AI Security Control Objectives Library
Purpose: Define reusable AI security control objectives for governance, engineering, vendor evaluation and audit testing.
Audience: Security engineering, GRC, audit, AI product teams, SOC.
How to use: Select controls by risk tier, then update the evidence, owners, control status, and links as implementation maturity improves.
The library holds 46 control objectives in 11 families. Each control has a stable ID that the rest of the wiki uses: the AI Risk to Control Mapping links risks to controls, the domain standards cite the controls they apply, the AI Security Audit and Evidence Checklist lists the evidence, and every one of the 653 cases in the Test Case Library names the control it tests.
The controls follow the design principle set out in the Foundations paper: the model is an untrusted component, and authority to act, access data or spend money is enforced outside it.
Framework identifiers
Each control cites the identifiers published by the framework owner. Where a framework has no matching entry, the cell says so and the wiki's own control ID stands in.
| Framework | Version used | Identifier format |
|---|---|---|
| OWASP Top 10 for LLM Applications | 2025 | LLM01:2025 to LLM10:2025 |
| OWASP Top 10 for Agentic Applications | 2026 | ASI01 to ASI10 |
| MITRE ATLAS | 2026.09 | Techniques AML.T####; mitigations AML.M#### |
| NIST AI Risk Management Framework | 1.0 | Subcategories, for example MEASURE 2.7 |
| ISO/IEC 42001 | 2023 | Annex A controls, for example A.6.2.4; management system clauses, for example Clause 9.2 |
| AI Security Wiki (own) | This page | AI-CTRL-001 to AI-CTRL-046 |
Verify before use. Frameworks are revised. MITRE ATLAS in particular is updated monthly and renames techniques. Check identifiers against the current published versions before quoting them in an RFP or audit. Owners and review frequencies are starting values; set your own.
Control families
| Family | Controls |
|---|---|
| Governance and Compliance | AI-CTRL-007, AI-CTRL-011, AI-CTRL-012, AI-CTRL-013, AI-CTRL-014, AI-CTRL-037, AI-CTRL-042, AI-CTRL-043, AI-CTRL-044, AI-CTRL-045, AI-CTRL-046 |
| Discovery and Workforce AI Use | AI-CTRL-001, AI-CTRL-002, AI-CTRL-003, AI-CTRL-004, AI-CTRL-010 |
| Identity and Access | AI-CTRL-015, AI-CTRL-016 |
| Data and Retrieval | AI-CTRL-017, AI-CTRL-018, AI-CTRL-019 |
| Application Runtime | AI-CTRL-005, AI-CTRL-020, AI-CTRL-021, AI-CTRL-039 |
| Agents and Tools | AI-CTRL-006, AI-CTRL-022, AI-CTRL-023, AI-CTRL-024, AI-CTRL-025, AI-CTRL-026, AI-CTRL-027 |
| Model, Training and Pipeline | AI-CTRL-028, AI-CTRL-029, AI-CTRL-030 |
| Supply Chain, Infrastructure and Resilience | AI-CTRL-031, AI-CTRL-032, AI-CTRL-040 |
| Assurance and Testing | AI-CTRL-033, AI-CTRL-034, AI-CTRL-038, AI-CTRL-041 |
| Detection and Response | AI-CTRL-008, AI-CTRL-009, AI-CTRL-035 |
| Cost and Abuse | AI-CTRL-036 |
Control index
| Control ID | Control Name | Family | Objective | Test Cases |
|---|---|---|---|---|
| AI-CTRL-001 | AI Discovery | Discovery and Workforce AI Use | Identify approved/unapproved AI platforms across browsers, endpoints, IDEs, SaaS, APIs and custom apps. | 33 |
| AI-CTRL-002 | Prompt Inspection | Discovery and Workforce AI Use | Detect sensitive, restricted or risky content submitted to AI platforms. | 16 |
| AI-CTRL-003 | File Upload Protection | Discovery and Workforce AI Use | Prevent uploads of confidential or restricted files to unauthorized AI services. | 6 |
| AI-CTRL-004 | IDE AI Governance | Discovery and Workforce AI Use | Monitor and control AI coding assistants, source code sharing and secret leakage. | 18 |
| AI-CTRL-005 | Runtime AI Security | Application Runtime | Protect custom AI applications from prompt injection, misuse and output leakage. | 52 |
| AI-CTRL-006 | Agent Governance | Agents and Tools | Monitor AI agents, tool calls, API access and autonomous actions. | 15 |
| AI-CTRL-007 | Data Sovereignty | Governance and Compliance | Ensure prompts, logs and uploads are processed and retained in approved locations. | 14 |
| AI-CTRL-008 | Auditability | Detection and Response | Maintain logs for prompts, responses, files, users, devices, applications and actions. | 22 |
| AI-CTRL-009 | SOC Integration | Detection and Response | Forward AI security events and logs to monitoring and response platforms. | 22 |
| AI-CTRL-010 | Policy Enforcement | Discovery and Workforce AI Use | Support monitor, warn, redact, block and allow policies based on risk and classification. | 27 |
| AI-CTRL-011 | AI Use-Case Registry and Risk Tiering | Governance and Compliance | Record every AI use case with a business owner and a risk tier that decides which controls apply. | 18 |
| AI-CTRL-012 | AI Policy, Roles and Acceptable Use | Governance and Compliance | Set and communicate the rules and responsibilities for using and building AI, and map each rule to a control. | 7 |
| AI-CTRL-013 | Privacy and Regulatory Compliance | Governance and Compliance | Meet privacy and regulatory obligations for personal data handled by AI systems. | 39 |
| AI-CTRL-014 | Third-Party and Vendor AI Assurance | Governance and Compliance | Assess AI vendors and embedded AI features before use, and reassess when they change. | 24 |
| AI-CTRL-015 | Human and Agent Identity | Identity and Access | Give every user, application and agent that uses AI a unique, attributable identity. | 44 |
| AI-CTRL-016 | Least Privilege and Scoped Credentials | Identity and Access | Limit what each AI workload and agent can reach to the minimum its task needs. | 50 |
| AI-CTRL-017 | Data Protection in AI Pipelines | Data and Retrieval | Apply classification, minimization and isolation to data that AI systems ingest, process and produce. | 31 |
| AI-CTRL-018 | Retrieval Access Control | Data and Retrieval | Return only content the requesting user is entitled to see. | 9 |
| AI-CTRL-019 | Knowledge Base Integrity | Data and Retrieval | Stop untrusted or poisoned content from entering the corpus that AI systems retrieve from. | 12 |
| AI-CTRL-020 | Output Handling | Application Runtime | Treat model output as untrusted input to whatever consumes it. | 13 |
| AI-CTRL-021 | Multimodal and Voice Input Security | Application Runtime | Apply the same inspection and policy to images, documents, audio and video as to text. | 28 |
| AI-CTRL-022 | Deterministic Action Authorization | Agents and Tools | Enforce authority to act, access data or spend money outside the model. | 18 |
| AI-CTRL-023 | Human Approval for Sensitive Actions | Agents and Tools | Require a person to approve irreversible or high-impact actions before they run. | 7 |
| AI-CTRL-024 | Tool and MCP Server Governance | Agents and Tools | Allow agents to use only vetted tools and tool servers, and detect when they change. | 15 |
| AI-CTRL-025 | Agent Containment and Kill Switch | Agents and Tools | Stop an agent, revoke its access and limit the damage within minutes. | 11 |
| AI-CTRL-026 | Agent Memory and Context Integrity | Agents and Tools | Prevent poisoned or cross-user content from persisting in agent memory and context. | 5 |
| AI-CTRL-027 | Agent Execution Isolation | Agents and Tools | Run agent-generated code and browser or computer-use sessions in isolation. | 11 |
| AI-CTRL-028 | Model Protection | Model, Training and Pipeline | Protect models from theft, extraction and adversarial inputs. | 18 |
| AI-CTRL-029 | Training and Fine-Tuning Data Integrity | Model, Training and Pipeline | Know where training data came from and detect tampering before it shapes a model. | 16 |
| AI-CTRL-030 | ML Pipeline and Model Registry Security | Model, Training and Pipeline | Protect the pipeline that builds, stores and releases models and prompts. | 16 |
| AI-CTRL-031 | AI Supply Chain and AI-BOM | Supply Chain, Infrastructure and Resilience | Know exactly which models, datasets, packages and prompts run in each environment. | 24 |
| AI-CTRL-032 | AI Infrastructure Hardening | Supply Chain, Infrastructure and Resilience | Harden and segment the infrastructure that trains and serves models. | 27 |
| AI-CTRL-033 | AI Security Review and Release Gate | Assurance and Testing | Review every AI system against its threats before production and after material change. | 6 |
| AI-CTRL-034 | Adversarial Testing and Continuous Evaluation | Assurance and Testing | Test AI systems against attacks before release and continuously afterwards. | 36 |
| AI-CTRL-035 | AI Incident Response and Forensics | Detection and Response | Detect, contain, investigate and recover from AI security incidents. | 39 |
| AI-CTRL-036 | AI Cost and Abuse Controls | Cost and Abuse | Attribute AI spend and stop abuse that exhausts budget or capacity. | 30 |
| AI-CTRL-037 | AI Risk Assessment and Exception Management | Governance and Compliance | Assess, treat and accept AI risks consistently, and keep every exception owned and time-bound. | 10 |
| AI-CTRL-038 | Control Assurance and Audit Evidence | Assurance and Testing | Show, with current evidence, that each AI control is operating and that findings are closed. | 17 |
| AI-CTRL-039 | Output Reliability and Content Safety | Application Runtime | Keep AI output grounded, within its approved scope and free of harmful content. | 8 |
| AI-CTRL-040 | AI Service Resilience and Fail-Safe Operation | Supply Chain, Infrastructure and Resilience | Keep AI services and their security controls available, and make them fail safely. | 13 |
| AI-CTRL-041 | Fairness, Bias Testing and Explainability | Assurance and Testing | Test AI systems that make or support high-impact decisions for unfair bias, and keep explanations that a person can understand and a reviewer can challenge. | 3 |
| AI-CTRL-042 | Fundamental Rights and Data Protection Impact Assessment | Governance and Compliance | Assess the impact on people's rights before deploying AI that is high-risk or that puts personal data at risk, and keep the assessment current. | 1 |
| AI-CTRL-043 | Regulator and Authority Engagement | Governance and Compliance | Know which authorities oversee each AI system, meet the registration, filing and notification duties they set, and keep a record of every contact. | 1 |
| AI-CTRL-044 | AI Literacy and Role-Based Competence | Governance and Compliance | Give everyone who builds, operates, oversees or uses AI the knowledge their role needs, and keep the records that show it. | 1 |
| AI-CTRL-045 | Human Oversight Design and Effectiveness | Governance and Compliance | Design human review so the people named as overseers can understand, challenge, override and stop an AI system, and show with measures that they do. | 3 |
| AI-CTRL-046 | Intellectual Property and Copyright Governance | Governance and Compliance | Control the intellectual property and copyright exposure of AI inputs, outputs and training data. | 4 |
A test case is counted under every control it tests, so the counts add up to more than 653.
