AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Operate network defenses that detect and constrain attacks against AI infrastructure, with owned alerts, tested response and visibility into relevant ingress, egress and internal traffic.
Why this matters
Preventive rules can fail through misconfiguration or newly exposed services. Network telemetry supports detection of scanning, lateral movement and suspicious data transfer outside model-level monitoring.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to internet-facing services, management networks, sensitive data paths and segmented AI workloads. Account for encrypted traffic and managed-service visibility limits.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
Security operations owns detection and response; network teams maintain enforcement; service owners identify essential traffic.
Implementation guidance
- Define threat scenarios and required network observations.
- Deploy appropriate filtering, detection and traffic protection.
- Route alerts to accountable responders with containment procedures.
- Test scanning, forbidden egress and lateral-movement scenarios safely.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Authorized attack simulation | Detection reaches the assigned responder. |
| Forbidden destination attempt | Traffic is blocked and relevant evidence retained. |
| Sensor or feed failure | Visibility loss produces an alert. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Detection coverage
- Network defense configuration
- Alert investigations
- Response exercise results
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Contain affected connections or segments, preserve telemetry and verify both attack interruption and continuing essential service.
Example in practice
Hypothetical example: A model worker begins connecting to multiple internal hosts. Network monitoring alerts operations, which isolates the worker and checks its credentials and recent tool activity.
Related controls
- CF12-S15: AI Infrastructure Network Security
- CF12-S18: AI Infrastructure Segmentation
- CF12-012: AI System Malware & Abuse Protection
Framework mappings
- CSA AICM (I&S-09)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0