{"title":"AI Detection & Response (AIDR) Requirements — 10 Workforce AI Security Controls","description":"Detect risky AI behavior, investigate incidents and respond with full context. 10 vendor evaluation requirements with acceptance criteria, verification tests and framework mappings.","updated":"2026-10-21","count":10,"requirements":[{"id":"GRD-016","section":"Runtime Guardrails","requirement":"Explain each decision to the employee and the analyst","acceptance":"Show which detection or policy triggered and highlight the content that caused it, both in the employee's coaching message and in the analyst's alert, so the employee can fix the prompt and the analyst can confirm the decision without opening another tool.","tier":"AT0–AT4","whyItMatters":"Explaining the trigger lets the employee fix the prompt and the analyst confirm the decision, which cuts tickets on both sides.","verificationMethod":"LT","verificationTest":"The coaching message and the alert both show the detection that fired and highlight the content.","formerly":"DAT-020","alsoIn":["aidr"],"sort":26,"adoptionContext":"Employees and analysts meet these decisions in every listed context, so explanations should appear wherever the intervention does.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Naming the trigger and the content behind it gives analysts what they need to evaluate an event and gives employees specific, in-context awareness of the policy. Explanations must not expose more sensitive content than the viewer is entitled to see.","kind":"framework","references":{"csf":["DE.AE-02","PR.AT-01"],"soc2":["CC2.2","CC7.3"],"iso27001":["A.5.25","A.6.3"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Showing why a detection fired explains the control's output to the people it affects and documents how the decision was reached. It explains the decision, not the internal workings of the detection model.","kind":"framework","references":{"rmf":["MEASURE 2.9"],"iso":["A.8.2"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-016","frameworkRefs":{"ISO27001":["A.5.25","A.6.3"],"ISO42001":["A.8.2"],"NIST-CSF":["DE.AE-02","PR.AT-01"],"NIST-AI-RMF":["MEASURE 2.9"],"SOC2":["CC2.2","CC7.3"]}},{"id":"IDR-001","section":"AI Detection & Response","requirement":"Generate actionable alerts","acceptance":"Include tool, account type, detection type, policy, action, timestamp, and user or team context.","tier":"AT0–AT4","whyItMatters":"An alert the SOC cannot act on is noise. The fields decide whether triage takes seconds or a ticket.","verificationMethod":"LT","verificationTest":"Pilot alerts carry every listed field and can be triaged without opening another console.","formerly":"DAT-006","alsoIn":[],"sort":32,"adoptionContext":"Alerts need enough context to identify the originating employee AI workflow across the listed adoption settings, without unnecessarily reproducing sensitive content.","mappings":[{"frameworks":["csf"],"explanation":"Tool, account, policy, action, time and user context provide adverse-event analysis evidence and information suitable for authorized responders. An alert must actually reach the appropriate staff or tools; generation alone does not perform analysis.","kind":"framework","references":{"csf":["DE.AE-02","DE.AE-06"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"The contextual alert supplies an AI event record describing what was detected and what action occurred. Wider logging arrangements, including retention and protection, remain necessary.","kind":"framework","references":{"iso":["A.6.2.8"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Context-rich alerts create an event trail and evidence for anomaly monitoring and incident triage. Determining incident significance, assigning ownership and responding require an operated review process.\nISO/IEC 27001: A.8.15: Keep attributable event records with appropriate retention, protection and analysis; a live view alone is insufficient.","kind":"framework","references":{"soc2":["CC7.2","CC7.3"],"iso27001":["A.8.15","A.5.25"]},"relation":null,"conditions":[]}],"area":"AI Detection & Response","areaSlug":"AIDR","url":"/r/IDR-001","frameworkRefs":{"ISO27001":["A.8.15","A.5.25"],"ISO42001":["A.6.2.8"],"NIST-CSF":["DE.AE-02","DE.AE-06"],"SOC2":["CC7.2","CC7.3"]}},{"id":"IDR-002","section":"AI Detection & Response","requirement":"Detect direct and indirect prompt injection attempts.","acceptance":"Identify, block, and flag prompt injection attempts, whether directly entered into the AI tool or read via connections to third-party tools.","tier":"AT0–AT4","whyItMatters":"Successful prompt injection can lead to sensitive data exfiltration or irreversible destructive agent actions.","verificationMethod":"LT","verificationTest":"Prompt injection attempts via user input or connected tools are detected and logged with evidence.","formerly":"DAT-014","alsoIn":[],"sort":33,"adoptionContext":"Jailbreak and misuse attempts can occur in any of the listed employee AI contexts; the tiers do not imply identical detection coverage.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Evidence of jailbreak, bypass and misuse attempts supports adverse-event analysis, security monitoring and event triage. A prompt attack is not automatically malware, and detection does not guarantee blocking.\nISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"soc2":["CC7.2"],"iso27001":["A.8.16","A.5.25"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Detection evidence, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.","kind":"framework","references":{"rmf":["MEASURE 3.1"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]}],"area":"AI Detection & Response","areaSlug":"AIDR","url":"/r/IDR-002","frameworkRefs":{"ISO27001":["A.8.16","A.5.25"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MEASURE 3.1"],"SOC2":["CC7.2"]}},{"id":"IDR-003","section":"AI Detection & Response","requirement":"Identify use cases leading to elevated risk behavior.","acceptance":"Surface the use cases and teams that require additional training on safe usage principles.","tier":"AT0–AT4","whyItMatters":"Repeat exposure and under-use point to where risk reduction or enablement will pay off.","verificationMethod":"POV","verificationTest":"High-risk use cases and the associated users are identified in a pilot.","formerly":"VAL-005","alsoIn":["value"],"sort":34,"adoptionContext":"Risky use and repeat exposure patterns can appear across the listed employee AI settings; low use is not itself proof of risk or failure.","mappings":[{"frameworks":["csf","rmf","soc2","iso27001"],"explanation":"Team-level risky-use and recurring-exposure patterns provide findings for usage monitoring, AI-risk tracking and evaluation against responsible-use/security objectives. Under-use alone is an enablement signal rather than a security anomaly; assessment and intervention remain necessary beyond surfacing patterns.\nISO/IEC 27001: Confirm the need for monitoring and choose the interventions to apply.","kind":"framework","references":{"csf":["DE.CM-03"],"rmf":["MEASURE 3.1"],"soc2":["CC7.2"],"iso27001":["Cl. 9.1","A.8.16"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Observed risky-use and recurring-exposure patterns provide ongoing operational-monitoring findings for in-scope AI systems or controls. Under-use alone is an enablement signal; surfacing patterns does not establish responsible-use objectives or complete assessment and intervention.","kind":"framework","references":{"iso":["A.6.2.6"]},"relation":null,"conditions":[]}],"area":"AI Detection & Response","areaSlug":"AIDR","url":"/r/IDR-003","frameworkRefs":{"ISO27001":["Cl. 9.1","A.8.16"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.CM-03"],"NIST-AI-RMF":["MEASURE 3.1"],"SOC2":["CC7.2"]}},{"id":"IDR-004","section":"AI Detection & Response","requirement":"Integrate with SIEM, SOAR, ticketing, and identity systems","acceptance":"Use webhooks or APIs to consume relevant employee identity context and to push alerts into logging and response systems.","tier":"AT0–AT4","whyItMatters":"Security alerts need relevant context and need to stream to centralized repositories.","verificationMethod":"LT","verificationTest":"Pilot events can be enriched with employee identity context and streamed to your SIEM.","formerly":"GOV-003","alsoIn":[],"sort":35,"adoptionContext":"Operational integration with security, identity and service-management systems is a cross-tier governance capability.","mappings":[{"frameworks":["csf","soc2"],"explanation":"Structured webhooks and APIs can route adverse-event evidence into authorized staff’s monitoring, triage and incident-response workflows. A connector contributes only when delivery, ingestion, successful processing and the associated operational workflow are configured and exercised; it does not itself establish incident decisions or response ownership.","kind":"framework","references":{"csf":["DE.AE-06"],"soc2":["CC7.3","CC7.4"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Feeding AI events into enterprise incident, ticket and evidence workflows enables organizational information sharing about AI issues. The connected teams still need to operate the associated reporting and response practices.","kind":"framework","references":{"rmf":["GOVERN 4.3"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Structured telemetry and incident-ticket integration supply logging, analysis and event-triage inputs. Demonstrate delivery, ingestion, successful processing, correlation and triage routing. An endpoint alone does not establish incident decisions, response ownership or completed response.","kind":"framework","references":{"iso27001":["A.5.25","A.8.15"]},"relation":null,"conditions":[]}],"area":"AI Detection & Response","areaSlug":"AIDR","url":"/r/IDR-004","frameworkRefs":{"ISO27001":["A.5.25","A.8.15"],"NIST-CSF":["DE.AE-06"],"NIST-AI-RMF":["GOVERN 4.3"],"SOC2":["CC7.3","CC7.4"]}},{"id":"AGT-002","section":"Agent & MCP Governance","requirement":"Flag destructive, over-scoped or anomalous agent actions","acceptance":"Detect excessive permissions, unexpected tools, destructive operations, abnormal call sequences and policy bypass.","tier":"AT3, AT4, AT6","whyItMatters":"Destructive or unusual agent actions are often the first sign of a hijacked or misconfigured agent.","verificationMethod":"LT","verificationTest":"A destructive or out-of-pattern tool call in the pilot is flagged with context.","formerly":null,"alsoIn":["aidr"],"sort":37,"adoptionContext":"The listed connected-agent contexts can produce abnormal tool sequences, excessive scope or destructive operations that ordinary prompt inspection may miss.","mappings":[{"frameworks":["csf","iso","soc2","iso27001"],"explanation":"Detecting destructive operations, unexpected tools, abnormal call sequences and policy bypass supplies adverse-event analysis and monitoring of agent behavior. Excess-permission findings also inform access-right review; detection does not prevent an operation or reduce its permissions.