Every AICM control ID with a one-line topic in our own words and how AutoGovern's anchor controls (NIST AI RMF, ISO/IEC 42001 Annex A, EU AI Act) cover it. Read the official standard for the requirement text.
247 IDs: 17 full mapping · 75 partial · 155 not covered by our anchors · 18 disputed between our analysts.
AICM 1.1 (1.1.1 patch, same 247 IDs). AICM 1.1.0 was released on 22 June 2026; the 1.1.1 patch (13 July 2026) keeps the same 247 control IDs. Cite as AICM 1.1.1 <ID>. Researched on 2026-10-16.
Signed in? See which of these your registered controls already meet under Account → Workspace → Standards readiness.
Control and requirement IDs belong to the Cloud Security Alliance (AICM) and the Artificial Intelligence Underwriting Company (AIUC-1). Descriptions and mappings are AutoGovern's own; read the official standard for the requirement text.
Official pages: CSA AI Controls Matrix (AICM) v1.1 · AIUC-1 · the AIUC-1 standard
Two analysts mapped every item independently to the anchor controls; on disagreement the lower strength and the union of anchor controls were kept, and the item is marked disputed. This is AutoGovern's analysis, not an official CSA or AIUC crosswalk. "Not covered" means our AI-governance anchor controls do not address the item (most cloud-infrastructure controls). It does not mean an organization fails it.
Anchors require periodic review and independent assessors, but no standing audit policy or procedures.
Independent assessment and conformity checks exist; no annual, standards-based audit cadence across the organisation.
Risk tiering and review cadence inform assessments; anchors do not define a risk-based audit plan.
Legal requirements are tracked and conformity assessed for AI; broader contractual and statutory audit scope missing.
Assessments and reviews occur, but no end-to-end audit management lifecycle is required.
Risk responses and continual improvement exist; no corrective-action plan specifically tied to audit findings.
Generic application-security policy; anchors only require AI system cybersecurity outcomes.
Application security baselines are general infosec; not in our AI anchors.
Application security metrics are general infosec; anchor metrics target AI risks.
Responsible design lifecycle and cybersecurity duty overlap; a formal secure SDLC is not required.
Verification, validation and go/no-go criteria cover AI releases; security acceptance testing of all software is broader.
A deployment plan and pre-deployment requirements exist; standardised or automated secure release is not addressed.
Application vulnerability remediation is general infosec; not in our anchors.
API security measures are general infosec; not in our anchors.
Adversarial resilience is required, but runtime filtering or blocking of inputs is not specified.
Safety and security evaluation touch outputs; no requirement to validate or block outputs at runtime.
Anchors narrow intended scope of use; they do not define technical security perimeters for agents.
Source-code management and review practices are software engineering hygiene outside our AI anchors.
No anchor requires isolated execution environments for AI tools or plugins.
Protection of generative AI caches is not addressed by any anchor control.
Prompt-injection resilience falls under adversarial robustness; instruction and data separation is not specified.
No anchor establishes a business continuity or operational resilience policy.
Business impact analysis for continuity planning is outside the AI anchors.
Recovery procedures, third-party contingency and fail-safe robustness overlap; organisation-wide continuity strategy is broader.
No anchor requires a documented business continuity plan.
Gathering continuity documentation is not covered by the AI anchors.
No anchor requires rehearsing continuity or resilience plans.
Business continuity and disaster recovery are outside our AI governance anchors.
Backups and restore testing are infrastructure controls absent from our anchors.
Disaster recovery planning is outside the AI anchors.
Disaster plan exercises are not covered by any anchor.
Physical equipment redundancy is a facility control outside our anchors.
Anchors have no change-management policy for organisational assets; change appears only incidentally in monitoring.
Validation and deployment criteria plus QMS design control overlap with a change test gate; baselines missing.
No anchor defines a procedure for managing risk of changes to assets.
Authorising asset additions and removals is IT change control not in our anchors.
Contractual limits on tenant-impacting changes are cloud-service terms outside our anchors.
Configuration baselines are not addressed by the AI anchors.
Configuration drift detection is infrastructure control, not covered; model drift is a different concept.
No anchor covers emergency or exception change handling.
Rollback to a known good state is not required; deactivation controls serve a different purpose.
Cryptography and key management policy is outside the AI anchors.
Cryptographic roles are not addressed by any anchor.
