From Compliance to Confidence: Mapping AI Security Controls Across 9 Frameworks

Four functions: Govern, Map, Measure, Manage. Each function has categories and subcategories analogous to the NIST CSF structure. Focuses on trustworthiness properties: valid, reliable, safe, secure, explainable, accountable, fair, privacy-preserving.

• AI system lifecycle documentation from design through decommission
• Regular impact assessments covering security and bias
• Human oversight mechanisms proportional to risk
• Incident response procedures specific to AI failures

Unacceptable risk (prohibited), High risk (Annex III — requires conformity assessment), Limited risk (transparency obligations), Minimal risk (voluntary codes). Most enterprise AI in security, HR, credit, and critical infrastructure falls in the high-risk tier.

• Risk management system documented and tested before deployment
• Training data governance: relevance, representativeness, error-free
• Technical documentation (Annex IV) kept current
• Automatic logging of all operations (tamper-proof audit trail)
• Human oversight measures built into the system design
• Accuracy, robustness, and cybersecurity measures proportional to risk

Follows the ISO High-Level Structure (Annex SL) for management system standards — the same structure as ISO 27001 and ISO 9001. This means organisations already certified to ISO 27001 can extend to ISO 42001 with relatively modest incremental effort, leveraging the same ISMS governance structure.

• AI policy and objectives defined at board level
• AI impact assessments documented for each system in scope
• Competence requirements for AI roles
• Supplier controls for AI components (models, datasets, APIs)

SOC 2 is not AI-specific but auditors increasingly examine AI system controls under the Security, Availability, and Confidentiality criteria. The AICPA has issued supplemental guidance covering AI system risks. Model endpoints, training pipelines, and AI vendor relationships fall under vendor management and logical access controls.

• Access controls to model serving infrastructure and training environments
• Change management for model versions (who approved the production rollout)
• Vendor assessments for LLM API providers
• Logging and monitoring of AI system operations

The CSA CCMv4 AI Security domain adds 16 control specifications covering AI system lifecycle, model security, data governance, and AI incident management. Particularly relevant for organisations using cloud-hosted AI services (AWS Bedrock, Azure OpenAI, Google Vertex AI) where shared responsibility for AI security must be explicitly allocated.

• AI-AIS-01: AI system inventory and classification
• AI-AIS-05: Model versioning and integrity verification
• AI-AIS-09: Training data lineage and provenance
• AI-AIS-14: AI incident detection and response

ATT&CK-style matrix of adversarial techniques targeting AI systems across the reconnaissance-weaponisation-execution kill chain. Covers 14 tactic categories including ML Attack Staging, Model Evasion, Exfiltration via ML Inference API, and Backdoor ML Model. Indispensable for threat modelling and red team exercise design.

• Threat modelling input: map ATLAS techniques to your AI components
• Red team test plan: select ATLAS techniques to simulate
• Detection coverage: map techniques to detection controls and identify gaps
• Incident classification: use ATLAS technique IDs in IR reports

Focuses specifically on language model applications, not the broader AI/ML landscape. Strongest on application-layer risks — prompt injection, insecure output handling, plugin vulnerabilities — and weakest on infrastructure and governance risks addressed by other frameworks. Best used in conjunction with MITRE ATLAS (attack techniques) and NIST AI RMF (governance).

• LLM01 Prompt Injection → Input validation, output schema enforcement
• LLM02 Insecure Output Handling → Output sanitisation controls
• LLM06 Sensitive Information Disclosure → PII controls, data minimisation
• LLM08 Excessive Agency → Least-privilege agent service accounts

CSF 2.0 explicitly introduces the Govern function and expands the framework's scope to cover AI systems. Model endpoints, training infrastructure, and AI supply chain are all within scope. Organisations already using CSF for general IT/OT security can extend their existing profiles to include AI system controls without adopting a separate framework.

• GV.OC: Organisational context includes AI risk appetite
• ID.AM: Asset management includes AI model inventory
• PR.AA: Access control applied to model serving and training environments
• DE.CM: Continuous monitoring extended to AI behavioural signals

The RBI Master Direction on IT Governance (2024) and its companion Cyber Security circular explicitly require banks to assess and manage risks introduced by AI and ML systems. Boards must approve AI risk policies. AI systems used in credit decisioning, fraud detection, and customer communication require documented risk assessments and explainability mechanisms.

• Board-approved AI and ML risk policy
• Risk assessment before production deployment of AI systems
• Audit trail for AI-driven decisions affecting customers
• Model risk management framework (validation, monitoring, version control)
• Third-party AI vendor due diligence