AI Security ยท SEC-01
AI security baseline
The organisation has adopted a recognised AI security baseline, built it into its security standards, and applies it to every use of AI.
Why it matters
General security standards were not written with AI in mind and miss threats specific to models, prompts and training data. Adopting a recognised baseline saves the organisation inventing its own and gives assessors, suppliers and staff a shared reference point.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No AI security baseline; security reviews of AI depend on the knowledge of whichever specialist is asked. |
| 2 Developing | A baseline has been chosen or drafted, but it is applied only to some uses of AI or is not yet part of security standards. |
| 3 Defined | An owned, recognised AI security baseline is part of security standards and applied before go-live, and every live use is monitored with logs set by risk. |
| 4 Managed | Conformance with the baseline is checked and reported for each use of AI, and gaps are tracked to closure or formally accepted. |
| 5 Optimising | The baseline is updated from incidents, threat intelligence and changes in recognised frameworks, and the organisation contributes to shared practice. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- SEC-01.1 A recognised AI security baseline is adopted and has an owner.
- SEC-01.2 The baseline is written into the organisation's security standards.
- SEC-01.3 The baseline is applied to every use of AI before it goes live.
- SEC-01.4 Every live use of AI is within security monitoring.
- SEC-01.5 Logs for each use of AI support detecting and investigating AI-specific attacks, at a depth set by risk.
Assessment questions
- Which AI security baseline has the organisation adopted, and who owns it?
- How is the baseline applied to a new use of AI, including AI inside bought products?
- How do you know which uses of AI meet the baseline and which do not?
- The adopted baseline and the security standard or policy that references it
- Conformance records for a sample of uses of AI
- A register of baseline gaps with owners and risk acceptance decisions
- Security monitoring coverage for live uses of AI, with AI-relevant log sources
How to reach Level 3
- Choose a recognised AI security control set as the baseline and name its owner.
- Write the baseline into the organisation's security standards.
- Apply the baseline to every use of AI before it goes live and record the result.
- Bring every live use of AI into security monitoring, with logs deep enough, by risk, to detect and investigate AI-specific attacks.
Common pitfalls
- Writing a new baseline from scratch instead of adopting one that already exists.
- Applying the baseline to new uses but not to AI already in use.
Starter artefacts
- Baseline adoption decision
- Baseline compliance record per use
- Monitoring and logging coverage list
Cross-references
| AI Cyber Security Code of Practice | 2.2 partial; 2.3 partial; 3.4 direct; 4.4 partial; 5.2 partial; 5.4 partial; 6.1 partial; 6.2 partial; 6.3 partial; 7.1 partial; 7.2 partial; 9.1 partial; 12.1 direct; 12.2 direct; 12.3 partial |
|---|---|
| EU AI Act | Art 15 partial |
| GDS AI Playbook | P3 direct |
| JSP 936 Part 1 | para 8 direct; para 49e direct; para 80 direct; para 178 partial; para 195 direct |
| MITRE AI Maturity Model | P4.3 partial; P5.2 partial; P6.2 partial |
| NIST AI 600-1 | R9 direct |
| NIST AI RMF 1.0 | MEASURE 2.7 partial |
| UK Data and AI Ethics Framework | Safety 2 direct; Safety 4 partial; SAT 1.4 partial; SAT 4.2 partial; SAT 4.9 partial |
| UNESCO AI Maturity Framework | 3.2 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.