AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Harden operating systems and runtime images supporting AI workloads using approved baselines, minimal services, controlled privileges and maintained security updates. Detect material configuration drift.
Why this matters
An AI application inherits vulnerabilities from hosts, containers and supporting runtimes. Unused services and privileged execution enlarge the effect of compromise.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to servers, virtual machines, containers, notebooks and accelerator hosts within the managed boundary. Account for provider-controlled layers.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The platform owner maintains hardened images; security defines baseline requirements; workload owners validate compatibility.
Implementation guidance
- Define secure baselines and remove unnecessary services and packages.
- Restrict administrative access and privileged runtime features.
- Maintain tested update and vulnerability-remediation processes.
- Scan deployed state and investigate drift from approved images.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Host baseline assessment | Required settings are enforced. |
| Unnecessary privileged service | It is removed or explicitly justified. |
| Deployed image vulnerability | Remediation follows approved risk deadlines. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Image manifests
- Hardening assessments
- Patch records
- Drift findings
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Isolate critically exposed hosts where warranted, preserve evidence and rebuild or remediate using verified images.
Example in practice
Hypothetical example: A notebook image initially includes an unused remote-access service. The hardened image removes it and runs user workloads without host-administrator privileges.
Related controls
- CF12-S13: AI Infrastructure Security Policy
- CF12-008: AI Tool & Plugin Sandboxing
- CF12-S21: AI Infrastructure Network Defense
Framework mappings
- CSA AICM (I&S-04)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0