{"id":"SPM-005","section":"AI Security Posture Management","requirement":"Discover local model runtimes and offline AI installations","acceptance":"Identify installation and running process for tools such as Ollama or LM Studio.","tier":"AT0, AT4","whyItMatters":"Local models move data off the monitored path entirely.","verificationMethod":"LT","verificationTest":"A local runtime installed on a pilot device is discovered and cataloged.","formerly":"DIS-005","alsoIn":[],"sort":4,"adoptionContext":"Local runtimes are relevant to shadow use and code-agent workflows even when no traffic reaches a hosted model provider.","mappings":[{"frameworks":["csf","iso27001"],"explanation":"Installed-versus-running local-runtime evidence supplies software-inventory and activity-monitoring inputs, including offline AI. Discovery alone neither maintains the inventory nor detects anomalies or controls installation. Finding a runtime does not establish prompt inspection.","kind":"framework","references":{"csf":["ID.AM-02","DE.CM-09"],"iso27001":["A.5.9","A.8.16"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Local-runtime discovery supplies control information about hidden software and access exposure. It does not itself restrict installation or access.","kind":"framework","references":{"soc2":["CC2.1","CC6.1"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Identifying installed and running local model runtimes documents part of the AI tooling landscape. It does not establish computing capacity, resource adequacy or prompt-inspection coverage.","kind":"framework","references":{"iso":["A.4.4"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-005","frameworkRefs":{"ISO27001":["A.5.9","A.8.16"],"ISO42001":["A.4.4"],"NIST-CSF":["ID.AM-02","DE.CM-09"],"SOC2":["CC2.1","CC6.1"]}}