Control entries
Governance and Compliance
AI-CTRL-007: Data Sovereignty
| Field | Detail |
|---|---|
| Control Objective | Ensure prompts, logs and uploads are processed and retained in approved locations. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R10 |
| Implementation Expectation | Confirm where prompts, uploads, outputs, metadata and logs are processed and stored, including the control plane and support access. Configure retention and training exclusion, and record any cross-border transfer. |
| Evidence Required | Residency attestation; retention configuration; training exclusion terms; administrative access logs. |
| Audit Test Procedure | Trace a test prompt and upload end to end and verify processing and storage locations against the approved list. Verify retention settings by checking that expired records are gone. |
| Control Owner | GRC / Legal |
| Review Frequency | Annually and on vendor change |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-007. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-007. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-007. |
| NIST AI RMF | GOVERN 1.1; GOVERN 6.1; MAP 4.1 |
| ISO/IEC 42001 | A.10.3 Suppliers; A.4.5 System and computing resources |
| Tested By (14 cases) | L03: 012, 013, 014 L08: 001 L10: 012, 013, 014, 015, 025 L15: 013, 014, 015, 020 L16: 019 |
AI-CTRL-011: AI Use-Case Registry and Risk Tiering
| Field | Detail |
|---|---|
| Control Objective | Record every AI use case with a business owner and a risk tier that decides which controls apply. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R02, AI-R18 |
| Implementation Expectation | Require intake and approval before deployment. Record owner, purpose, data, model, users and autonomy for each use case. Assign a risk tier using published criteria, and re-tier when the use case changes. |
| Evidence Required | Use-case registry; intake and approval records; tiering criteria; re-tiering history. |
| Audit Test Procedure | Sample use cases in production and confirm each has a registry entry, an owner and a tier consistent with the criteria. Sample registry entries and confirm they match what is deployed. |
| Control Owner | AI Governance Lead |
| Review Frequency | Quarterly |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-011. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-011. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-011. |
| NIST AI RMF | GOVERN 1.6; GOVERN 1.3; GOVERN 1.7; MAP 1.1 |
| ISO/IEC 42001 | A.4.2 Resource documentation; A.5.2 AI system impact assessment process; A.9.4 Intended use of the AI system |
| Tested By (18 cases) | L01: 001, 002, 003, 004, 005, 006, 007, 008, 009, 013, 016, 019, 020 L03: 037 L05: 007, 029 L12: 024, 025 |
AI-CTRL-012: AI Policy, Roles and Acceptable Use
| Field | Detail |
|---|---|
| Control Objective | Set and communicate the rules and responsibilities for using and building AI, and map each rule to a control. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R02, AI-R03, AI-R18, AI-R19, AI-R27, AI-R28 |
| Implementation Expectation | Publish an AI policy and acceptable-use standard with scope, owner and review date. Define roles and decision rights, and record governance decisions. Map each policy statement to a control in this library. Train users and reinforce the rules at the point of use. |
| Evidence Required | Approved policy; roles and responsibilities record; governance decision log; policy-to-control mapping; training and acknowledgement records. |
| Audit Test Procedure | Select policy statements and trace each to a control and to evidence that it operates. Confirm the policy was reviewed within its cycle. |
| Control Owner | GRC |
| Review Frequency | Annually |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-012. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-012. |
| MITRE ATLAS Mitigations | AML.M0018 User Training |
| NIST AI RMF | GOVERN 1.2; GOVERN 1.4; GOVERN 2.1; GOVERN 2.2 |
| ISO/IEC 42001 | A.2.2 AI policy; A.2.4 Review of the AI policy; A.3.2 AI roles and responsibilities |
| Tested By (7 cases) | L02: 001, 002, 004, 005, 022, 023 L04: 011 |
AI-CTRL-013: Privacy and Regulatory Compliance
| Field | Detail |
|---|---|
| Control Objective | Meet privacy and regulatory obligations for personal data handled by AI systems. |
| Applies To | Browser AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R03, AI-R10, AI-R27, AI-R28 |
| Implementation Expectation | Complete a privacy impact assessment for AI systems that process personal data. Define lawful basis, minimization, retention and data subject request handling, including data held in prompts, logs, indexes and memory. |
| Evidence Required | Impact assessments; records of processing; data subject request tests; evidence exports. |
| Audit Test Procedure | Run a data subject access and deletion request against a test identity and confirm the data is found and removed across prompts, logs, indexes and memory. |
| Control Owner | Privacy Office / Legal |
| Review Frequency | Annually and on material change |
| OWASP | LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-013. |
| NIST AI RMF | GOVERN 1.1; MAP 5.1; MEASURE 2.10 |
| ISO/IEC 42001 | A.5.2 AI system impact assessment process; A.5.3 Documentation of AI system impact assessments; A.5.4 Assessing AI system impact on individuals or groups of individuals |
| Tested By (39 cases) | D11: 007, 018, 019, 020 D12: 015, 016 L01: 010, 011 L02: 020 L03: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 015, 016, 017, 018, 019, 020, 028, 029, 030, 036 L04: 027 L07: 030 L10: 020, 021, 022 L13: 002, 007, 019 L17: 026 |
AI-CTRL-014: Third-Party and Vendor AI Assurance
| Field | Detail |
|---|---|
| Control Objective | Assess AI vendors and embedded AI features before use, and reassess when they change. |
| Applies To | Vendors / AI APIs / Browser AI |
| Risk Mapping | AI-R08, AI-R10, AI-R16 |
| Implementation Expectation | Evaluate vendors against the vendor evaluation framework. Cover training use of customer data, retention, sub-processors, model changes and incident notification in contracts. Re-evaluate when a vendor changes model or terms. |
| Evidence Required | Vendor assessments; contract clauses; sub-processor list; model change notices. |
| Audit Test Procedure | Sample AI vendors in use and confirm each has a current assessment and the required contract terms. Confirm the last model or terms change triggered a review. |
| Control Owner | Procurement / GRC |
| Review Frequency | Annually and on vendor change |
| OWASP | LLM03:2025 Supply Chain |
| MITRE ATLAS Techniques | AML.T0010 AI Supply Chain Compromise; AML.T0109 AI Supply Chain Rug Pull |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-014. |
| NIST AI RMF | GOVERN 6.1; GOVERN 6.2; MANAGE 3.1 |
| ISO/IEC 42001 | A.10.2 Allocating responsibilities; A.10.3 Suppliers |
| Tested By (24 cases) | D09: 018 D12: 017 D13: 019 L01: 017 L02: 021 L03: 020, 021 L06: 032, 043 L10: 025 L13: 009 L15: 016 L16: 008, 009, 010, 011, 012, 018, 019, 020, 021, 022, 023, 025 |
AI-CTRL-037: AI Risk Assessment and Exception Management
| Field | Detail |
|---|---|
| Control Objective | Assess, treat and accept AI risks consistently, and keep every exception owned and time-bound. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R02, AI-R18, AI-R28 |
| Implementation Expectation | Keep an AI risk register with an owner and a score for every risk. Use one scoring method so that different assessors reach the same result. Accept residual risk only at the right authority level. Give every exception an owner, a compensating control and an expiry date that the technical control enforces. |
| Evidence Required | AI risk register; treatment plans; risk acceptance records; exception register with expiry dates. |
| Audit Test Procedure | Sample accepted risks and confirm the approver had the authority. Let a test exception expire and confirm the technical control blocks the activity again. |
| Control Owner | Cyber Risk / GRC |
| Review Frequency | Quarterly |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-037. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-037. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-037. |
| NIST AI RMF | GOVERN 1.3; MAP 1.5; MANAGE 1.2; MANAGE 1.4 |
| ISO/IEC 42001 | Clause 6.1.2 AI risk assessment; Clause 6.1.3 AI risk treatment |
| Tested By (10 cases) | L02: 006, 007, 008, 009, 010, 011, 012 L04: 013, 014, 015 |
AI-CTRL-042: Fundamental Rights and Data Protection Impact Assessment
| Field | Detail |
|---|---|
| Control Objective | Assess the impact on people's rights before deploying AI that is high-risk or that puts personal data at risk, and keep the assessment current. |
| Applies To | AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R10, AI-R12, AI-R28 |
| Implementation Expectation | Run a combined data protection and fundamental rights impact assessment before go-live for in-scope systems. Record purpose, data, groups affected, risks, oversight, mitigation, consultation and decision. Record the data protection officer's advice and how it was handled. Reassess on material change and at least annually. |
| Evidence Required | Completed assessments; data protection officer advice; approvals dated before go-live; review dates; reassessment records. |
| Audit Test Procedure | Sample in-scope systems and confirm the assessment predates go-live. Check that each risk maps to a mitigation. Confirm that the last material change triggered a reassessment. |
| Control Owner | Data Protection Officer / AI Governance Lead |
| Review Frequency | Before deployment, annually and on material change |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-042. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-042. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-042. |
| NIST AI RMF | MAP 5.1; MAP 1.1; GOVERN 1.1 |
| ISO/IEC 42001 | A.5.2 AI system impact assessment process; A.5.3 Documentation of AI system impact assessments; A.5.4 Assessing AI system impact on individuals or groups of individuals; A.5.5 Assessing societal impacts of AI systems |
| Tested By (1 case) | L03: 034 |
AI-CTRL-043: Regulator and Authority Engagement
| Field | Detail |
|---|---|
