AI security control library32 controls
AI security governance
Integrate AI systems, data, models, prompts, agents, tools, vendors, and incidents into cybersecurity governance, risk appetite, policy, and reporting.
System context and attack surface
Map users, data flows, models, retrieval, APIs, tools, identities, privileges, networks, environments, vendors, and downstream actions.
Threat actor capability and objective
Assess insiders, external attackers, users, vendors, compromised dependencies, and automated agents by access, knowledge, capability, and objective.
Security risk acceptance
Document treatment, compensating controls, residual exposure, accountable acceptance, expiration, monitoring, and stop conditions.
Identity and least privilege
Use unique identities, role and attribute controls, minimum permissions, segregation, periodic review, and rapid revocation for people and machines.
Service accounts tokens and secrets
Protect API keys, credentials, certificates, tokens, signing keys, and model or data access secrets through vaulting, rotation, scoping, and monitoring.
Environment and network isolation
Separate development, testing, production, tenants, sensitive data, tools, and high-risk execution with controlled ingress, egress, and administration.
Privileged action and transaction limits
Constrain agent and automation actions by allowlist, amount, frequency, geography, object, user, approval, and time; require idempotency and safe retry.
Data integrity and poisoning resistance
Protect collection, labeling, ingestion, transformation, training, evaluation, retrieval, feedback, and monitoring data from unauthorized or deceptive change.
Confidentiality minimization and isolation
Limit sensitive data, mask or tokenize where appropriate, isolate tenants and purposes, and prevent unintended exposure through outputs, logs, caches, or training.
Model and artifact integrity
Verify provenance, hashes, signatures, access, storage, build chain, version, deployment, and rollback for models, prompts, indexes, policies, code, and configurations.
Privacy extraction and inference testing
Test membership inference, model inversion, memorization, training-data extraction, sensitive attribute inference, and cross-context leakage.
Prompt injection resistance
Test direct and indirect prompt injection across user input, documents, email, web content, retrieval, images, files, memory, and tool output.
Retrieval and grounding integrity
Protect content ingestion, chunking, metadata, permissions, embeddings, ranking, citations, freshness, and index updates from manipulation or unauthorized access.
Output handling and content controls
Treat model output as untrusted; validate before code, query, template, browser, workflow, decision, or communication use.
System prompt and policy protection
Limit exposure and unauthorized change to system instructions, policies, routing, safety rules, examples, and hidden context while assuming determined extraction attempts.
Tool allowlisting and parameter control
Expose only necessary tools and operations; validate identities, objects, parameters, destinations, formats, and business rules at execution time.
Goal plan memory and delegation limits
Constrain goal interpretation, planning, persistence, memory, subagents, loops, budgets, and external delegation; detect goal drift.
Confirmation approval and separation
Require independent approval for high-consequence transactions, sensitive disclosures, policy changes, external communications, and irreversible actions.
Sandbox termination and recovery
Isolate untrusted execution, enforce resource limits and timeouts, provide kill controls, prevent unsafe retry, and reconcile partial actions.
Secure AI development lifecycle
Apply security requirements, design review, code and configuration review, dependency management, testing, release approval, and vulnerability remediation.
Adversarial and abuse-case testing
Test evasion, poisoning, privacy, misuse, jailbreak, injection, extraction, denial, impersonation, unsafe agency, and cross-tenant scenarios.
Dependency and model supply chain
Inventory cloud, model, data, library, image, plugin, tool, service, open-source, and fourth-party dependencies; verify provenance and monitor change.
Release baseline and change security
Approve and attest the production bundle; assess security impact and repeat affected tests for model, data, prompt, tool, policy, infrastructure, or vendor change.
AI security telemetry
Log identities, prompts, retrieval, outputs, tool calls, decisions, approvals, changes, policy events, errors, denials, latency, and resource use proportionate to risk.
Detection analytics and triage
Detect anomalous access, injection, exfiltration, poisoning, unusual outputs, privilege misuse, tool abuse, drift, resource exhaustion, and repeated failure.
AI incident response and affected-case analysis
Contain the system and downstream actions; preserve evidence; identify versions, data, decisions, consumers, transactions, and regulatory or contractual duties.
Recovery validation and lessons learned
Restore from trusted baselines, reconcile partial actions, correct affected cases, rotate secrets, revalidate controls, monitor closely, and close root causes.
Availability capacity and graceful degradation
Set service, capacity, rate, queue, timeout, dependency, and degraded-mode requirements; prevent overload from becoming unsafe behavior.
Business continuity and manual fallback
Define maximum outage, fallback workflow, data and queue reconciliation, staffing, consumer protection, and recovery priorities.
Third-party security and incident cooperation
Require evidence, change notice, vulnerabilities, subprocessors, rapid incident notice, investigation support, regulator cooperation, continuity, and exit.
Independent assurance and control effectiveness
Use qualified review, penetration and adversarial tests, control testing, audit, metrics, and executive challenge based on risk and material change.