This requirement exists to maintain a complete and accurate inventory of AI systems, models, and related assets, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to maintain a complete and accurate inventory of AI systems, models, and related assets. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.2-3.2.2.2 – Asset Inventory; §2.2-3.1 – Information asset profiling |
India
Guideline
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 2.1 ID.AM: Asset Management |
India
Regulation
|
vLatest | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(1) Standard: Technology asset inventory |
US
Law
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.2 – Information security roles and responsibilities |
ISO
Standard
|
v2022 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.5.1 – An inventory of system components that are |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan. 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.07 – Define information (data) and system ownership. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.2.2 – Business impact analysis |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RM – Risk Management Strategy | GV.RM-03 – Cybersecurity risk management activities and outcomes are included in enterprise risk management processes ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT, 3.5 – CONFIGURATION MANAGEMENT; PM-5 – SYSTEM INVENTORY, CM-8 – SYSTEM COMPONENT INVENTORY |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC2.1 – Information and Communication – COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control. CC8.1 – Change Management – The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. |
AICPA
Audit Framework
|
vLatest | View → |