| Control Objective | Know which authorities oversee each AI system, meet the registration, filing and notification duties they set, and keep a record of every contact. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R09, AI-R10 |
| Implementation Expectation | Keep a register of the authorities and ethics bodies relevant to each AI system and jurisdiction, with the duties each one sets and an owner for each duty. Track filings, registrations and local representative appointments to their due dates. Log every contact and its outcome. Watch for new guidance and pending rules, and review the register on a schedule. |
| Evidence Required | Authority register; filing and registration records; representative appointments; contact log; watchlist of pending rules. |
| Audit Test Procedure | Sample AI systems and confirm each lists its authorities and duties. Trace one filing or notification to its due date and evidence. Confirm the register was reviewed in the period. |
| Control Owner | Legal / Compliance |
| Review Frequency | Quarterly |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-043. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-043. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-043. |
| NIST AI RMF | GOVERN 1.1; GOVERN 5.1 |
| ISO/IEC 42001 | Clause 4.2 Understanding the needs and expectations of interested parties; A.8.3 External reporting; A.8.5 Information for interested parties |
| Tested By (1 case) | L03: 039 |
AI-CTRL-044: AI Literacy and Role-Based Competence
| Field | Detail |
|---|---|
| Control Objective | Give everyone who builds, operates, oversees or uses AI the knowledge their role needs, and keep the records that show it. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R02, AI-R19 |
| Implementation Expectation | Define the knowledge each role group needs, from board members to human reviewers and contractors. Deliver role-based training on a schedule and when a role or a system changes. Record completion and results. Check that the training works, for example through scenario tests and reviewer override rates. |
| Evidence Required | Role and needs matrix; programme and modules; completion records; effectiveness checks. |
| Audit Test Procedure | Sample staff in three role groups and confirm each completed training that matches the role. Confirm human reviewers were trained before they were assigned. Review one effectiveness check. |
| Control Owner | AI Governance Lead / HR |
| Review Frequency | Annually and on role change |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-044. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-044. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-044. |
| NIST AI RMF | GOVERN 2.2; MAP 3.4 |
| ISO/IEC 42001 | Clause 7.2 Competence; Clause 7.3 Awareness; A.4.6 Human resources |
| Tested By (1 case) | L03: 038 |
AI-CTRL-045: Human Oversight Design and Effectiveness
| Field | Detail |
|---|---|
| Control Objective | Design human review so the people named as overseers can understand, challenge, override and stop an AI system, and show with measures that they do. |
| Applies To | Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R07, AI-R12, AI-R14, AI-R18, AI-R19, AI-R28 |
| Implementation Expectation | Set, by risk tier, where a person must review, approve or be able to intervene: before the output is used, while the system runs, and after the fact by sampling. Give each overseer the evidence behind the output (sources, confidence, alternatives) and not only the result, the authority and time to override, and training that matches the role (AI-CTRL-044). Keep the volume per reviewer low enough to be reviewed, and give overseers a way to stop or roll back the system (AI-CTRL-025). Measure effectiveness: override and escalation rates, time per review, results of independent re-review of a sample, and detection of seeded errors. Reassess the design when the measures show rubber-stamping. This control covers oversight of AI-assisted decisions in general; AI-CTRL-023 gates specific irreversible agent actions. |
| Evidence Required | Oversight design record per in-scope use case; overseer roles, authority and training records; sampled re-review results; override and escalation metrics; seeded-error test results. |
| Audit Test Procedure | Select a high-tier use case and compare the oversight points in operation with the design record. Interview two overseers about the evidence they see and their authority to override. Submit a set of known-wrong outputs and measure how many are caught. Confirm the overseers can stop the system and that override metrics are reviewed. |
| Control Owner | AI Governance Lead / Application Owner |
| Review Frequency | Semi-annually and on material change |
| Regulatory Pointers | EU AI Act Article 14 (Human Oversight) and Article 26(2) (deployers assign oversight to competent, trained people with authority and support); GDPR Article 22 (Automated individual decision-making, including profiling). GCC: see rows U3, U6, U9 and Q4 of the GCC AI Regulatory Hub. Article titles and paragraph content were checked on 10 October 2026 against a secondary source (artificialintelligenceact.eu) that shows amended text; check the Official Journal text before citing. |
| OWASP | LLM06:2025 Excessive Agency; ASI09 Human-Agent Trust Exploitation |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-045. |
| MITRE ATLAS Mitigations | AML.M0029 Human In-the-Loop for AI Agent Actions |
| NIST AI RMF | MAP 3.5; GOVERN 3.2 |
| ISO/IEC 42001 | A.9.2 Processes for responsible use of AI systems; A.9.3 Objectives for responsible use of AI system |
| Tested By (3 cases) | L01: 012 L03: 040, 041 |
AI-CTRL-046: Intellectual Property and Copyright Governance
| Field | Detail |
|---|---|
| Control Objective | Control the intellectual property and copyright exposure of AI inputs, outputs and training data. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Vendors |
| Risk Mapping | AI-R27 |
| Implementation Expectation | Set a policy on what third-party copyrighted or licensed material staff may submit to AI tools, and on how AI output may be used in products, code and publications. Review vendor terms for ownership of output, indemnity for infringement claims and use of inputs for training. Record the source and licence of training and fine-tuning data (AI-CTRL-029). Where policy requires, scan AI-generated code and content for licence and similarity matches before release. Record exceptions with an owner and an expiry date. |
| Evidence Required | IP and acceptable-use policy; vendor terms review; training data provenance and licence records; scan results; exception log. |
| Audit Test Procedure | Sample vendors and confirm the terms were reviewed for output ownership and indemnity. Sample released AI-generated artefacts and confirm a scan result or a documented exception. Sample fine-tuning datasets and confirm source and licence are recorded. |
| Control Owner | Legal / Compliance |
| Review Frequency | Annually and when vendor terms change |
| Regulatory Pointers | EU AI Act Article 53(1): providers of general-purpose AI models keep a copyright compliance policy and publish a summary of training content (checked on 10 October 2026 against artificialintelligenceact.eu, a secondary source). GCC: row S9 of the GCC AI Regulatory Hub (Saudi copyright exception for text and data mining, tagged [Reported]). |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-046. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-046. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-046. |
| NIST AI RMF | MAP 4.1 |
| ISO/IEC 42001 | A.7.5 Data provenance; A.10.3 Suppliers |
| Tested By (4 cases) | L03: 028, 042 L05: 035 L13: 007 |
Discovery and Workforce AI Use
AI-CTRL-001: AI Discovery
| Field | Detail |
|---|---|
| Control Objective | Identify approved/unapproved AI platforms across browsers, endpoints, IDEs, SaaS, APIs and custom apps. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R02 |
| Implementation Expectation | Discover AI services, extensions, plugins, embedded SaaS AI features and API usage continuously. Classify each as approved, tolerated or unapproved, and attribute use to a user, device and application. |
| Evidence Required | AI service inventory; usage dashboard; user and device reports; classification of each service. |
| Audit Test Procedure | Seed a known set of approved and unapproved AI tools in a test group and compare the discovered inventory with ground truth. Confirm new tools appear within the stated interval. |
| Control Owner | Security Engineering |
| Review Frequency | Quarterly |
| OWASP | LLM03:2025 Supply Chain |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-001. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-001. |
| NIST AI RMF | GOVERN 1.6; GOVERN 6.1 |
| ISO/IEC 42001 | A.4.2 Resource documentation |
| Tested By (33 cases) | D10: 001, 022 D11: 001 D13: 017 L01: 008 L04: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 024, 025 L05: 001, 002, 003, 004, 005, 006, 007, 008, 009, 011, 029 L11: 001 L12: 001 L14: 001, 018 L15: 001 |
AI-CTRL-002: Prompt Inspection
| Field | Detail |
|---|---|
| Control Objective | Detect sensitive, restricted or risky content submitted to AI platforms. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications |
| Risk Mapping | AI-R01, AI-R03, AI-R27 |
| Implementation Expectation | Inspect prompts in line or at the endpoint for classified data, personal data, credentials and source code. Apply the data classification scheme already in use, and record the policy outcome for every detection. |
| Evidence Required | Prompt detection logs; policy outcomes; sampled test results by data type. |
| Audit Test Procedure | Submit a labelled set of sensitive and benign prompts through each channel. Measure detection rate and false positives, and confirm each detection is logged with user, device and destination. |
| Control Owner | AI Security Team |
| Review Frequency | Quarterly |
| OWASP | LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage |
| MITRE ATLAS Mitigations | AML.M0020 Generative AI Guardrails |
| NIST AI RMF | MEASURE 2.10; MANAGE 4.1 |
| ISO/IEC 42001 | A.9.2 Processes for responsible use of AI systems |
| Tested By (16 cases) | D11: 006, 015, 016 L04: 012, 017, 019, 028 L08: 004, 005, 006, 007, 008, 010, 011, 014, 027 |
AI-CTRL-003: File Upload Protection
