AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational and Technical
An established security program may protect servers while overlooking model artifacts, retrieval access or an agent’s delegated authority. AI security needs to connect to existing operations without leaving these paths unowned.
Control requirement
Integrate AI-specific security risks and safeguards into the organization’s information security program, with accountable ownership, resources, assessment, incident handling and ongoing verification across models, applications, data and tools.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls define the process and decision authority; Technical controls enforce boundaries or produce the system evidence needed to verify it.
When it applies
Internally developed, hosted and embedded AI services, including supporting identities, data pipelines, providers and agent tools.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The information security leader is accountable; AI system and platform owners implement safeguards and provide operational evidence.
Implementation guidance
- Extend the security asset and trust-boundary inventory to AI models, prompts, retrieval stores, agents, tools and supporting identities.
- Assess AI-specific attack and misuse paths alongside conventional threats; assign protections and owners across supplier and internal boundaries.
- Integrate security requirements into acquisition, development, change management, monitoring and incident response, with trained operational staff.
- Review coverage after incidents or architecture changes and verify that controls work on the actual deployment rather than existing only in policy.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Trace an AI-specific attack scenario | Preventive, detective and response responsibilities are assigned and exercised. |
| Inspect agent and retrieval access | Security assessment covers their actual privileges and data boundaries. |
| Review an AI incident route | Security staff can identify, contain and investigate the affected service. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- AI security scope and ownership
- Threat and risk assessments
- Implemented-control evidence
- Monitoring, incident and training records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate unowned or uncontrolled AI attack paths to security and system owners. Restrict affected integrations or permissions when the program cannot contain material exposure.
Example in practice
Hypothetical example: A company’s security review covers its chatbot host but not the document store. Expanding the security program reveals excessive retrieval permissions and assigns remediation to the data and application owners.
Related controls
- CF01-001: Governance Program Policy & Procedures
- CF12-002: AI System Least Privilege Access Control
- CF12-010: Prompt Injection Defense
Framework mappings
- CSA AICM (GRC-05)
- NIST AI RMF (GOVERN 1.1)
- ISO 42001 (Cl. 5.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0