Encryption of data at rest, in transit or in use is not specified by anchors.
Cipher selection is a cryptographic control outside our anchors.
Cryptographic change management is not covered.
Cost-benefit analysis of cryptographic changes is not covered.
No anchor requires an encryption risk programme.
Customer-managed keys are a cloud service capability outside our anchors.
Auditing cryptographic systems is not addressed.
Key generation practices are outside the AI anchors.
Single-purpose key management is not covered.
Key rotation is not covered.
Key revocation is not covered.
Key destruction is not covered.
Pre-activation key states are not covered.
Key suspension handling is not covered.
Key deactivation on expiry is not covered.
Archived key storage is not covered.
Compromised key handling is not covered.
Key recovery risk balancing is not covered.
Key inventory tracking is not covered.
Physical and environmental security policy is outside the AI anchors.
Off-site equipment disposal is a physical control not in our anchors.
Authorising off-site transfer of equipment or data is not covered.
Secure work area rules are physical controls outside our anchors.
Physical media transport is not covered.
AI systems are inventoried and tiered by risk; classifying all physical and logical assets is broader.
AI system and resource inventories exist; tracking every asset across provider sites is broader.
Physical security perimeters are outside our anchors.
Device-identity authentication is a network control not in our anchors.
Secure-area physical access is not covered.
Site surveillance is not covered.
Training facility staff for physical incidents is not covered.
Cabling protection is not covered.
Environmental monitoring of facilities is not covered.
Utility security is not covered.
Siting equipment away from hazards is not covered.
Datacenter security metrics are not covered.
Datacenter operational continuity is not covered.
AI development data management covers privacy and security; whole-lifecycle policy for all data is broader.
Forensically secure wiping of storage is not addressed by anchors.
AI data resources are documented; a register focused on sensitive and personal data is narrower and different.
A data classification scheme by sensitivity is not required by our anchors.
Data sources, provenance and compute location are documented; full data-flow mapping with review is more.
AI roles are defined; named owners for personal and sensitive data are not required.
Responsible design and cybersecurity duties overlap; organisation-wide security-by-design principle is broader.
Privacy is considered in AI data management; privacy-by-default settings are not required.
Privacy risk and impact assessments exist; a formal data protection impact assessment is narrower.
Protection of personal data in transfer is not covered by anchors.
Data subject access, correction and erasure rights are not in our anchors.
Purpose limitation for personal data is not stated in our anchors.
Third-party data risk and responsibilities are covered; personal-data sub-processing controls are narrower.
Advance disclosure of sub-processors to data owners is not required by anchors.
Authorisation before using production data in test is not covered.
Anchors cover log retention only, not general data retention and deletion schedules.
Privacy and security of AI development data overlap; lifecycle protection of all sensitive data is broader.
Handling law-enforcement disclosure requests is not covered.
Compute resource locations are documented; data storage and backup locations are not explicit.
Tracing data provenance is covered; making sources available per legal requirements is not.
Poisoning is explicitly in scope of security evaluation and required cybersecurity defences.
Privacy of training data is assessed; use of privacy-enhancing techniques is not required.
Data quality, provenance and preparation are covered; dataset versioning and change locks are not.
Data governance requires relevance and suitability of training data for intended purpose.
AI policy with leadership accountability exists; a broader information governance programme is not required.
Documented, leadership-owned AI risk process with treatment and acceptance; ISO risk process is clause-level, not Annex A.
AI policy is reviewed periodically; review of all organisational policies is broader.
No anchor defines an approved process for policy exceptions.
Anchors evaluate AI security but do not establish an organisation-wide security programme.
Defined and allocated governance roles are required directly by all three anchors.
AI legal requirements are documented; full catalogue of all standards and contracts is broader.
Engagement with industry or specialist groups is not required by anchors.
Intended use and instructions bound customer use; enforcing an acceptable-use policy with ongoing review is more.
Lifecycle impact assessment process on individuals and society is a direct anchor requirement.
Bias and fairness evaluation of systems and data is explicitly required.
Responsible objectives and diverse decision-making exist; a standing ethics review body is not required.
Explainability is evaluated and transparency required; setting a target explainability level is not explicit.
Explainability must be evaluated, documented and communicated with limitations.
Human oversight and ability to override or stop the system is a core anchor requirement.
Pre-employment screening is an HR control outside our anchors.
