This requirement exists to monitor model accuracy and investigate degradation against required thresholds, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to monitor model accuracy and investigate degradation against required thresholds. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.1 DE.CM: Security Continuous Monitoring; 1.4 GV.OV: Oversight |
India
Regulation
|
vLatest | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.16 – Monitoring activities |
ISO
Standard
|
v2022 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 11.4.1 – A penetration testing methodology is defined,; 11.4.4 – Exploitable vulnerabilities and security |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan. 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.03 – Monitor and review the information security management system (ISMS). |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.19 – SYSTEM AND INFORMATION INTEGRITY, 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; SI-6 – SECURITY AND PRIVACY FUNCTION VERIFICATION, CA-7 – CONTINUOUS MONITORING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Logging and Monitoring – Alerts and Tracking |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. PI1.1 – Processing Integrity – The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services. CC7.2 – System Operations – The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. |
AICPA
Audit Framework
|
vLatest | View → |