AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Secure AI network access through approved connectivity, protected transport, controlled ingress and egress, and restricted management interfaces. Validate the effective paths rather than relying on intended diagrams.
Why this matters
Private model endpoints can still leak through unrestricted outbound connections or exposed administration. Network controls support data and action boundaries across services.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to cloud and on-premises environments, supplier links, remote administration and connections between AI components.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The network security owner defines rules; platform teams implement them; application owners justify destinations.
Implementation guidance
- Identify required sources, destinations, protocols and management paths.
- Restrict ingress and egress to approved service needs.
- Protect transport and administrative connectivity.
- Test exposure, forbidden destinations and rule-change propagation.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Public endpoint scan | Only approved services are reachable. |
| Unapproved outbound connection | Network policy denies traffic. |
| Management connection | Approved authentication and protected transport are required. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Network rules
- Connectivity approvals
- Exposure tests
- Change records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Close unauthorized paths, investigate traffic and verify that containment does not leave alternate routes open.
Example in practice
Hypothetical example: A model worker can contact its approved artifact store and logging service but cannot send retrieved documents to arbitrary internet destinations.
Related controls
- CF12-S18: AI Infrastructure Segmentation
- CF12-S20: AI Infrastructure Network Documentation
- CF12-S21: AI Infrastructure Network Defense
Framework mappings
- CSA AICM (I&S-03)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0