AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational
A tabletop can reveal unclear authority but cannot prove that a fallback has enough capacity. Exercises need to test the assumptions on which continued service depends.
Control requirement
Exercise AI service continuity arrangements at an approved risk-based interval and after material changes. Test fallback operation and recovery against business needs, assign findings and verify remediation.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
Continuity plans and strategies for AI-supported business processes, including manual and third-party alternatives.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The continuity exercise lead coordinates; service and business owners evaluate results and fund corrective action.
Implementation guidance
- Define exercise objectives and success measures from service priorities, disruption tolerance and identified uncertainty.
- Use scenarios covering provider outages, unreliable output, key dependency loss and reduced staffing as relevant; select tabletop or practical tests accordingly.
- Observe activation, handoffs, fallback capacity, communication and return to service without introducing uncontrolled production risk.
- Record outcomes and limitations, assign remediation deadlines and retest failed critical capabilities before claiming readiness.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Run the selected continuity scenario | Measured service, staffing and recovery outcomes meet approved criteria. |
| Inspect a critical exercise finding | Ownership, deadline and verification of closure are recorded. |
| Review test limitations | Unexercised assumptions are explicit and not represented as proven. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Exercise plan and scenario
- Measured outcomes and observations
- Findings and remediation
- Retest and acceptance records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate failed critical objectives to business and continuity owners. Revise service commitments, resourcing or fallback strategy while the readiness gap remains open.
Example in practice
Hypothetical example: A tabletop suggests manual review is feasible. A timed exercise finds the team can handle only a fraction of urgent demand, leading to revised prioritization and additional trained coverage.
Related controls
- CF01-S05: AI Business Continuity Risk Assessment
- CF01-S07: AI Continuity Planning
- CF01-S13: AI Disaster Response Exercise
Framework mappings
- CSA AICM (BCR-06)
- NIST AI RMF (MANAGE 4.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0