\nISO/IEC 27001: A.8.16: Event assessment and response remain wider dependencies; test false-positive and response handling.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"iso":["A.6.2.6"],"soc2":["CC7.2","CC6.3"],"iso27001":["A.8.16","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Runtime findings supply the monitoring and evaluation component of post-deployment risk management. A detection capability alone does not establish the wider plan for user input, incident response, recovery and change management.","kind":"framework","references":{"rmf":["MANAGE 4.1"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Destructive calls and excessive permissions expose tool-misuse and identity-abuse patterns; abnormal sequences and policy bypass can also flag rogue-agent behavior. These are indicators for investigation, rather than proof that every anomalous agent is compromised or that the behavior is contained.","kind":"framework","references":{"owasp":["ASI02","ASI03","ASI10"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-002","frameworkRefs":{"ISO27001":["A.8.16","A.5.18"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MANAGE 4.1"],"SOC2":["CC7.2","CC6.3"],"OWASP-ASI":["ASI02","ASI03","ASI10"]}},{"id":"AGT-004","section":"Agent & MCP Governance","requirement":"Attribute every connector and tool call alert to a person","acceptance":"Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.","tier":"AT3, AT4, AT6","whyItMatters":"Without attribution, an agent action cannot be investigated or tied to accountability.","verificationMethod":"LT","verificationTest":"Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.","formerly":null,"alsoIn":["aidr","audit"],"sort":39,"adoptionContext":"The listed connected-agent contexts need an identity chain from the employee to the server and tool call, including the delegated identity actually used.","mappings":[{"frameworks":["soc2"],"explanation":"Linking the person, execution identity, server, tool, scope and result supplies usable information for correlating calls and reviewing identity use. It can reveal gaps between human and delegated identities; attribution alone does not authenticate the caller, manage the identity lifecycle or authorize the operation.","kind":"framework","references":{"soc2":["CC2.1","CC7.2"]},"relation":null,"conditions":[]},{"frameworks":["iso","iso27001"],"explanation":"The person-to-identity-to-tool chain supplies attribution needed for AI event records and an audit trail. Answering those questions does not by itself require persistent protected logs, and the chain must preserve the distinction between the person and any service or delegated identity.\nISO/IEC 27001: Human attribution must not expose credential values.","kind":"framework","references":{"iso":["A.6.2.8"],"iso27001":["A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Visible identity and scope relationships help investigate inherited-identity abuse, excessive delegation and confused-deputy behavior. Attribution exposes how authority was used; it does not itself stop an unauthorized call.","kind":"framework","references":{"owasp":["ASI03"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Joining the person, execution identity, server, tool, scope and result supports event correlation. Attribution does not authenticate the caller, manage identity lifecycles or authorize the operation.","kind":"framework","references":{"csf":["DE.AE-03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-004","frameworkRefs":{"ISO27001":["A.8.15"],"ISO42001":["A.6.2.8"],"NIST-CSF":["DE.AE-03"],"SOC2":["CC2.1","CC7.2"],"OWASP-ASI":["ASI03"]}},{"id":"AGT-005","section":"Agent & MCP Governance","requirement":"Provide targeted containment for a single connector or tool.","acceptance":"Disable or revoke one connector, tool, plugin, or integration for a user or group without switching off the whole AI tool.","tier":"AT1, AT2, AT3, AT6","whyItMatters":"When one connector misbehaves, switching off the whole AI tool punishes everyone.","verificationMethod":"LT","verificationTest":"One connector is disabled for one pilot group while the AI tool keeps working.","formerly":null,"alsoIn":["aidr"],"sort":40,"adoptionContext":"The listed agent contexts may share an AI client across multiple connectors, making targeted revocation preferable to disabling the whole tool when feasible.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Disabling an affected connector or revoking its token removes a specific access path and supplies an incident-containment action. It contributes to eradication only where it removes the compromised access mechanism; containment alone does not establish complete eradication or incident response.