AI Control Library / CF-12: Security & Abuse Resistance
Designation: Core | Control types represented: Operational and Technical
Control requirement
Use authentication appropriate to the consequence of AI system access. Protect privileged and sensitive human access with strong multifactor authentication and use securely managed identities for workloads.
Why this matters
Compromised credentials can expose training data, prompts, model assets and action tools. Strong authentication must cover direct endpoints and recovery channels as well as the main interface.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to user portals, administrative consoles, developer access and machine-to-machine connections. Prefer phishing-resistant methods for high-impact human access where supported.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The identity owner defines authentication assurance; system owners integrate it; support teams secure recovery and enrollment.
Implementation guidance
- Classify access paths by sensitivity and required assurance.
- Enforce approved authentication methods and protected enrollment.
- Manage workload identity and token issuance without shared human accounts.
- Test bypass, recovery, session expiry and direct endpoint access.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Privileged login | Required authentication assurance is enforced. |
| Recovery attempt | Identity verification cannot bypass approved controls. |
| Expired or revoked token | Resource rejects access. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Authentication standards
- Configuration records
- Recovery procedures
- Access tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disable compromised methods or sessions, secure recovery paths and assess actions performed through affected identities.
Example in practice
Hypothetical example: An AI administration console requires phishing-resistant authentication. Its legacy management endpoint is also protected so administrators cannot bypass the requirement through an alternate URL.
Related controls
- CF12-S01: AI System Password & Credential Policy
- CF12-S10: AI System Unique User Identification
- CF12-S11: AI System Secrets Management
Framework mappings
- CSA AICM (IAM-14)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0