{"id":"SPM-002","section":"AI Security Posture Management","requirement":"Detect AI use at the browser point of use","acceptance":"Show visibility in Chrome, Edge, Safari and Firefox where supported, including prompt context and account plan.","tier":"AT0","whyItMatters":"The browser is where most employee AI use happens, so it is the first place visibility has to work.","verificationMethod":"LT","verificationTest":"Pilot users' AI use in each supported browser appears with prompt context and account plan.","formerly":"DIS-002","alsoIn":[],"sort":1,"adoptionContext":"The listed contexts focus on browser access to personal-account AI and vendor assistants; the supported browser and capture path still determine visibility.","mappings":[{"frameworks":["csf","iso"],"explanation":"Browser prompt and account-plan telemetry makes personnel use and AI runtime activity visible for operational monitoring. Coverage is limited to supported browsers, and visibility alone does not establish adverse-event analysis.","kind":"framework","references":{"csf":["DE.CM-03","DE.CM-09"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Point-of-use browser telemetry provides evidence for anomaly monitoring; the acceptance test does not require anomaly analysis or incident evaluation.","kind":"framework","references":{"soc2":["CC7.2"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Browser-use observations, including the prompt and account fields actually captured, provide application-activity signals for security monitoring. Demonstrate browser coverage, telemetry completeness and delivery to security analysis; visibility alone does not detect anomalies or prevent disclosure.","kind":"framework","references":{"iso27001":["A.8.16"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-002","frameworkRefs":{"ISO27001":["A.8.16"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.CM-03","DE.CM-09"],"SOC2":["CC7.2"]}}