\nISO/IEC 27001: A.5.26: Integrate containment into the buyer’s incident process. A.5.18: Review effective access and adjust or revoke it where required; cached access and in-flight actions may survive revocation.","kind":"framework","references":{"csf":["RS.MI-01","RS.MI-02"],"soc2":["CC6.3","CC7.4"],"iso27001":["A.5.26","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"A targeted disablement mechanism enables disengagement of an unsafe AI dependency while other functions remain available. It contributes to operational response, but the capability alone does not establish who has authority to invoke it or a complete operational-support process.","kind":"framework","references":{"rmf":["MANAGE 2.4"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Isolating a connector, tool or token can interrupt propagation through an agent workflow, matching the isolation and circuit-breaker approach to cascading failures. The scope and timing of disablement determine which downstream actions it can contain.","kind":"framework","references":{"owasp":["ASI08"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-005","frameworkRefs":{"ISO27001":["A.5.26","A.5.18"],"ISO42001":["A.6.2.6"],"NIST-CSF":["RS.MI-01","RS.MI-02"],"NIST-AI-RMF":["MANAGE 2.4"],"SOC2":["CC6.3","CC7.4"],"OWASP-ASI":["ASI08"]}},{"id":"AGT-009","section":"Agent & MCP Governance","requirement":"Detect indirect prompt injection in content agents read","acceptance":"Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.","tier":"AT3, AT4, AT6","whyItMatters":"A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.","verificationMethod":"LT","verificationTest":"Injected instructions in content returned to pilot users' agents are detected and attributed to their source.","formerly":"DAT-014","alsoIn":["aidr"],"sort":44,"adoptionContext":"Indirect injection enters through connected-agent workflows and retrieved content; the listed tiers do not imply identical detection coverage.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Evidence and source attribution for injection, jailbreak and bypass behavior support adverse-event analysis, security monitoring and event triage. Test connector responses, retrieved content and tool outputs even with benign user prompts; prompt injection is not automatically malware, and detection does not guarantee blocking or constitute malware prevention.\nISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"soc2":["CC7.2"],"iso27001":["A.8.16","A.5.25"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Detection evidence, originating sources, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.","kind":"framework","references":{"rmf":["MEASURE 3.1"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Direct and indirect malicious instructions can hijack agent goals under ASI01. ASI06 applies when content poisons retained or retrievable context; a malicious connector response is not automatically memory poisoning. Detection coverage must be demonstrated, and blocking is not guaranteed.","kind":"framework","references":{"owasp":["ASI01","ASI06"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-009","frameworkRefs":{"ISO27001":["A.8.16","A.5.25"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MEASURE 3.1"],"SOC2":["CC7.2"],"OWASP-ASI":["ASI01","ASI06"]}},{"id":"AUD-001","section":"Audit & Evidence","requirement":"Keep a configurable record of each conversation","acceptance":"Record the prompts, responses, uploaded files and tool calls that make up each conversation, with content capture set per policy: full, partial, metadata-only or none, in line with privacy and retention rules.","tier":"Tier-independent","whyItMatters":"The conversation, not the single prompt, is the unit an investigator or auditor needs to see.","verificationMethod":"W","verificationTest":"Show one pilot conversation's record at full, partial and metadata-only capture settings.","formerly":"GOV-014","alsoIn":["aidr"],"sort":52,"adoptionContext":"Logging-depth choices apply across adoption tiers, balancing needed evidence against data minimization and any applicable retention rule.","mappings":[{"frameworks":["csf","iso","soc2"],"explanation":"Selectable prompt/response capture provides AI/security logging evidence while letting privacy and retention policy constrain content depth. The buyer must test that each chosen mode preserves needed event metadata; capture configuration alone establishes neither log integrity nor an adequate monitoring and retention process.\nSOC 2: P3.1/P4.2 require the Privacy category and relevant information in scope.","kind":"framework","references":{"csf":["PR.PS-04"],"iso":["A.6.2.8"],"soc2":["CC7.2","P3.1","P4.2"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Choosing and documenting content depth can supply evidence for evaluating transparency and accountability alongside privacy trade-offs. A configuration option alone does not establish the evaluation or its adequacy.","kind":"framework","references":{"rmf":["MEASURE 2.8"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Configurable prompt and response capture supports logging design and privacy minimization. Preserve needed event metadata, usable attribution and appropriate retention, protection and analysis even when content capture is disabled. Capture-depth options alone establish neither log integrity, record protection nor lawful monitoring.","kind":"framework","references":{"iso27001":["A.8.15","A.5.34"]},"relation":null,"conditions":[]}],"area":"Audit & Evidence","areaSlug":"AUD","url":"/r/AUD-001","frameworkRefs":{"ISO27001":["A.8.15","A.5.34"],"ISO42001":["A.6.2.8"],"NIST-CSF":["PR.PS-04"],"NIST-AI-RMF":["MEASURE 2.8"],"SOC2":["CC7.2","P3.1","P4.2"]}}]}