# SPM-010: Define default treatment for newly discovered AI services


- Area: AI Security Posture Management

- Verification: Live test
- OWASP adoption tier: AT0, AT1
- Formerly: POL-004
- URL: /r/SPM-010

**Acceptance criteria:** Apply a documented default rule until the service is assessed as sanctioned, restricted or prohibited.

**Why it matters:** New tools arrive faster than they can be assessed, so the default decides what happens in the meantime.

**How to verify:** A tool first used during the pilot receives the documented default treatment.

**OWASP adoption context:** Default treatment matters wherever employees can encounter a new AI service in the listed settings, before a full approval decision is available.

**Mappings:**
- NIST CSF 2.0: GV.PO-01; SOC 2: CC5.3, CC6.7; ISO 27001: Cl. 8.1, A.5.10, A.8.3 — Applying a documented default while a new service awaits assessment puts interim acceptable-use policy into operation. The default contributes to information-access and transfer restrictions only when its selected action actually restricts them; an applied permissive default is still a policy decision.
ISO/IEC 27001: The chosen default must be approved and fit the organization’s risk treatment.
- NIST AI RMF: MANAGE 1.1 — The interim rule records whether and under what conditions use may proceed before the service assessment is complete. It contributes to the proceed-or-do-not-proceed decision without replacing an assessment against the intended purpose and objectives.
- ISO 42001: A.9.2 — A documented default for an unclassified AI service provides an interim responsible-use rule. The chosen default must be approved and fit the organization’s risk treatment; approval status is not the AI system’s intended function.