AI Security & Resilience Assessment

DISC-001

Enterprise AI Inventory

Does the organization maintain a centralized inventory of AI systems, models, AI-enabled applications and AI services?

DISC-002

Shadow AI Visibility

Can the organization identify AI services and tools used outside formally approved processes?

DISC-003

AI Embedded in SaaS

Can the organization identify AI capabilities embedded in third-party SaaS and enterprise applications?

DISC-004

Model and Version Visibility

Are the models and material model versions used by critical AI systems identified and tracked?

DISC-005

Agent and Tool Inventory

Does the organization maintain visibility of production AI agents and the tools, APIs or systems they can invoke?

Agent-specific

DISC-006

AI Data Flow Visibility

Can the organization identify the key data sources, retrieval sources and destinations used by critical AI workloads?

RISK-001

AI Business Criticality

Are AI systems classified according to business criticality and potential operational impact?

RISK-002

Data Sensitivity and AI Risk

Is AI risk classification influenced by the sensitivity of data the system can access, generate or expose?

RISK-003

Autonomy and Privilege Risk

Does AI risk classification consider autonomy, privileges and the ability to execute business actions?

Agent-specific

RISK-004

External and Regulatory Impact

Does AI risk classification account for customer exposure, regulated decisions and legal or regulatory impact?

RISK-005

Human Oversight and Consequence

Is the adequacy of human oversight evaluated relative to the consequence of an incorrect or unsafe AI action?

GOV-001

AI Governance Operating Model

Is there a defined operating model for AI governance and AI security governance?

GOV-002

Defined AI Responsibilities

Are responsibilities for AI risk, security, data access, model approval, monitoring, incidents and lifecycle management formally assigned?

GOV-003

Critical AI Business Ownership

Does every critical production AI system have an accountable business owner?

GOV-004

Agent Sponsorship

Does every production AI agent capable of executing business actions have an accountable human sponsor or owner?

Agent-specific

GOV-005

Autonomy Decision Rights

Is authority explicitly assigned for approving increases in AI autonomy or authority?

Agent-specific

GOV-006

Residual Risk Acceptance

Can the organization identify who formally accepts residual risk for high-risk AI deployments?

GOV-007

Third-Party AI Governance

Are third-party AI services, embedded AI and external models subject to defined security and risk review before adoption or material change?

GOV-008

AI Incident Decision Authority

Is authority clearly defined to disable, contain, investigate and restore AI systems during an incident?

THRT-001

AI-Specific Threat Modeling

Are AI-specific threats incorporated into architecture and application threat modeling?

THRT-002

Prompt and Context Manipulation

Does threat modeling address direct and indirect prompt injection, context manipulation and malicious retrieved content?

GenAI-specific

THRT-003

Model and Data Manipulation

Does threat modeling address data poisoning, RAG poisoning, model manipulation, model theft or extraction where relevant?

THRT-004

Agent and Tool Abuse

Does threat modeling address excessive agency, tool abuse, credential misuse, agent impersonation and delegation abuse?

Agent-specific

THRT-005

AI Supply Chain Threats

Does threat modeling include models, libraries, datasets, plugins, connectors, MCP/tool endpoints and third-party AI dependencies?

SDLC-001

AI Security by Design

Are AI security and risk requirements defined during design before implementation begins?

SDLC-002

AI Dependency and Provenance Controls

Are models, datasets, libraries and material AI dependencies reviewed for provenance and integrity during development?

SDLC-003

Secrets and Non-Human Identity Security

Are credentials, secrets and non-human identities used by AI workloads governed throughout development and deployment?

SDLC-004

Pre-Production Security Validation

Are applicable AI-specific security tests required before production deployment?

SDLC-005

Deployment and Permission Review

Are AI permissions, data access, tools, configurations and autonomy reviewed before production deployment?

SDLC-006

Secure Retirement

Are AI systems, models, agents, identities, credentials and data access formally retired when no longer needed?

PROT-001

AI Identity Ownership

Are identities used by AI applications and agents uniquely identifiable, owned and lifecycle-managed?

