Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
8 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-026 | Agent tool and skill vetting Tools, skills and connectors are reviewed, scanned and approved before an agent may load them, are loaded only from approved sources, and are re-reviewed when they change. | 06 Third Party & Supply Chain | Preventive |
| C-085 | AI bill of materials The models, datasets, libraries, tools and hosted components that make up each AI system are recorded and checked against known vulnerabilities, licence terms and supplier changes. | 06 Third Party & Supply Chain | Detective |
| C-083 | AI contract terms Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit. | 06 Third Party & Supply Chain | Directive |
| C-087 | Embedded AI feature review Supplier release notes, terms and product settings are monitored for new AI features in products already in use, and each feature is assessed and approved before it is enabled. | 06 Third Party & Supply Chain | Detective |
| C-084 | Model version pinning and change notification Hosted models are called by a fixed version, and a provider's new version is adopted only after the organisation's own regression tests have passed. | 06 Third Party & Supply Chain | Preventive |
| C-086 | Ongoing AI vendor monitoring Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is. | 06 Third Party & Supply Chain | Detective |
| C-005 | Third-party model and vendor due diligence Before an AI supplier, model or dataset is adopted, it is assessed against AI-specific criteria to a depth set by how material the use is, with evidence for the answers. | 06 Third Party & Supply Chain | Directive |
| C-022 | Vendor exit strategy and concentration management Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits. | 06 Third Party & Supply Chain | Directive |