| Field | Detail |
|---|---|
| Control Objective | Prevent uploads of confidential or restricted files to unauthorized AI services. |
| Applies To | Browser AI / AI APIs / Custom AI Applications |
| Risk Mapping | AI-R01, AI-R03, AI-R27 |
| Implementation Expectation | Inspect files sent to AI services, including nested archives, images and documents with embedded content. Block or warn according to classification and the approval status of the destination. |
| Evidence Required | Upload block and warn logs; classification policy; file type coverage matrix. |
| Audit Test Procedure | Upload labelled test files of each supported type to approved and unapproved services. Confirm the expected action and log entry for each. |
| Control Owner | DLP Team |
| Review Frequency | Quarterly |
| OWASP | LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage |
| MITRE ATLAS Mitigations | AML.M0020 Generative AI Guardrails |
| NIST AI RMF | MEASURE 2.10; MANAGE 4.1 |
| ISO/IEC 42001 | A.9.2 Processes for responsible use of AI systems |
| Tested By (6 cases) | D10: 009 L04: 018, 020, 022 L08: 012, 013 |
AI-CTRL-004: IDE AI Governance
| Field | Detail |
|---|---|
| Control Objective | Monitor and control AI coding assistants, source code sharing and secret leakage. |
| Applies To | IDE AI |
| Risk Mapping | AI-R04, AI-R22 |
| Implementation Expectation | Inventory AI coding assistants and extensions. Detect proprietary source code and secrets in assistant traffic, restrict assistants on restricted repositories, and attribute activity to developer, device and IDE. |
| Evidence Required | IDE assistant inventory; secret and source code detection events; repository policy; developer rules. |
| Audit Test Procedure | Send seeded secrets and marked source code through each approved assistant. Confirm detection, policy action and attribution. Confirm an unapproved extension is discovered. |
| Control Owner | DevSecOps |
| Review Frequency | Quarterly |
| OWASP | LLM02:2025 Sensitive Information Disclosure; LLM03:2025 Supply Chain |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage; AML.T0055 Unsecured Credentials |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-004. |
| NIST AI RMF | GOVERN 6.1; MEASURE 2.10; MANAGE 4.1 |
| ISO/IEC 42001 | A.9.2 Processes for responsible use of AI systems; A.4.4 Tooling resources |
| Tested By (18 cases) | L04: 019, 031, 032 L05: 004, 031, 032, 033, 034, 035 L06: 037 L07: 041 L08: 007, 041, 042 L09: 026 L14: 021 L16: 026 L17: 031 |
AI-CTRL-010: Policy Enforcement
| Field | Detail |
|---|---|
| Control Objective | Support monitor, warn, redact, block and allow policies based on risk and classification. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications |
| Risk Mapping | AI-R01, AI-R02, AI-R03 |
| Implementation Expectation | Apply graduated actions by user group, destination, data classification and risk. Coach users at the point of use, resist simple bypass, and manage exceptions with an owner and expiry date. |
| Evidence Required | Policy configuration; action logs by type; exception register; bypass test results. |
| Audit Test Procedure | For each policy action, run a matching test and confirm the action and log entry. Attempt documented bypass methods and record the result. |
| Control Owner | AI Security Team |
| Review Frequency | Quarterly |
| OWASP | LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage |
| MITRE ATLAS Mitigations | AML.M0020 Generative AI Guardrails |
| NIST AI RMF | GOVERN 1.4; MANAGE 1.3 |
| ISO/IEC 42001 | A.9.2 Processes for responsible use of AI systems; A.2.2 AI policy |
| Tested By (27 cases) | L02: 011 L04: 009, 011, 012, 013, 016, 025, 026, 029 L05: 028 L08: 001, 002, 003, 009, 010, 021, 022, 023, 024, 025, 026, 028, 036, 037, 038, 041 L12: 021 |
Identity and Access
AI-CTRL-015: Human and Agent Identity
| Field | Detail |
|---|---|
| Control Objective | Give every user, application and agent that uses AI a unique, attributable identity. |
| Applies To | AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R07, AI-R22, AI-R25 |
| Implementation Expectation | Issue a unique identity to each agent and AI workload, with a named human sponsor. Do not share keys between workloads. Recertify identities on a schedule and remove them when the sponsor leaves or the use case ends. Authenticate agents to each other and sign the messages they exchange, so that one agent cannot pass as another. Give training jobs, pipelines and model-serving processes their own workload identities. |
| Evidence Required | Identity registry; sponsor records; recertification results; orphaned identity report. |
| Audit Test Procedure | Sample agent identities and confirm each has a sponsor and a current recertification. Remove a test sponsor and confirm the agent identity is flagged. |
| Control Owner | IAM Team |
| Review Frequency | Semi-annually |
| OWASP | LLM06:2025 Excessive Agency; ASI03 Identity & Privilege Abuse; ASI07 Insecure Inter-Agent Communication |
| MITRE ATLAS Techniques | AML.T0012 Valid Accounts; AML.T0073 Impersonation; AML.T0091 Use Alternate Authentication Material |
| MITRE ATLAS Mitigations | AML.M0019 Control Access to AI Models and Data in Production |
| NIST AI RMF | MEASURE 2.7; MEASURE 2.8 |
| ISO/IEC 42001 | None published in ISO/IEC 42001. The wiki's own identifier applies: AI-CTRL-015. |
| Tested By (44 cases) | D09: 001, 002, 003, 004, 008, 011, 012, 013, 015, 016, 017, 018, 019, 020 D10: 015 D11: 017 L04: 030 L06: 010, 018, 035, 038, 041, 042, 043 L09: 001, 002, 010, 011, 012, 017, 018, 020, 021, 024, 025 L12: 013, 026, 027, 030, 031 L13: 021, 024, 025, 026 |
AI-CTRL-016: Least Privilege and Scoped Credentials
| Field | Detail |
|---|---|
| Control Objective | Limit what each AI workload and agent can reach to the minimum its task needs. |
| Applies To | AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R06, AI-R07, AI-R08, AI-R22 |
| Implementation Expectation | Use short-lived credentials scoped per tool and resource. Act with the end user's rights where a user is present, not with a broad service account. Detect and correct permission drift. Keep secrets out of locations an agent can read, such as environment variables, configuration files and shell history; issue short-lived tokens scoped to one task at the moment of the call; and plant canary credentials to detect an agent searching for credentials it was never given. Apply the same limits to training jobs, pipelines and model-serving identities: scope them to the datasets and models the task names, and revoke them when the job ends. |
| Evidence Required | Permission maps; token scope configuration; access review records; drift reports. |
| Audit Test Procedure | Have a test agent attempt a tool or resource outside its scope and confirm it is denied and logged. Confirm credentials expire as configured. |
| Control Owner | IAM Team |
| Review Frequency | Quarterly |
| OWASP | LLM06:2025 Excessive Agency; ASI03 Identity & Privilege Abuse |
| MITRE ATLAS Techniques | AML.T0012 Valid Accounts; AML.T0055 Unsecured Credentials; AML.T0083 Credentials from AI Agent Configuration; AML.T0098 AI Agent Tool Credential Harvesting |
| MITRE ATLAS Mitigations | AML.M0026 Privileged AI Agent Permissions Configuration; AML.M0027 Single-User AI Agent Permissions Configuration; AML.M0028 AI Agent Tools Permissions Configuration |
| NIST AI RMF | MEASURE 2.7; MANAGE 1.3 |
| ISO/IEC 42001 | None published in ISO/IEC 42001. The wiki's own identifier applies: AI-CTRL-016. |
| Tested By (50 cases) | D09: 005, 006, 007, 009, 010, 014 D10: 003, 021 D13: 005 L05: 010 L06: 012, 013, 017, 019, 039, 044 L07: 039 L08: 029, 039 L09: 003, 004, 005, 006, 007, 008, 009, 013, 014, 015, 016, 019, 022, 023, 026 L10: 017 L11: 022 L12: 014, 026, 028, 029, 030 L13: 008, 021, 022, 023, 024 L14: 004, 008, 022 L15: 010 |
Data and Retrieval
AI-CTRL-017: Data Protection in AI Pipelines
| Field | Detail |
|---|---|
| Control Objective | Apply classification, minimization and isolation to data that AI systems ingest, process and produce. |
| Applies To | AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R01, AI-R03, AI-R06, AI-R17 |
| Implementation Expectation | Carry data classification into AI pipelines. Minimize or mask sensitive fields before they reach a model. Keep tenants separate in indexes, caches, memory and logs, and record data lineage. |
| Evidence Required | Data flow diagrams; classification and masking rules; tenant isolation tests; lineage records. |
| Audit Test Procedure | Send labelled sensitive records through the pipeline and confirm masking at each stage. Attempt to read another tenant's data through the AI interface. |
| Control Owner | Data Owner / Security Engineering |
| Review Frequency | Semi-annually |
| OWASP | LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage; AML.T0085 Data from AI Services; AML.T0025 Exfiltration via Cyber Means |
| MITRE ATLAS Mitigations | AML.M0012 Encrypt Sensitive Information; AML.M0005 Control Access to AI Models and Data at Rest |
| NIST AI RMF | MEASURE 2.10; MEASURE 2.7 |
| ISO/IEC 42001 | A.4.3 Data resources; A.7.6 Data preparation |
| Tested By (31 cases) | D08: 023 D10: 017 D11: 022 L03: 015, 018 L05: 023 L06: 044 L08: 040 L10: 001, 002, 003, 004, 005, 007, 008, 009, 010, 011, 015, 016, 020, 023, 029 L11: 007, 012, 015, 023 L13: 006, 009 L14: 015 L15: 012 |
AI-CTRL-018: Retrieval Access Control
| Field | Detail |
|---|---|
| Control Objective | Return only content the requesting user is entitled to see. |
| Applies To | Custom AI Applications / Agents |
| Risk Mapping | AI-R06 |
| Implementation Expectation | Enforce document-level permissions at query time using the end user's identity. Propagate permission changes to the index promptly. Do not rely on the model to withhold content. Return citations that users can check. |
| Evidence Required | Permission test results; retrieval logs with source documents; propagation timing. |
| Audit Test Procedure | Query as users with different entitlements and confirm restricted documents are never retrieved. Revoke access to a document and measure how long it remains retrievable. |
| Control Owner | Application Owner |
| Review Frequency | Quarterly |
