AI Control Library / CF-09: Monitoring & Drift Detection
Designation: Core | Control types represented: Operational and Technical
Control requirement
Monitor AI deployments for security-relevant behavior across identities, data, models and tools, providing actionable alerts and a tested route to investigation and containment.
Why this matters
A model may produce an unsafe suggestion without executing it, or a legitimate-looking tool request may create real exposure. Security monitoring must establish what happened at the enforcement and action boundaries.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
AI applications, agents, retrieval stores, tool services and supporting access or administrative paths.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The security operations owner maintains detection with AI system specialists and incident response.
Implementation guidance
- Derive security cases from threat models and actual permissions, identifying events and context needed for each.
- Correlate authentication, retrieval, authorization, tool execution and configuration activity while minimizing sensitive content.
- Assign severity, recipients and containment authority, connecting model observations to observed system effects.
- Exercise alerting and response with safe fixtures, updating coverage after changes and assessing missed events.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Generate a representative unauthorized attempt | The responsible team receives relevant actionable evidence. |
| Inspect an unsafe generated instruction | Reporting distinguishes suggestion, attempt and actual effect. |
| Exercise containment | The affected access or action path can be restricted through approved authority. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Detection cases and event coverage
- Correlation and alert routing
- Exercises and incident evidence
- Coverage and tuning reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Activate security response for credible material exposure. Contain the relevant identity or path and assess delegated work rather than relying only on closing the user session.
Example in practice
Hypothetical example: An agent repeatedly attempts denied data reads. Correlated logs support investigation while the report clearly states that authorization blocked disclosure in the observed attempts.
Related controls
- CF04-012: AI Audit Log Monitoring & Anomaly Response
- CF08-S08: AI Threat Response
- CF10-003: AI Incident Response Plans
Framework mappings
- CSA AICM (LOG-03)
- NIST AI RMF (MANAGE 4.1)
- EU AI Act (Art. 72)
- ISO 42001 (Cl. 9.1)
- MITRE ATLAS
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Monitoring & Drift Detection
Version 1.0