{"id":"SPM-010","section":"AI Security Posture Management","requirement":"Define default treatment for newly discovered AI services","acceptance":"Apply a documented default rule until the service is assessed as sanctioned, restricted or prohibited.","tier":"AT0, AT1","whyItMatters":"New tools arrive faster than they can be assessed, so the default decides what happens in the meantime.","verificationMethod":"LT","verificationTest":"A tool first used during the pilot receives the documented default treatment.","formerly":"POL-004","alsoIn":[],"sort":9,"adoptionContext":"Default treatment matters wherever employees can encounter a new AI service in the listed settings, before a full approval decision is available.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Applying a documented default while a new service awaits assessment puts interim acceptable-use policy into operation. The default contributes to information-access and transfer restrictions only when its selected action actually restricts them; an applied permissive default is still a policy decision.\nISO/IEC 27001: The chosen default must be approved and fit the organization’s risk treatment.","kind":"framework","references":{"csf":["GV.PO-01"],"soc2":["CC5.3","CC6.7"],"iso27001":["Cl. 8.1","A.5.10","A.8.3"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"The interim rule records whether and under what conditions use may proceed before the service assessment is complete. It contributes to the proceed-or-do-not-proceed decision without replacing an assessment against the intended purpose and objectives.","kind":"framework","references":{"rmf":["MANAGE 1.1"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"A documented default for an unclassified AI service provides an interim responsible-use rule. The chosen default must be approved and fit the organization’s risk treatment; approval status is not the AI system’s intended function.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-010","frameworkRefs":{"ISO27001":["Cl. 8.1","A.5.10","A.8.3"],"ISO42001":["A.9.2"],"NIST-CSF":["GV.PO-01"],"NIST-AI-RMF":["MANAGE 1.1"],"SOC2":["CC5.3","CC6.7"]}}