| OWASP | LLM08:2025 Vector and Embedding Weaknesses; LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0057 LLM Data Leakage; AML.T0085 Data from AI Services; AML.T0064 Gather RAG-Indexed Targets; AML.T0082 RAG Credential Harvesting |
| MITRE ATLAS Mitigations | AML.M0027 Single-User AI Agent Permissions Configuration; AML.M0019 Control Access to AI Models and Data in Production |
| NIST AI RMF | MEASURE 2.10; MEASURE 2.7 |
| ISO/IEC 42001 | None published in ISO/IEC 42001. The wiki's own identifier applies: AI-CTRL-018. |
| Tested By (9 cases) | L10: 006, 018, 019 L11: 004, 005, 006, 007, 016, 019 |
AI-CTRL-019: Knowledge Base Integrity
| Field | Detail |
|---|---|
| Control Objective | Stop untrusted or poisoned content from entering the corpus that AI systems retrieve from. |
| Applies To | Custom AI Applications / Agents |
| Risk Mapping | AI-R05, AI-R08, AI-R17 |
| Implementation Expectation | Control who and what can write to the corpus. Record the source of every indexed item. Scan ingested content for embedded instructions, and keep the ability to find and remove items by source. Record an owner and a freshness limit for each source, and monitor retrieval quality for drift so that superseded or degraded content is found and removed. |
| Evidence Required | Ingestion access list; provenance records; ingestion scan results; removal test. |
| Audit Test Procedure | Add a document with a planted instruction and a false fact through each ingestion path. Confirm it is detected or neutralized, and that it can be traced and removed. |
| Control Owner | Application Owner |
| Review Frequency | Quarterly |
| OWASP | LLM04:2025 Data and Model Poisoning; LLM08:2025 Vector and Embedding Weaknesses |
| MITRE ATLAS Techniques | AML.T0070 RAG Poisoning; AML.T0071 False RAG Entry Injection; AML.T0066 Retrieval Content Crafting |
| MITRE ATLAS Mitigations | AML.M0025 Maintain AI Dataset Provenance |
| NIST AI RMF | MEASURE 2.7; MAP 2.3 |
| ISO/IEC 42001 | A.7.3 Acquisition of data; A.7.4 Quality of data for AI systems; A.7.5 Data provenance |
| Tested By (12 cases) | L07: 012 L10: 024 L11: 001, 008, 009, 010, 011, 013, 014, 017, 018, 021 |
Application Runtime
AI-CTRL-005: Runtime AI Security
| Field | Detail |
|---|---|
| Control Objective | Protect custom AI applications from prompt injection, misuse and output leakage. |
| Applies To | Custom AI Applications / AI APIs |
| Risk Mapping | AI-R05, AI-R06, AI-R24 |
| Implementation Expectation | Inspect inputs and retrieved content for direct and indirect prompt injection and jailbreaks. Treat retrieved text as untrusted data. Protect the system prompt, and keep high-privilege tools out of sessions that read untrusted content. |
| Evidence Required | Prompt injection test reports; runtime logs; guardrail configuration; bypass test results. |
| Audit Test Procedure | Run the prompt injection and jailbreak cases with the control disabled and then enabled. Record attack success rate in both states against the agreed threshold. |
| Control Owner | AppSec |
| Review Frequency | Before each release and quarterly |
| OWASP | LLM01:2025 Prompt Injection; LLM07:2025 System Prompt Leakage; ASI01 Agent Goal Hijack |
| MITRE ATLAS Techniques | AML.T0051 LLM Prompt Injection; AML.T0054 LLM Jailbreak; AML.T0056 Extract LLM System Prompt; AML.T0068 LLM Prompt Obfuscation; AML.T0093 Prompt Infiltration via Public-Facing Application |
| MITRE ATLAS Mitigations | AML.M0020 Generative AI Guardrails; AML.M0021 Generative AI Guidelines; AML.M0033 Input and Output Validation for AI Agent Components |
| NIST AI RMF | MEASURE 2.7; MANAGE 1.3 |
| ISO/IEC 42001 | A.6.2.4 AI system verification and validation; A.6.2.6 AI system operation and monitoring |
| Tested By (52 cases) | D10: 010, 011, 012 D11: 002, 003, 012, 013 L05: 012, 026 L06: 020, 027 L07: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 017, 018, 019, 020, 021, 022, 023, 024, 025, 026, 031, 032, 033, 035, 036, 037, 039, 041 L08: 015, 016, 019 L11: 014, 020 L14: 022 L16: 016 |
AI-CTRL-020: Output Handling
| Field | Detail |
|---|---|
| Control Objective | Treat model output as untrusted input to whatever consumes it. |
| Applies To | Custom AI Applications / AI APIs / Agents |
| Risk Mapping | AI-R05, AI-R06, AI-R24, AI-R26 |
| Implementation Expectation | Validate and encode output before it is rendered, executed or passed to another system. Restrict what output can trigger, such as links, images and calls. Inspect responses for sensitive data. Treat reasoning traces, intermediate tool output and system instructions as sensitive content. Decide whether each is shown to users or written to logs, apply the same classification as the final output, and test for leakage. |
| Evidence Required | Output validation rules; response inspection logs; injection test results. |
| Audit Test Procedure | Induce the model to emit script, markup and command payloads and confirm none executes downstream. Confirm sensitive data in a response is detected. |
| Control Owner | AppSec |
| Review Frequency | Before each release and quarterly |
| OWASP | LLM05:2025 Improper Output Handling; LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0077 LLM Response Rendering; AML.T0067 LLM Trusted Output Components Manipulation; AML.T0057 LLM Data Leakage |
| MITRE ATLAS Mitigations | AML.M0033 Input and Output Validation for AI Agent Components; AML.M0020 Generative AI Guardrails |
| NIST AI RMF | MEASURE 2.7; MEASURE 2.10 |
| ISO/IEC 42001 | A.6.2.4 AI system verification and validation; A.6.2.6 AI system operation and monitoring |
| Tested By (13 cases) | D11: 021 L05: 014, 015, 016, 017, 020, 022, 024 L06: 030, 040 L07: 016 L08: 020, 035 |
AI-CTRL-021: Multimodal and Voice Input Security
| Field | Detail |
|---|---|
| Control Objective | Apply the same inspection and policy to images, documents, audio and video as to text. |
| Applies To | Browser AI / Custom AI Applications / Agents |
| Risk Mapping | AI-R03, AI-R05 |
| Implementation Expectation | Inspect non-text inputs for sensitive content and hidden instructions. Do not treat voice as proof of identity for sensitive actions. Govern recordings and transcripts under the retention policy. |
| Evidence Required | Modality coverage matrix; detection results by modality; recording retention configuration. |
| Audit Test Procedure | Submit images, documents and audio carrying sensitive data and hidden instructions. Compare detection with the text-channel result for the same content. |
| Control Owner | AI Security Team |
| Review Frequency | Semi-annually |
| OWASP | LLM01:2025 Prompt Injection; LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0129 Triggers in Multimodal Inputs; AML.T0051 LLM Prompt Injection; AML.T0088 Generate Deepfakes |
| MITRE ATLAS Mitigations | AML.M0034 Deepfake Detection; AML.M0020 Generative AI Guardrails |
| NIST AI RMF | MEASURE 2.7; MEASURE 2.10 |
| ISO/IEC 42001 | A.6.2.4 AI system verification and validation |
| Tested By (28 cases) | D11: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 017, 018, 019, 020, 021, 022 L04: 020, 021, 022 L07: 014, 023 L08: 013 |
AI-CTRL-039: Output Reliability and Content Safety
| Field | Detail |
|---|---|
| Control Objective | Keep AI output grounded, within its approved scope and free of harmful content. |
| Applies To | Custom AI Applications / AI APIs / IDE AI |
| Risk Mapping | AI-R12, AI-R14, AI-R20 |
| Implementation Expectation | Ground answers in approved sources and verify citations. Restrict assistants to their approved topics. Filter harmful and policy-violating output. Detect fabricated packages, links and references before users act on them, and measure factual accuracy against a baseline. |
| Evidence Required | Grounding and citation test results; topic policy; harmful content filter results; factuality baseline. |
| Audit Test Procedure | Ask questions the sources cannot answer and confirm the assistant says so. Confirm fabricated package names and links are flagged, and off-topic requests are refused. |
| Control Owner | Application Owner / AppSec |
| Review Frequency | Before each release and quarterly |
| OWASP | LLM09:2025 Misinformation |
| MITRE ATLAS Techniques | AML.T0062 Discover LLM Hallucinations; AML.T0060 Publish Hallucinated Entities; AML.T0048 External Harms |
| MITRE ATLAS Mitigations | AML.M0020 Generative AI Guardrails; AML.M0022 Generative AI Model Alignment |
| NIST AI RMF | MEASURE 2.5; MEASURE 2.6; MAP 2.2 |
| ISO/IEC 42001 | A.6.2.4 AI system verification and validation; A.8.2 System documentation and information for users |
| Tested By (8 cases) | L03: 033, 035 L05: 018, 019, 021 L08: 017, 018 L12: 017 |
Agents and Tools
AI-CTRL-006: Agent Governance
| Field | Detail |
|---|---|
| Control Objective | Monitor AI agents, tool calls, API access and autonomous actions. |
| Applies To | Agents |
| Risk Mapping | AI-R07, AI-R25 |
| Implementation Expectation | Keep a registry of every agent with its owner, purpose, model, tools, data scope and approval status. Monitor decisions, tool calls and delegation chains, and detect unregistered agents. Keep a map of which agents may call or delegate to which, and alert on links outside it. |
| Evidence Required | Agent registry; tool access logs; delegation maps; shadow agent reports. |
| Audit Test Procedure | Deploy registered and unregistered test agents. Confirm the unregistered agents are detected, and that owner, tools and data scope are correct for the registered ones. |
| Control Owner | AI Platform Team |
| Review Frequency | Quarterly |
| OWASP | LLM06:2025 Excessive Agency; ASI10 Rogue Agents; ASI07 Insecure Inter-Agent Communication |
| MITRE ATLAS Techniques | AML.T0081 Modify AI Agent Configuration |
| MITRE ATLAS Mitigations | AML.M0038 AI Agent Scope Drift Detection; AML.M0024 AI Telemetry Logging |
| NIST AI RMF | GOVERN 1.6; MEASURE 2.4 |
| ISO/IEC 42001 | A.4.2 Resource documentation; A.6.2.6 AI system operation and monitoring |
| Tested By (15 cases) | D09: 020 D10: 001, 023 L04: 023 L06: 001, 002, 003, 004, 017, 029, 034, 035, 038, 045 L17: 012 |
AI-CTRL-022: Deterministic Action Authorization
| Field | Detail |
|---|---|
| Control Objective | Enforce authority to act, access data or spend money outside the model. |
| Applies To | Agents / Custom AI Applications |
| Risk Mapping | AI-R07, AI-R24 |
