Verification

A checklist for validating AI security and compliance operations.

Use this checklist before treating an AI product as production-ready from a security and compliance perspective.

Governance

Check	Pass condition
System register	All AI systems have owners and risk class
Risk register	High risks have mitigation and approval
Control catalog	Required controls are mapped to systems
Review cadence	Risk is reviewed after changes and incidents

Controls

Check	Pass condition
Data protection	Sensitive data paths, retention, and logs are governed
Prompt injection	Input, retrieval, and tool surfaces are tested
Access control	Human, service, and agent permissions are separated
Audit evidence	Evidence exists for each critical control

Operations

Check	Pass condition
Incident runbook	AI-specific incident classes and contacts are documented
Board reporting	Residual risk and investment decisions are visible
Exceptions	Risk appetite exceptions have owners and expiration dates

Glossary

Shared terminology for AI security and compliance operations.

Updates

Change log for the AI Security and Compliance Operations handbook.

On this page

Governance Controls Operations