# SPM-005: Discover local model runtimes and offline AI installations


- Area: AI Security Posture Management

- Verification: Live test
- OWASP adoption tier: AT0, AT4
- Formerly: DIS-005
- URL: /r/SPM-005

**Acceptance criteria:** Identify installation and running process for tools such as Ollama or LM Studio.

**Why it matters:** Local models move data off the monitored path entirely.

**How to verify:** A local runtime installed on a pilot device is discovered and cataloged.

**OWASP adoption context:** Local runtimes are relevant to shadow use and code-agent workflows even when no traffic reaches a hosted model provider.

**Mappings:**
- NIST CSF 2.0: ID.AM-02, DE.CM-09; ISO 27001: A.5.9, A.8.16 — Installed-versus-running local-runtime evidence supplies software-inventory and activity-monitoring inputs, including offline AI. Discovery alone neither maintains the inventory nor detects anomalies or controls installation. Finding a runtime does not establish prompt inspection.
- SOC 2: CC2.1, CC6.1 — Local-runtime discovery supplies control information about hidden software and access exposure. It does not itself restrict installation or access.
- ISO 42001: A.4.4 — Identifying installed and running local model runtimes documents part of the AI tooling landscape. It does not establish computing capacity, resource adequacy or prompt-inspection coverage.