| Implementation Expectation | Place a policy enforcement point between the model and every tool. It authorizes each call with deterministic rules using the real parameters, the acting identity and the end user's rights. Model output is advice, never authority. |
| Evidence Required | Policy rules; allow and deny logs; architecture review record. |
| Audit Test Procedure | Instruct a test agent, through injected content, to make a call the policy forbids. Confirm the enforcement point denies it regardless of what the model outputs. |
| Control Owner | Security Architecture |
| Review Frequency | Semi-annually |
| OWASP | LLM06:2025 Excessive Agency; ASI02 Tool Misuse & Exploitation |
| MITRE ATLAS Techniques | AML.T0053 AI Agent Tool Invocation; AML.T0086 Exfiltration via AI Agent Tool Invocation; AML.T0101 Data Destruction via AI Agent Tool Invocation |
| MITRE ATLAS Mitigations | AML.M0028 AI Agent Tools Permissions Configuration; AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data; AML.M0033 Input and Output Validation for AI Agent Components |
| NIST AI RMF | MEASURE 2.7; MANAGE 1.3 |
| ISO/IEC 42001 | A.6.2.2 AI system requirements and specification |
| Tested By (18 cases) | D09: 010 D10: 004, 005, 006, 007, 012, 014 L05: 022 L06: 011, 014, 019, 024, 033, 036, 039, 040 L07: 008 L09: 006 |
AI-CTRL-023: Human Approval for Sensitive Actions
| Field | Detail |
|---|---|
| Control Objective | Require a person to approve irreversible or high-impact actions before they run. |
| Applies To | Agents |
| Risk Mapping | AI-R07, AI-R19 |
| Implementation Expectation | Define which actions need approval. Show the approver the real parameters and the consequence, not a model-written summary. Record the decision, and guard against approval fatigue by keeping the set of gated actions small. |
| Evidence Required | List of gated actions; approval logs with parameters shown; rejection samples. |
| Audit Test Procedure | Trigger a gated action and confirm it does not run without approval. Confirm the approver sees the real parameters and that the decision is logged. |
| Control Owner | Application Owner |
| Review Frequency | Semi-annually |
| OWASP | LLM06:2025 Excessive Agency; ASI09 Human-Agent Trust Exploitation |
| MITRE ATLAS Techniques | AML.T0053 AI Agent Tool Invocation; AML.T0101 Data Destruction via AI Agent Tool Invocation |
| MITRE ATLAS Mitigations | AML.M0029 Human In-the-Loop for AI Agent Actions |
| NIST AI RMF | MAP 3.5; GOVERN 3.2 |
| ISO/IEC 42001 | A.9.2 Processes for responsible use of AI systems; A.9.3 Objectives for responsible use of AI system |
| Tested By (7 cases) | D10: 006, 013 L01: 012 L06: 015, 016 L07: 038 L09: 012 |
AI-CTRL-024: Tool and MCP Server Governance
| Field | Detail |
|---|---|
| Control Objective | Allow agents to use only vetted tools and tool servers, and detect when they change. |
| Applies To | Agents / IDE AI |
| Risk Mapping | AI-R07, AI-R08, AI-R23, AI-R24 |
| Implementation Expectation | Keep an allow-list of tools, plugins and MCP servers with an owner for each. Validate tool schemas, pin versions, and re-approve when a tool definition changes after approval. The same governance applies to agent skills and plugins: approve them from an allowlist after review, pin the version, check integrity on load and keep a procedure to remove one quickly. |
| Evidence Required | Tool and MCP server registry; allow-list configuration; change detection alerts. |
| Audit Test Procedure | Connect an unlisted tool server and confirm it is blocked. Change the description of an approved tool and confirm the change is detected before use. |
| Control Owner | AI Platform Team |
| Review Frequency | Quarterly |
| OWASP | LLM03:2025 Supply Chain; ASI04 Agentic Supply Chain Vulnerabilities; ASI02 Tool Misuse & Exploitation |
| MITRE ATLAS Techniques | AML.T0110 AI Agent Tool Poisoning; AML.T0109 AI Supply Chain Rug Pull; AML.T0099 AI Agent Tool Data Poisoning; AML.T0010 AI Supply Chain Compromise |
| MITRE ATLAS Mitigations | AML.M0028 AI Agent Tools Permissions Configuration; AML.M0014 Verify AI Artifacts |
| NIST AI RMF | GOVERN 6.1; MAP 4.1; MAP 4.2; MANAGE 3.1 |
| ISO/IEC 42001 | A.10.3 Suppliers; A.4.4 Tooling resources |
| Tested By (15 cases) | D10: 022 L06: 005, 006, 007, 008, 009, 010, 011, 012, 013, 032, 037, 041 L16: 015, 026 |
AI-CTRL-025: Agent Containment and Kill Switch
| Field | Detail |
|---|---|
| Control Objective | Stop an agent, revoke its access and limit the damage within minutes. |
| Applies To | Agents |
| Risk Mapping | AI-R07, AI-R11, AI-R21, AI-R25 |
| Implementation Expectation | Provide a tested way to stop a single agent and to revoke credentials for all agents. Set limits on steps, time and spend per task. Know which actions can be rolled back and how. |
| Evidence Required | Kill switch procedure; test records with timings; task limits configuration. |
| Audit Test Procedure | Start a long-running test agent and stop it. Measure the time until no further actions occur and credentials are invalid. |
| Control Owner | AI Platform Team / SOC |
| Review Frequency | Semi-annually |
| OWASP | LLM06:2025 Excessive Agency; ASI08 Cascading Failures; ASI10 Rogue Agents |
| MITRE ATLAS Techniques | AML.T0053 AI Agent Tool Invocation; AML.T0034 Cost Harvesting |
| MITRE ATLAS Mitigations | AML.M0037 AI Agent Authority Expansion Controls; AML.M0036 Limit AI Workload Resource Consumption |
| NIST AI RMF | MANAGE 2.4; MANAGE 2.3 |
| ISO/IEC 42001 | A.6.2.6 AI system operation and monitoring |
| Tested By (11 cases) | D09: 016 D10: 019, 020 D12: 011 D13: 009 L06: 021, 022, 023, 024, 046 L17: 019 |
AI-CTRL-026: Agent Memory and Context Integrity
| Field | Detail |
|---|---|
| Control Objective | Prevent poisoned or cross-user content from persisting in agent memory and context. |
| Applies To | Agents / Custom AI Applications |
| Risk Mapping | AI-R05, AI-R07, AI-R21 |
| Implementation Expectation | Separate memory by user and tenant. Record the source of each memory item, apply expiry, and provide a way to inspect and purge memory. Do not let untrusted content write to long-term memory unchecked. |
| Evidence Required | Memory isolation tests; memory provenance records; purge procedure and test. |
| Audit Test Procedure | Plant an instruction in memory through untrusted content and confirm it does not affect a later session. Confirm one user cannot read another's memory. |
| Control Owner | Application Owner |
| Review Frequency | Semi-annually |
| OWASP | LLM04:2025 Data and Model Poisoning; LLM01:2025 Prompt Injection; ASI06 Memory & Context Poisoning |
| MITRE ATLAS Techniques | AML.T0080 AI Agent Context Poisoning; AML.T0092 Manipulate User LLM Chat History; AML.T0094 Delay Execution of LLM Instructions |
| MITRE ATLAS Mitigations | AML.M0031 Memory Hardening |
| NIST AI RMF | MEASURE 2.7; MEASURE 2.10 |
| ISO/IEC 42001 | A.6.2.6 AI system operation and monitoring |
| Tested By (5 cases) | L07: 027, 028, 029, 030, 035 |
AI-CTRL-027: Agent Execution Isolation
| Field | Detail |
|---|---|
| Control Objective | Run agent-generated code and browser or computer-use sessions in isolation. |
| Applies To | Agents |
| Risk Mapping | AI-R07, AI-R21, AI-R22, AI-R25 |
| Implementation Expectation | Execute generated code in a sandbox with no network, filesystem or secrets access by default. Run browser and computer-use agents in a separate profile or container with their own credentials and sessions. |
| Evidence Required | Sandbox configuration; egress rules; isolation test results. |
| Audit Test Procedure | Have a test agent run code that tries to reach the network, read secrets and write outside its workspace. Confirm each attempt fails and is logged. |
| Control Owner | Platform Engineering |
| Review Frequency | Semi-annually |
| OWASP | LLM06:2025 Excessive Agency; ASI05 Unexpected Code Execution (RCE) |
| MITRE ATLAS Techniques | AML.T0050 Command and Scripting Interpreter; AML.T0105 Escape to Host; AML.T0102 Generate Malicious Commands |
| MITRE ATLAS Mitigations | AML.M0032 Segmentation of AI Agent Components; AML.M0011 Restrict Library Loading |
| NIST AI RMF | MEASURE 2.7; MANAGE 1.3 |
| ISO/IEC 42001 | A.4.5 System and computing resources; A.6.2.5 AI system deployment |
| Tested By (11 cases) | D10: 002, 003, 008, 009, 016, 021 L06: 025, 026, 031, 036, 046 |
Model, Training and Pipeline
AI-CTRL-028: Model Protection
| Field | Detail |
|---|---|
| Control Objective | Protect models from theft, extraction and adversarial inputs. |
| Applies To | Custom AI Applications / AI APIs |
| Risk Mapping | AI-R08 |
| Implementation Expectation | Restrict access to model weights and encrypt them at rest. Limit and monitor inference queries for extraction patterns. Scan models before use, and test robustness for models that make security or safety decisions. |
| Evidence Required | Model access list; query monitoring rules; model scan reports; robustness test results. |
| Audit Test Procedure | Run a scripted extraction pattern against a test endpoint and confirm it is detected and throttled. Attempt to read model weights with a non-privileged identity. |
| Control Owner | ML Engineering |
| Review Frequency | Semi-annually |
| OWASP | LLM10:2025 Unbounded Consumption; LLM02:2025 Sensitive Information Disclosure |
| MITRE ATLAS Techniques | AML.T0024 Exfiltration via AI Inference API; AML.T0043 Craft Adversarial Data; AML.T0015 Evade AI Model; AML.T0044 Full AI Model Access; AML.T0018 Manipulate AI Model |
| MITRE ATLAS Mitigations | AML.M0004 Limit AI Service Query Volume and Rate; AML.M0005 Control Access to AI Models and Data at Rest; AML.M0003 Predictive AI Model Hardening; AML.M0015 Predictive AI Adversarial Input Detection; AML.M0008 Validate AI Model |
| NIST AI RMF | MEASURE 2.7; MEASURE 2.5 |
| ISO/IEC 42001 | A.6.2.4 AI system verification and validation; A.6.2.6 AI system operation and monitoring |
| Tested By (18 cases) | D11: 004 L12: 002, 003, 004, 007, 008, 009, 010, 011, 012, 013, 015, 024, 028, 029 L13: 017 L15: 011 L16: 005 |
AI-CTRL-029: Training and Fine-Tuning Data Integrity
| Field | Detail |
|---|---|
| Control Objective | Know where training data came from and detect tampering before it shapes a model. |
| Applies To | Custom AI Applications |
| Risk Mapping | AI-R08 |
