AI Security & Operational Resilience (AIG-005) - Universal Control Library

Criticality Critical Active

Control ID

AIG-005

Domain Code

AIG

Control Nature

Corrective

Business Owner

CAIO / CISO / Security Architecture

Control Overview

AIG-005 · Full Control Profile

Business Description

Establish and maintain controls to protect AI systems against adversarial attacks, model compromise, data poisoning, prompt injection, model theft, unauthorized use, operational failures, and AI-related security incidents.

Business Objective

Ensure AI systems remain secure, resilient, reliable, and capable of supporting critical business operations throughout their lifecycle.

Business Benefits

Business Risks if Missing

Stakeholders, Industries & Technologies

AIG-005 · Operating Context

Primary Stakeholders

Applicable Industries

Applicable Technologies

Mapped Regulatory & Industry Frameworks

Harmonized Framework Mappings

The following compliance and regulatory frameworks map directly to this control's governance scope.

FRAMEWORK CODE	FRAMEWORK NAME & DESCRIPTION	FAMILY / CATEGORY	VERSION	ACTION
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor...	India Regulation	vLatest	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis...	EU Regulation	vCurrent	View →
HIPAA	Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...	US Law	vCurrent	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine...	PCI Standard	v4	View →
COBIT2019	COBIT COBIT is an enterprise governance and management f...	COBIT Governance Framework	v2019	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i...	NIST Control Catalog	vRev. 5	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin...	EU Regulation	vCurrent	View →
CERT-IN	CERT-In Directions The CERT-In Directions issued under India’s Inform...	India Direction	v2022	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting...	AICPA Audit Framework	vLatest	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a...	ISO Standard	v2022	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements...	India Guideline	vLatest	View →
CIS-V8	CIS Controls CIS Controls are a prioritized set of cybersecurit...	CIS Best Practice	vv8	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont...	India Standard	vLatest	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for...	ISO Standard	v2022	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

AI Governance & Model Security (AIG)

Purpose:

To ensure the trustworthy, secure, and ethical development and deployment of AI.

Scope:

Enterprise

View

Compliance Requirements & Audit Crosswalk

10 Specific Audit Clauses

The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

REQUIREMENT ID	REQUIREMENT TITLE & DETAILS	MAPPED CONTROL	TYPICAL OWNER	ACTION
AIG-005-R001	AI Security Framework The organization shall establish an AI s...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R002	Adversarial Attack Protection The organization shall implement protect...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R003	Prompt Injection Protection The organization shall implement protect...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R004	Model Poisoning Protection The organization shall implement protect...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R005	AI Access Security The organization shall implement access...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R006	AI Monitoring The organization shall monitor AI system...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R007	AI Incident Response The organization shall respond to AI-rel...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R008	AI Resilience Testing The organization shall conduct resilienc...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R009	AI Security Review The organization shall conduct periodic...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R010	Continuous Improvement The organization shall establish a conti...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