This requirement exists to test AI systems against disruptions, attacks, failures, and recovery scenarios and document results, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to test AI systems against disruptions, attacks, failures, and recovery scenarios and document results. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 5.1 RS.MA: Incident Management; 6.1 RC.RP: Incident Recovery Plan Execution |
India
Regulation
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 11.4.1 – A penetration testing methodology is defined,; 11.4.4 – Exploitable vulnerabilities and security |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RM – Risk Management Strategy | GV.RM-03 – Cybersecurity risk management activities and outcomes are included in enterprise risk management processes ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-8 – PENETRATION TESTING, CA-2 – CONTROL ASSESSMENTS |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1) – Security of processing; Article 32(1)(d) – Testing, assessing and evaluating security measures |
EU
Regulation
|
vCurrent | View → |
| CERT-IN | CERT-In Directions The CERT-In Directions issued under India’s Inform... Clause: Annexure I(xx) – Attacks or malicious/suspicious activities affecting systems/servers/software/applications related to Artificial Intelligence and Machine Learning |
India
Direction
|
v2022 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Infrastructure – Testing |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC6.1 – Logical and Physical Access Controls – The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. CC7.1 – System Operations – To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. CC7.3 – System Operations – The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures. |
AICPA
Audit Framework
|
vLatest | View → |