| Implementation Expectation | Record provenance for every dataset. Verify integrity before each training or fine-tuning run. Screen data for sensitive content and poisoning, and keep the ability to trace a model back to its data. |
| Evidence Required | Dataset provenance records; integrity checks; screening results; model-to-data lineage. |
| Audit Test Procedure | Alter a sample of a test dataset and confirm the integrity check fails the run. Trace a deployed model back to the exact dataset versions used. |
| Control Owner | ML Engineering / Data Owner |
| Review Frequency | Before each training run |
| OWASP | LLM04:2025 Data and Model Poisoning |
| MITRE ATLAS Techniques | AML.T0020 Training Data Poisoning; AML.T0059 Erode Dataset Integrity |
| MITRE ATLAS Mitigations | AML.M0007 Sanitize Training Data; AML.M0025 Maintain AI Dataset Provenance |
| NIST AI RMF | MAP 2.3; MAP 4.1; MEASURE 2.7; MEASURE 2.10 |
| ISO/IEC 42001 | A.7.2 Data for development and enhancement of AI system; A.7.3 Acquisition of data; A.7.4 Quality of data for AI systems; A.7.5 Data provenance |
| Tested By (16 cases) | D12: 013 L13: 001, 002, 003, 004, 005, 006, 007, 008, 013, 014, 015, 016, 018, 022 L14: 014 |
AI-CTRL-030: ML Pipeline and Model Registry Security
| Field | Detail |
|---|---|
| Control Objective | Protect the pipeline that builds, stores and releases models and prompts. |
| Applies To | Custom AI Applications |
| Risk Mapping | AI-R08 |
| Implementation Expectation | Sign model artifacts and verify signatures at deployment. Restrict who can write to the registry. Gate releases on security tests, and version models, prompts and configuration together. |
| Evidence Required | Signing configuration; registry access list; release gate results; version history. |
| Audit Test Procedure | Attempt to deploy an unsigned or altered artifact and confirm it is rejected. Confirm a failed security test blocks a release. |
| Control Owner | MLOps / DevSecOps |
| Review Frequency | Semi-annually |
| OWASP | LLM03:2025 Supply Chain; LLM04:2025 Data and Model Poisoning |
| MITRE ATLAS Techniques | AML.T0010 AI Supply Chain Compromise; AML.T0018 Manipulate AI Model; AML.T0119 Exploit Automated Artifact Processing Pipeline |
| MITRE ATLAS Mitigations | AML.M0013 Code Signing; AML.M0014 Verify AI Artifacts |
| NIST AI RMF | MEASURE 2.7; MAP 4.2 |
| ISO/IEC 42001 | A.6.2.5 AI system deployment; A.6.2.3 Documentation of AI system design and development |
| Tested By (16 cases) | D08: 020 L07: 034 L12: 004, 023 L13: 012, 013 L14: 001, 002, 003, 004, 005, 012, 013, 014, 018, 019 |
Supply Chain, Infrastructure and Resilience
AI-CTRL-031: AI Supply Chain and AI-BOM
| Field | Detail |
|---|---|
| Control Objective | Know exactly which models, datasets, packages and prompts run in each environment. |
| Applies To | Custom AI Applications / Agents / IDE AI / Vendors |
| Risk Mapping | AI-R08, AI-R16, AI-R23 |
| Implementation Expectation | Maintain an AI bill of materials per system. Take models and packages only from approved sources, verify provenance, and scan them. Re-run security tests when any component changes, including a provider-side model update. Pin model versions rather than using floating aliases such as "latest", and track provider deprecation and change notices so that a model change is a reviewed change. |
| Evidence Required | AI-BOM; approved source list; scan reports; change-triggered test records. |
| Audit Test Procedure | Compare the AI-BOM of a sampled system with what is deployed. Introduce a component from an unapproved source and confirm it is blocked or flagged. |
| Control Owner | DevSecOps |
| Review Frequency | Quarterly |
| OWASP | LLM03:2025 Supply Chain |
| MITRE ATLAS Techniques | AML.T0010 AI Supply Chain Compromise; AML.T0109 AI Supply Chain Rug Pull; AML.T0115 Publish Poisoned AI Artifacts; AML.T0111 AI Supply Chain Reputation Inflation |
| MITRE ATLAS Mitigations | AML.M0023 AI Bill of Materials; AML.M0014 Verify AI Artifacts; AML.M0016 Vulnerability Scanning |
| NIST AI RMF | GOVERN 6.1; MAP 4.1; MANAGE 3.1; MANAGE 3.2 |
| ISO/IEC 42001 | A.10.3 Suppliers; A.4.2 Resource documentation; A.7.5 Data provenance |
| Tested By (24 cases) | L05: 019 L08: 028, 042 L12: 001, 002, 005, 006, 018, 019 L13: 014 L14: 009 L16: 001, 002, 003, 004, 005, 006, 007, 013, 014, 015, 016, 017, 024 |
AI-CTRL-032: AI Infrastructure Hardening
| Field | Detail |
|---|---|
| Control Objective | Harden and segment the infrastructure that trains and serves models. |
| Applies To | Custom AI Applications |
| Risk Mapping | AI-R08, AI-R10 |
| Implementation Expectation | Separate experimentation, training, evaluation and production. Isolate model runtimes at the network level and allow only required egress. Manage secrets centrally, and isolate tenants on shared GPUs. |
| Evidence Required | Network segmentation rules; secrets management configuration; hardening baseline; isolation tests. |
| Audit Test Procedure | Attempt to reach production data from the experimentation environment and to open unapproved egress from a model runtime. Confirm both fail. |
| Control Owner | Platform Engineering |
| Review Frequency | Semi-annually |
| OWASP | LLM03:2025 Supply Chain |
| MITRE ATLAS Techniques | AML.T0049 Exploit Public-Facing Application; AML.T0132 Misconfigured or Publicly Exposed AI Services; AML.T0055 Unsecured Credentials; AML.T0025 Exfiltration via Cyber Means |
| MITRE ATLAS Mitigations | AML.M0005 Control Access to AI Models and Data at Rest; AML.M0012 Encrypt Sensitive Information; AML.M0016 Vulnerability Scanning; AML.M0019 Control Access to AI Models and Data in Production |
| NIST AI RMF | MEASURE 2.7; MAP 4.2 |
| ISO/IEC 42001 | A.4.5 System and computing resources |
| Tested By (27 cases) | L06: 042 L09: 019 L10: 023 L11: 002, 003 L12: 020 L13: 011 L14: 006, 007, 010, 011, 020 L15: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 015, 016 L16: 017 |
AI-CTRL-040: AI Service Resilience and Fail-Safe Operation
| Field | Detail |
|---|---|
| Control Objective | Keep AI services and their security controls available, and make them fail safely. |
| Applies To | AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R13, AI-R16 |
| Implementation Expectation | Decide for each control whether it fails open or closed, and test it. Measure the latency and quality cost of controls so that teams do not remove them. Provide failover that keeps guardrails, residency and logging intact. Keep tested fallback paths for AI-dependent processes, tested backups and an exit plan for each provider. Detect silent failure of controls. |
| Evidence Required | Fail-mode test results; latency and load measurements; failover and restore tests; continuity and exit plans; health monitoring alerts. |
| Audit Test Procedure | Disable the protection layer in the lab and confirm the documented fail mode. Fail over to the secondary model or region and confirm policy, logging and residency still hold. |
| Control Owner | Platform Engineering / Application Owner |
| Review Frequency | Semi-annually |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-040. |
| MITRE ATLAS Techniques | AML.T0029 Denial of AI Service |
| MITRE ATLAS Mitigations | AML.M0036 Limit AI Workload Resource Consumption |
| NIST AI RMF | MEASURE 2.7; GOVERN 6.2; MANAGE 2.3 |
| ISO/IEC 42001 | A.6.2.6 AI system operation and monitoring; A.4.5 System and computing resources |
| Tested By (13 cases) | L01: 018 L05: 013, 030 L08: 032, 033, 034, 035 L11: 025 L12: 021 L15: 019 L16: 012, 020 L17: 028 |
Assurance and Testing
AI-CTRL-033: AI Security Review and Release Gate
| Field | Detail |
|---|---|
| Control Objective | Review every AI system against its threats before production and after material change. |
| Applies To | Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R05, AI-R07, AI-R08, AI-R14, AI-R16 |
| Implementation Expectation | Threat model each system: assets, trust boundaries, worst-case output and maximum damage. Select controls from this library by risk tier. Record open risks and exceptions, and require sign-off before release. |
| Evidence Required | Threat models; architecture review records; control selection; approvals and exceptions. |
| Audit Test Procedure | Sample production systems and confirm each has a current threat model, a control selection that matches its tier and a signed approval. |
| Control Owner | Security Architecture |
| Review Frequency | Before each release and annually |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-033. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-033. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-033. |
| NIST AI RMF | MANAGE 1.1; GOVERN 4.2; MEASURE 2.7 |
| ISO/IEC 42001 | A.5.2 AI system impact assessment process; A.6.2.2 AI system requirements and specification; A.6.2.4 AI system verification and validation; A.6.2.5 AI system deployment |
| Tested By (6 cases) | L01: 002, 013, 014, 015 L06: 034 L14: 012 |
AI-CTRL-034: Adversarial Testing and Continuous Evaluation
| Field | Detail |
|---|---|
| Control Objective | Test AI systems against attacks before release and continuously afterwards. |
| Applies To | Custom AI Applications / Agents |
| Risk Mapping | AI-R05, AI-R07, AI-R16, AI-R17, AI-R20 |
| Implementation Expectation | Red team each system against defined threat cases before release. Run a regression suite in the pipeline and whenever the model, prompt, tools or data change. The risk owner sets the acceptable attack success rate in writing. Re-run the regression suite whenever the model version, prompt, retrieval source or guardrail changes, including changes made by the provider, and set a tolerance for run-to-run output variation. |
| Evidence Required | Red team reports; regression suite results; agreed thresholds; retest records. |
| Audit Test Procedure | Confirm the last model or prompt change triggered the regression suite. Reproduce a sample of reported findings and confirm fixes hold. |
| Control Owner | AI Red Team / AppSec |
| Review Frequency | Before each release and continuously |
| OWASP | LLM01:2025 Prompt Injection; LLM02:2025 Sensitive Information Disclosure; LLM03:2025 Supply Chain; LLM04:2025 Data and Model Poisoning; LLM05:2025 Improper Output Handling; LLM06:2025 Excessive Agency; LLM07:2025 System Prompt Leakage; LLM08:2025 Vector and Embedding Weaknesses; LLM09:2025 Misinformation; LLM10:2025 Unbounded Consumption |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-034. |
