Back to the AI Control Library
21 controls | 13 core | 8 supplemental
Why this family matters
A convincing demonstration does not establish that an AI system will behave reliably under pressure. This family addresses how organizations test systems against intended use, foreseeable misuse and adversarial conditions. Testing should produce findings that affect release decisions and lead to verified remediation.
What this family covers
The controls cover threat modeling, penetration testing, adversarial analysis, model hardening, guardrails, application testing, red teaming, fairness, performance and output reliability. Supplemental controls extend into secure development, deployment, source management and threat response.
How the four control types apply
Operational controls establish testing, release review and remediation practices. Technical controls implement guardrails, hardening and security checks. Contextual conditions determine which tests represent the intended use and foreseeable misuse. Governance controls establish applicable external assurance obligations.
Where to begin
Define meaningful acceptance criteria for the use case and test the complete application, including its data paths, integrations and permissions.
Controls in this family
This family contains 21 controls: 13 core and 8 supplemental. Each page provides requirements, implementation steps, verification criteria, evidence, escalation and a worked example. Applicability depends on the system, information and risks involved.
Core controls
- CF08-001: AI Testing & Robustness Policy
- CF08-002: AI Threat Analysis & Modelling
- CF08-003: AI System Penetration Testing
- CF08-004: Adversarial Attack Analysis
- CF08-005: AI Model Hardening
- CF08-006: AI System Guardrails
- CF08-007: AI Application Security Testing
- CF08-008: AI Red-Team Exercises
- CF08-009: AI Bias & Fairness Testing
- CF08-010: AI Reliability & Performance Benchmarking
- CF08-011: AI Dependency & Library Vulnerability Scanning
- CF08-012: AI Vulnerability Remediation
- CF08-013: AI Output Reliability & Hallucination Testing
Supplemental controls
- CF08-S01: AI Application Security Policy
- CF08-S02: AI Application Security Baseline Requirements
- CF08-S03: AI Application Security Metrics
- CF08-S04: AI Secure Development Lifecycle
- CF08-S05: AI Application Secure Deployment
- CF08-S06: AI Application Vulnerability Remediation
- CF08-S07: AI Application Source Code Management
- CF08-S08: AI Threat Response
Applying this family
Begin with the intended use, consequence and security boundary. Define acceptance criteria before selecting tests and retain the exact candidate, conditions and limitations behind each result. Combine model evaluation with application and action-boundary tests, then verify remediation on the deployed system. A favorable average or isolated refusal does not establish protection across every relevant path.
Version 1.0