Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
12 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-026 | Agent tool and skill vetting Tools, skills and connectors are reviewed, scanned and approved before an agent may load them, are loaded only from approved sources, and are re-reviewed when they change. | 06 Third Party & Supply Chain | Preventive |
| C-085 | AI bill of materials The models, datasets, libraries, tools and hosted components that make up each AI system are recorded and checked against known vulnerabilities, licence terms and supplier changes. | 06 Third Party & Supply Chain | Detective |
| C-083 | AI contract terms Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit. | 06 Third Party & Supply Chain | Directive |
| C-087 | Embedded AI feature review Supplier release notes, terms and product settings are monitored for new AI features in products already in use, and each feature is assessed and approved before it is enabled. | 06 Third Party & Supply Chain | Detective |
| C-095 | Intellectual property and licence clearance Training data, models, components and significant outputs are checked for rights and licence terms before they are used, published or shipped. | 03 Regulatory & Legal Compliance | Preventive |
| C-010 | Model artifact signing and integrity verification Approved model artefacts are cryptographically signed at validation, and the signature is verified before an artefact is loaded anywhere in production. | 10 Security & Resilience | Preventive |
| C-084 | Model version pinning and change notification Hosted models are called by a fixed version, and a provider's new version is adopted only after the organisation's own regression tests have passed. | 06 Third Party & Supply Chain | Preventive |
| C-086 | Ongoing AI vendor monitoring Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is. | 06 Third Party & Supply Chain | Detective |
| C-034 | Safe model loading and artefact scanning Model files and their dependencies are obtained only from approved sources, scanned before use, and loaded in formats and with settings that cannot execute embedded code. | 10 Security & Resilience | Preventive |
| C-005 | Third-party model and vendor due diligence Before an AI supplier, model or dataset is adopted, it is assessed against AI-specific criteria to a depth set by how material the use is, with evidence for the answers. | 06 Third Party & Supply Chain | Directive |
| C-012 | Training data provenance checks The source, collection method, rights and integrity of every dataset are verified and recorded before it is used for training, fine-tuning or retrieval. | 04 Data & Data Governance | Preventive |
| C-022 | Vendor exit strategy and concentration management Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits. | 06 Third Party & Supply Chain | Directive |