AI Control Library / CF-07: Human Oversight & Escalation
Designation: Supplemental | Control types represented: Operational
Control requirement
Recover or securely dispose of organizational AI-related assets when personnel leave or change responsibilities, reconciling equipment, media, credentials and relevant copies. Coordinate with access termination without waiting for physical recovery.
Why this matters
Returned hardware does not establish that access or copied information has been removed. Conversely, a missing device must not delay disabling credentials and ongoing delegated work.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Employee and contractor departures or role changes involving devices, removable media, security tokens and AI data or artifacts.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The offboarding owner coordinates HR, managers, asset management, security and service custodians.
Implementation guidance
- Maintain assigned-asset and information responsibilities, including remote equipment, tokens and permitted local copies.
- Plan return, secure transport or approved remote disposition with identity and access termination in parallel.
- Reconcile received assets, inspect handling needs and sanitize or preserve material through authorized procedures.
- Record unresolved assets and copies, pursue approved follow-up and verify closure without claiming unsupported deletion.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a departure | Assigned assets and relevant information responsibilities are reconciled. |
| Simulate delayed equipment return | Access revocation proceeds under the approved schedule. |
| Inspect recovered media | Custody, retention and sanitization decisions are documented. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Assigned-asset records
- Return and custody evidence
- Access coordination
- Exception and disposition records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate missing sensitive assets or suspected retained information to security and the offboarding authority. Apply authorized remote containment and investigate exposure as appropriate.
Example in practice
Hypothetical example: A contractor returns a laptop after leaving, but the organization disables accounts and rotates shared credentials at departure rather than leaving access active until the package arrives.
Related controls
- CF07-S06: AI Role Change Access Revocation
- CF05-016: AI Data Secure Disposal
- CF05-S17: Production AI Data Use Limitation
Framework mappings
- CSA AICM (HRS-05)
- NIST AI RMF (GOVERN 5.2)
- ISO 42001 (Cl. 7.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0