PROT-002

Least Privilege for AI and Agents

Are AI applications and agents restricted to the minimum privileges required for their approved purpose?

Agent-specific

PROT-003

Sensitive Data Access Controls

Are AI access to sensitive data and retrieval sources governed according to existing data classification and authorization policies?

PROT-004

AI Input and Output Data Protection

Are controls applied to reduce inappropriate sensitive-data disclosure through AI inputs, outputs and generated content?

GenAI-specific

PROT-005

RAG and Retrieval Security

Are permissions, provenance and integrity of RAG and retrieval sources protected against unauthorized access or manipulation?

GenAI-specific

PROT-006

Model Integrity and Approval

Are critical models subject to provenance, integrity, version and approval controls?

PROT-007

AI Application Guardrails

Are appropriate input, output, isolation and execution controls implemented for AI-enabled applications?

GenAI-specific

PROT-008

Agent Tool Authorization

Are the tools, APIs and systems an AI agent can invoke explicitly authorized and constrained?

Agent-specific

PROT-009

Agent Action Boundaries and Kill Capability

Are action boundaries, transaction limits, approval requirements and rapid disablement capabilities defined for autonomous or semi-autonomous agents?

Agent-specific

PROT-010

AI Supply Chain Controls

Are third-party models, libraries, datasets, connectors and tool endpoints subject to security, provenance and change controls?

VAL-001

AI Adversarial Validation

Are critical AI systems tested for adversarial behavior before production?

VAL-002

Prompt Injection and Data Leakage Testing

Are applicable systems tested for prompt injection, indirect injection and sensitive-data leakage?

GenAI-specific

VAL-003

Agent Abuse and Privilege Testing

Are production agents tested for excessive agency, tool abuse, privilege escalation, unsafe delegation and unauthorized actions?

Agent-specific

VAL-004

AI Red Teaming

Does the organization perform structured AI red teaming for systems whose risk warrants it?

VAL-005

Resilience and Failure-Mode Testing

Are critical AI systems tested for outage, degradation, unsafe behavior and dependency failure scenarios?

MON-001

AI Security Telemetry

Does the organization collect security-relevant telemetry for critical AI applications, models, agents and tools?

MON-002

Agent Action Traceability

Can the organization reconstruct what a production AI agent did during a security investigation?

Agent-specific

MON-003

Human vs AI Action Attribution

Can security operations distinguish user actions, AI recommendations and autonomous AI actions?

Agent-specific

MON-004

AI Anomaly and Abuse Detection

Are detections defined for abnormal AI usage, sensitive-data exposure, privilege abuse, suspicious tool use or anomalous agent behavior?

MON-005

Model and Dependency Change Monitoring

Are material changes in models, AI providers, tools, permissions or dependencies monitored for security impact?

IR-001

AI-Specific Incident Playbooks

Does incident response include playbooks for AI-specific scenarios?

IR-002

Agent Containment

Can the organization quickly disable or isolate a compromised or unsafe AI agent and revoke its credentials and tool access?

Agent-specific

IR-003

AI Evidence Preservation and Investigation

Can the organization preserve relevant prompts, outputs, agent actions, identities, tool calls and model/context information for investigation?

IR-004

AI Service Continuity

Are fallback and continuity plans defined for critical business processes that depend on AI services?

IR-005

Provider Concentration and Exit Readiness

Has the organization assessed concentration risk and exit or substitution options for critical external AI dependencies?

MEAS-001

AI Security KPIs and KRIs

Are meaningful AI security KPIs and KRIs defined and reviewed?

MEAS-002

Executive and Board Reporting

Is material AI risk integrated into executive or board-level risk reporting where appropriate?

MEAS-003

Periodic Reassessment

Is AI security maturity and exposure reassessed periodically and after material system changes?

MEAS-004

AI Security Roadmap Governance

Are AI security improvement actions prioritized, owned and tracked to completion based on business exposure?

MEAS-005

Continuous Learning from Incidents and Testing

Are findings from incidents, red teaming, validation, audits and operational telemetry used to improve AI controls and governance?