Keywords
DeploymentCloud SecurityOn-Premise SecurityData Residency
Application
MandatoryFrequency
Every 12 monthsType
PreventativeCapabilities
Universal
Crosswalks
MITRE ATLAS?
NIST AI RMF?
OWASP Top 10?
CSA AICM?
AIS-05: Application Security TestingDCS-01: Off-Site Equipment Disposal Policy and ProceduresDCS-02: Off-Site Transfer Authorization Policy and ProceduresDCS-03: Secure Area Policy and ProceduresDCS-04: Secure Media Transportation Policy and ProceduresDCS-05: Assets ClassificationDCS-06: Assets Cataloguing and TrackingDCS-07: Controlled Physical Access PointsDCS-08: Equipment IdentificationDCS-09: Secure Area AuthorizationDCS-10: Surveillance SystemDCS-11: Adverse Event Response TrainingDCS-12: Cabling SecurityDCS-13: Environmental SystemsDCS-14: Secure UtilitiesDCS-15: Equipment Location
OWASP AIVSS?
IBM AI Risk Atlas?
Cisco AI Security Framework?
Should include?
Documenting data storage security. For example, assessments around cloud vs. on-premises processing.
E005.1 Documentation: Data storage security practices
Documenting data storage security practices against data sensitivity, regulatory requirements, and operational needs - may include security trust center documentation, deployment decision memos such as cloud vs. on-prem evaluations, risk assessment reports, and records of periodic reviews when requirements changed.
Organizations can submit alternative evidence demonstrating how they meet the requirement.