| MITRE ATLAS Mitigations | AML.M0035 AI Red Team |
| NIST AI RMF | MEASURE 2.7; MEASURE 2.6; MEASURE 2.1; GOVERN 4.3 |
| ISO/IEC 42001 | A.6.2.4 AI system verification and validation |
| Tested By (36 cases) | D08: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 017, 018, 019, 020, 021, 022, 023, 024, 025 D12: 014 L05: 027 L07: 024, 040 L12: 016, 018 L13: 010 L14: 002, 016, 017 L17: 029 |
AI-CTRL-038: Control Assurance and Audit Evidence
| Field | Detail |
|---|---|
| Control Objective | Show, with current evidence, that each AI control is operating and that findings are closed. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R09, AI-R15, AI-R28 |
| Implementation Expectation | Measure control effectiveness on a schedule. Collect evidence automatically where possible and record its age. Have control owners attest periodically. Track findings to verified closure, and protect governance records from silent change. |
| Evidence Required | Control effectiveness results; evidence packs with collection dates; owner attestations; findings log; record change history. |
| Audit Test Procedure | Request an evidence pack for a sampled control at short notice and check that the evidence is current. Confirm a closed finding was verified before closure. |
| Control Owner | GRC / Internal Audit |
| Review Frequency | Quarterly |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-038. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-038. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-038. |
| NIST AI RMF | GOVERN 1.5; MEASURE 1.2; MEASURE 1.3; MANAGE 4.2 |
| ISO/IEC 42001 | Clause 9.1 Monitoring, measurement, analysis and evaluation; Clause 9.2 Internal audit; Clause 9.3 Management review; Clause 10.2 Nonconformity and corrective action |
| Tested By (17 cases) | D09: 019 L02: 003, 013, 014, 015, 016, 017, 018, 019, 024, 025 L03: 022, 023, 024, 025, 026 L10: 030 |
AI-CTRL-041: Fairness, Bias Testing and Explainability
| Field | Detail |
|---|---|
| Control Objective | Test AI systems that make or support high-impact decisions for unfair bias, and keep explanations that a person can understand and a reviewer can challenge. |
| Applies To | Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R12, AI-R14, AI-R15 |
| Implementation Expectation | Define which decisions are high-impact. Identify the relevant groups with legal input. Test for bias before release, at least annually and on material model change, and record the method, data, thresholds, results and approvals. Where sensitive data is needed for testing, record why it is necessary and the safeguards. Give an explanation for each high-impact decision and a route to human review. Block or condition release when a threshold fails. |
| Evidence Required | Bias test plan and results; threshold approvals; necessity record for sensitive data; explanation records; human-review log; retest evidence. |
| Audit Test Procedure | Sample high-impact use cases and confirm a current bias test exists. Re-perform one test. Trace one decision to its explanation and review outcome. Confirm a failed result led to action. |
| Control Owner | AI Governance Lead / Model Risk |
| Review Frequency | Annually and on material model change |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-041. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-041. |
| MITRE ATLAS Mitigations | None published in MITRE ATLAS mitigations. The wiki's own identifier applies: AI-CTRL-041. |
| NIST AI RMF | MEASURE 2.11; MEASURE 2.9; MAP 5.1 |
| ISO/IEC 42001 | A.5.4 Assessing AI system impact on individuals or groups of individuals; A.6.2.4 AI system verification and validation; A.8.2 System documentation and information for users |
| Tested By (3 cases) | L03: 031, 032, 033 |
Detection and Response
AI-CTRL-008: Auditability
| Field | Detail |
|---|---|
| Control Objective | Maintain logs for prompts, responses, files, users, devices, applications and actions. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R09, AI-R15, AI-R26 |
| Implementation Expectation | Log prompts, responses, uploads, retrieved sources, model calls, tool calls and policy decisions according to policy. Records must be timestamped, attributable, exportable and retained for the approved period. |
| Evidence Required | Exportable audit records; log schema; retention policy; sample reconstruction. |
| Audit Test Procedure | Pick a completed test interaction and reconstruct it from logs alone: who, what was sent, what was retrieved, what the model returned and what action followed. |
| Control Owner | Security Engineering |
| Review Frequency | Semi-annually |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-008. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-008. |
| MITRE ATLAS Mitigations | AML.M0024 AI Telemetry Logging |
| NIST AI RMF | MEASURE 2.4; MEASURE 2.8; MANAGE 4.1 |
| ISO/IEC 42001 | A.6.2.8 AI system recording of event logs |
| Tested By (22 cases) | D09: 012 D10: 018 D12: 006 L02: 025 L05: 025 L06: 028, 045 L08: 040 L09: 025 L10: 026 L11: 024 L12: 031 L13: 025 L14: 019 L15: 018 L17: 001, 002, 004, 005, 020, 030, 031 |
AI-CTRL-009: SOC Integration
| Field | Detail |
|---|---|
| Control Objective | Forward AI security events and logs to monitoring and response platforms. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R09 |
| Implementation Expectation | Forward AI security events to the SIEM with a documented schema. Build detections and runbooks for AI-specific events, and correlate them with identity, endpoint and network telemetry. |
| Evidence Required | SIEM event IDs; parser mapping; detection rules; runbooks; alert samples. |
| Audit Test Procedure | Trigger each AI event type in the lab and confirm it arrives in the SIEM within the stated time, parses correctly and raises the expected alert. |
| Control Owner | SOC |
| Review Frequency | Semi-annually |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-009. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-009. |
| MITRE ATLAS Mitigations | AML.M0024 AI Telemetry Logging |
| NIST AI RMF | MEASURE 2.4; MEASURE 3.1; MANAGE 4.1 |
| ISO/IEC 42001 | A.6.2.6 AI system operation and monitoring; A.6.2.8 AI system recording of event logs |
| Tested By (22 cases) | L06: 029 L07: 037 L09: 017 L14: 016 L17: 001, 003, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 024, 025, 027, 028, 029 |
AI-CTRL-035: AI Incident Response and Forensics
| Field | Detail |
|---|---|
| Control Objective | Detect, contain, investigate and recover from AI security incidents. |
| Applies To | Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors |
| Risk Mapping | AI-R09, AI-R20 |
| Implementation Expectation | Maintain AI-specific playbooks and an incident taxonomy. Preserve state needed for investigation: prompts, context, index snapshots, memory and model version. Define containment options and how to work with the model provider. |
| Evidence Required | Playbooks; exercise records; preserved-state checklist; provider contact and escalation path. |
| Audit Test Procedure | Run a tabletop or lab exercise for a prompt injection incident. Confirm the interaction can be replayed, scoped and contained using the playbook. |
| Control Owner | SOC / Incident Response |
| Review Frequency | Annually and after each incident |
| OWASP | None published in the OWASP Top 10 lists. The wiki's own identifier applies: AI-CTRL-035. |
| MITRE ATLAS Techniques | None published in MITRE ATLAS techniques. The wiki's own identifier applies: AI-CTRL-035. |
| MITRE ATLAS Mitigations | AML.M0024 AI Telemetry Logging |
| NIST AI RMF | MANAGE 4.3; MANAGE 2.3; GOVERN 4.3; GOVERN 6.2 |
| ISO/IEC 42001 | A.8.4 Communication of incidents; A.8.3 External reporting; A.3.3 Reporting of concerns; A.6.2.6 AI system operation and monitoring |
| Tested By (39 cases) | D09: 017 D12: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 017, 018, 019, 020, 021, 022 L03: 019, 027 L10: 027, 028 L16: 021, 024 L17: 015, 017, 018, 019, 020, 021, 022, 023, 026, 027 |
Cost and Abuse
AI-CTRL-036: AI Cost and Abuse Controls
| Field | Detail |
|---|---|
| Control Objective | Attribute AI spend and stop abuse that exhausts budget or capacity. |
| Applies To | AI APIs / Custom AI Applications / Agents |
| Risk Mapping | AI-R11 |
| Implementation Expectation | Attribute usage to team, application, user and key. Set budgets, rate limits and quotas with enforcement. Detect spend anomalies and leaked keys, and limit loops and retries in agents. |
| Evidence Required | Cost attribution reports; budget and quota configuration; anomaly alerts; key revocation records. |
| Audit Test Procedure | Drive a test key past its budget and confirm enforcement. Simulate a traffic spike on a public endpoint and confirm detection and throttling. |
| Control Owner | FinOps / AI Platform Team |
| Review Frequency | Quarterly |
| OWASP | LLM10:2025 Unbounded Consumption |
| MITRE ATLAS Techniques | AML.T0034 Cost Harvesting; AML.T0029 Denial of AI Service; AML.T0046 Spamming AI System with Chaff Data |
| MITRE ATLAS Mitigations | AML.M0004 Limit AI Service Query Volume and Rate; AML.M0036 Limit AI Workload Resource Consumption |
| NIST AI RMF | MEASURE 2.7; MANAGE 4.1 |
| ISO/IEC 42001 | A.4.5 System and computing resources |
| Tested By (30 cases) | D11: 011 D13: 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 017, 018, 019, 020, 021 L06: 021 L07: 032 L08: 030, 031 L12: 013, 022 L13: 020 L15: 017 |
Case numbers in Tested By are short for the full ID: under L06, 001 is TC-L06-001.
Standard Control Entry Template
Use this template when adding a control. Give it the next free ID and do not reuse or renumber existing IDs, because other pages link to them.
# Control ID: AI-CTRL-XXX
## Control Name
## Control Objective
## Applies To
Browser AI / IDE AI / AI APIs / Custom AI Applications / Agents / Vendors
## Risk Mapping
## Implementation Expectation
## Evidence Required
## Audit Test Procedure
## Control Owner
## Review Frequency
## Framework Mapping
OWASP / MITRE ATLAS techniques and mitigations / NIST AI RMF / ISO/IEC 42001
## Tested By
Evidence Expectations
Evidence should be exportable, timestamped, attributable to user/device/application where applicable, and suitable for audit or incident investigation.