AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Segment AI infrastructure according to trust, sensitivity and function, limiting lateral movement between workloads, management systems, data stores and tenants. Enforce segmentation on actual communication paths.
Why this matters
A single compromised parser or agent should not gain access to model registries, secrets or unrelated tenants. Broad internal trust can bypass otherwise strong application controls.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to network, workload, account and administrative boundaries across cloud, on-premises and hybrid deployments.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The security architect defines zones; network and platform teams enforce boundaries; application owners justify exceptions.
Implementation guidance
- Classify components into trust and sensitivity zones.
- Permit only necessary inter-zone services and identities.
- Separate management, processing and sensitive storage paths.
- Test lateral movement and review temporary connectivity exceptions.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Compromised worker simulation | Unrelated sensitive zones remain inaccessible. |
| Required service connection | Only approved identity and protocol succeed. |
| Temporary exception expires | The added route is removed. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Zone design
- Inter-zone policies
- Lateral-movement tests
- Exception reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Isolate the compromised zone, close unintended paths and investigate systems reachable during the exposure.
Example in practice
Hypothetical example: A document converter operates in a processing segment that can write sanitized results but cannot access the model registry or secrets service.
Related controls
- CF12-008: AI Tool & Plugin Sandboxing
- CF12-S15: AI Infrastructure Network Security
- CF12-S20: AI Infrastructure Network Documentation
Framework mappings
- CSA AICM (I&S-06)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0