{"id":"SPM-007","section":"AI Security Posture Management","requirement":"Provide visibility for unmanaged endpoints","acceptance":"Use approved SaaS/API methods where no endpoint agent can be installed.","tier":"AT1, AT2","whyItMatters":"Contractors and personal devices still reach corporate AI tenants, and some will never run an agent.","verificationMethod":"W + D","verificationTest":"The vendor shows and documents the coverage method for an unmanaged device in your environment.","formerly":"DIS-012","alsoIn":[],"sort":6,"adoptionContext":"Shadow, vendor-embedded and platform-integrated use may occur without a managed endpoint; network or service-side visibility depends on the available architecture.","mappings":[{"frameworks":["csf"],"explanation":"Approved network, remote-MCP and SaaS/API observations provide network or service-monitoring inputs where an endpoint agent cannot run. They do not establish equivalent visibility into all device activity.","kind":"framework","references":{"csf":["DE.CM-01","DE.CM-06"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Alternative collection methods contribute to the AI operation-monitoring arrangement for unmanaged endpoints. Its scope, gaps and operating process still need to be defined.","kind":"framework","references":{"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Off-endpoint telemetry supplies otherwise missing evidence for security monitoring within the buyer’s boundary. Validate coverage gaps, analysis and review rather than assuming equivalent visibility. These methods do not harden the endpoint.","kind":"framework","references":{"soc2":["CC7.2"],"iso27001":["A.8.16"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-007","frameworkRefs":{"ISO27001":["A.8.16"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.CM-01","DE.CM-06"],"SOC2":["CC7.2"]}}