Controls.
Each entry is a specific control: what it does, where it fits in the prevent, detect, correct and direct lifecycle, and which risks it addresses, graded primary, supporting or compensating. 105 controls.
Browse by list or family
22 of 105 controls shown.
| ID | Control | Family | Type |
|---|---|---|---|
| C-036 | Abuse monitoring Usage of an AI system is analysed for patterns of misuse, extraction or attack, and accounts are restricted when such patterns are detected. | 10 Security & Resilience | Detective |
| C-006 | Adversarial robustness testing A defined battery of adversarial tests is run against an AI system before release and after every material change, and release depends on the results. | 10 Security & Resilience | Preventive |
| C-027 | Agent memory controls What an agent may write to persistent memory is restricted, validated and attributed, and stored memory can be inspected, corrected and cleared. | 10 Security & Resilience | Preventive |
| C-025 | Agent sandboxing and isolation Code execution and tool use by agents run in isolated environments with restricted network, file and system access, so that a failure is contained where it occurs. | 10 Security & Resilience | Preventive |
| C-089 | AI failure scenario testing Severe but plausible AI failure scenarios are exercised against impact tolerances on a set cycle, and the lessons are acted on. | 10 Security & Resilience | Detective |
| C-032 | AI red teaming People skilled in attacking AI systems try to make the system fail as an adversary would, before release and periodically, and their findings are tracked to closure. | 10 Security & Resilience | Detective |
| C-035 | Content safety filtering Inputs and outputs are classified against defined harm categories by a mechanism independent of the main model, and are blocked, modified or escalated according to policy. | 10 Security & Resilience | Preventive |
| C-039 | Deepfake-resistant verification Identity and instruction verification never rests on voice, image or video alone, and high-value actions require confirmation through a separate, pre-agreed channel. | 10 Security & Resilience | Preventive |
| C-088 | Fallback and manual workaround A tested alternative, such as a manual process, a simpler model or a degraded mode, is ready to take over when an AI component fails or has to be withdrawn. | 10 Security & Resilience | Corrective |
| C-021 | Important business service impact-tolerance mapping The AI components each important business service depends on are identified in the resilience map, and impact tolerances are set that cover AI-specific disruption, including a model that is running and wrong. | 10 Security & Resilience | Directive |
| C-009 | Inference usage quotas and rate limiting Limits on request rate, input size, output size and spend are enforced for each user, tenant and system, with alerts as limits are approached. | 10 Security & Resilience | Preventive |
| C-029 | Input filtering and injection defence User input and all retrieved or tool-supplied content are screened for hostile instructions and passed to the model marked as data, separate from the system's own instructions. | 10 Security & Resilience | Preventive |
| C-024 | Least-privilege agent identity and permissions Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement. | 10 Security & Resilience | Preventive |
| C-031 | Model and data access control Access to model weights, training data, pipelines and inference endpoints is granted by role, limited to need, logged and reviewed. | 10 Security & Resilience | Preventive |
| C-010 | Model artifact signing and integrity verification Approved model artefacts are cryptographically signed at validation, and the signature is verified before an artefact is loaded anywhere in production. | 10 Security & Resilience | Preventive |
| C-004 | Output validation and guardrails Every model output is validated against a schema and sanitised by deterministic code before any downstream system, tool or user interface acts on it. | 10 Security & Resilience | Preventive |
| C-038 | Review of AI-generated code Code produced with an AI assistant passes the same human review, security scanning and dependency checks as any other code before it is merged. | 10 Security & Resilience | Detective |
| C-034 | Safe model loading and artefact scanning Model files and their dependencies are obtained only from approved sources, scanned before use, and loaded in formats and with settings that cannot execute embedded code. | 10 Security & Resilience | Preventive |
| C-030 | Secrets management for AI Credentials used by AI systems are held in a vault, supplied at run time, kept out of prompts, configuration and notebooks, scoped narrowly and rotated. | 10 Security & Resilience | Preventive |
| C-033 | Secure AI development pipeline The pipelines and tooling that train, evaluate and deploy models are subject to the security controls of production software delivery, including review, scanning and segregation of environments. | 10 Security & Resilience | Preventive |
| C-011 | System prompt hardening System prompts are written to contain no secrets and no security decisions, are placed under version control and review, and are tested against extraction before release. | 10 Security & Resilience | Preventive |
| C-037 | Tenant and session isolation Every stateful component of an AI system, including caches, memory, retrieval indexes and fine-tuned models, is partitioned by customer and user, and the partitioning is tested. | 10 Security & Resilience | Preventive |