurance application should still go past the person who is accountable for it.

Guides are updated when the underlying source changes. If a deadline moves or a framework is revised, the page is edited and the change is dated, in line with our editorial standards. If you spot something out of date, tell the desk through the contact page.

Below is the full list of guides currently published, with a one-line description of each. The same guides, with images and reading times, are also on the main guides page. Related tools that do the arithmetic in your browser are on the tools page.

All guides

• Extra Questions for an AI Bill of Materials — CISA’s May 2026 AI SBOM guide is supplemental. Ask for the model, the data, and the application around them, on top of the general minimum elements.
• How to tell AI spend from AI return — Seat cost versus token cost, pilot versus production, and board questions that separate a copilot invoice from a P&L line. No guaranteed-return claims.
• Ask a Vendor for an SBOM — The fields CISA’s July 2026 minimum elements say an SBOM should carry, including for SaaS, and the reply that does not count.
• Before the Form 8-K Clock — Item 1.05 gives a public company four business days after it decides a cyber incident is material. Rehearse who makes that call.
• When cloud repatriation is a finance decision, not an engineering slogan — A U.S. mid-market FinOps pass: cost drivers, stay-versus-leave questions, and a labeled list-price egress example — not a fake AWS bill calculator.
• The Cloud Shared-Responsibility Checklist — AWS says it secures the cloud. You secure what you put in it. The guest operating system, the application, and the firewall rules stay with the customer on EC2.
• Cyber insurance checklist for mid-market IT budgets (2026) — A 2026 checklist for U.S. mid-market IT: MFA, EDR, immutable backups, IR retainer, and who owns the broker versus the questionnaire.
• What a Cyber Insurer Will Still Ask — MFA, EDR, backups, and a named retainer: the controls that still show up on cyber applications even when rates are falling.
• How to Read a SaaS Renewal — A checklist for the 90 days before a software renewal: seats, overlap, price, and the exit.
• How to Build an IT Risk Register in Excel — Build an IT risk register in Excel: columns, written scales, a 5 by 5 likelihood and impact matrix with INDEX and VLOOKUP, severity bands and review dates.
• Limit What an Agent Can Touch — Gartner says 54% of organizations do not limit AI-agent access or let agents inherit a person’s access. Write the permission down.
• A One-Page AI Use Rule — NIST’s AI Risk Management Framework is voluntary. Its four functions — Govern, Map, Measure, Manage — are enough for a one-page departmental rule.
• Questions Before a Post-Quantum Pilot — Gartner says firms that have not piloted post-quantum cryptography by 2027 face at least 200% higher migration cost, and 51% of CISOs had not started.
• Put an AI Cost on One Workflow — A 90-day method to attach token spend and review time to a single process with a definition of done.
• How to Build a Risk Exception Register — What a risk exception register template should record: columns, inherent and residual scoring, expiry status, review log and a worked example.
• Software buying as an operating skill — RFP basics, seat waste, who signs, and SaaS management categories for U.S. mid-market operators. Buying the stack like toner is how you get seven CRMs.
• How to Build a Software Renewal Tracker — The columns, notice-deadline formulas, scoring and worked example for a software renewal tracker template in Excel or Google Sheets.
• Stop Using a Voice as Approval — Gartner says deepfakes are mainstream and recognition is not an acceptable basis for authorizing an action. Add a second check.
• What Article 50 Asks a Buyer — EU transparency duties applied on 2 August 2026. Generative systems already on the market have until 2 December 2026 for machine-readable marking. Ask the vendor which date they mean.
• What Belongs in a Processor Clause — The European Commission’s June 2021 clauses for controllers and processors are the public checklist for an Article 28 contract. They are not the international-transfer clauses.