General acceptable use of organisational technology is not covered; AI use is handled separately.
Clean desk rules are not covered.
Remote working protection is not covered.
Asset return on leaving is not covered.
Employment change procedures are not covered.
Signed employee agreements before access are not covered.
Security terms in employment contracts are not covered.
Staff information-security roles are not addressed; AI roles anchors are a different scope.
Confidentiality agreements are not covered.
General security awareness training is not covered; anchor training is AI risk specific.
Training for staff handling personal data is not covered.
Training supports duties consistent with policy; general compliance-awareness obligations are broader.
Role-based AI competence and training are required across anchors.
AI policy and responsible-use processes exist; explicit staff acceptable-use rules for AI tools are not.
Infrastructure and virtualisation security policy is outside our anchors.
Capacity planning is an operations control not covered by anchors.
Network traffic restriction and encryption are not covered.
OS and hypervisor hardening is not covered.
Separating production and test environments is not covered.
Tenant segmentation in shared infrastructure is not covered.
Encrypted migration channels are not covered.
Identifying high-risk network environments is not covered.
Network defence in depth is not covered.
Identity and access policy is outside our anchors.
Credential policy is not covered.
Identity inventory is not covered.
Separation of duties for system access is not covered.
Least-privilege access is not covered.
Access provisioning process is not covered.
Timely access removal is not covered.
Access recertification is not covered.
Privileged role segregation is not covered.
Time-limited privileged access is not covered.
Customer approval of privileged access is not covered.
Unique attributable identities are not covered.
Strong authentication is not covered.
Secure handling of authentication secrets is not covered.
Authorisation checks on requests are not covered.
Need-to-know access to knowledge and data is not required by anchors.
Defined oversight roles may override outputs; a dedicated authorised role for editing outputs is narrower.
Use is bounded to intended scope; least-privilege restriction of agent tools is not specified.
Interoperability and portability policy is outside our anchors.
Customer data export interfaces are not covered.
Secure import and export protocols are not covered.
Post-termination data access contract terms are not covered.
AI event logging and production monitoring required; a general logging and monitoring policy is broader.
Log retention is required; securing logs against compromise is not.
Production monitoring and attack detection overlap; security event alerting to owners is not explicit.
Restricting and recording access to audit logs is not covered.
Log correlation for suspicious activity is a security operations control not in anchors.
Clock synchronisation is not covered.
Anchors set logging for traceability; a reviewed logging scope tied to threats is more.
Masking sensitive data in logs is not covered by anchors.
Event records must support traceability; security-specific record content is not specified.
Tamper protection for audit records is not required by anchors.
Cryptographic operations reporting is not covered.
Key lifecycle event logging is not covered.
Physical access logging is not covered.
Alerting on monitoring-system failure is not covered.
Event logging is required; capturing all model input content is narrower and more demanding.
Event logging is required; capturing all model output content is narrower and more demanding.
Poisoning defences and data security overlap; securing the full training pipeline is broader.
Pre-trained models are monitored and security evaluated; scanning model files at handover is not required.
Maintained technical documentation of the model and system is a direct anchor requirement.
Annex IV-style technical file defines baseline documentation content.
Documentation must be kept current; a separate validation step against the live model is not required.
Adversarial threats including poisoning, evasion and extraction must be evaluated per system.
Technical measures against AI-specific attacks are required, beyond evaluation alone.
Cryptographic hash checks of model checkpoints are not required by anchors.
Model signing and signature verification are not required by anchors.
Production monitoring including drift and performance decline is required.
Error costs, fail-safes and resilience overlap; serving infrastructure failure analysis is not covered.
Third-party and pre-trained model risks must be assessed and monitored over time.
Safe model serialisation formats are not addressed by anchors.
AI incident handling exists; security incident, e-discovery and forensics policy is different scope.
Timely AI incident response and reporting exist; security incident policy is a different focus.
Incident communication plan exists; security response plan covering supply-chain parties is broader.
No anchor requires exercising incident response plans.
Security incident metrics are not required by anchors.
Triage of security events is not addressed by anchors.
Severity-tiered AI incident reporting and recovery overlap; security incident categories are not defined.
Reporting to authorities and affected parties exists for serious AI incidents, not security breaches generally.
Incident information sharing and learning exist; a secure incident record store is not required.
Authority communication is part of QMS and reporting; maintained law-enforcement contacts are not.
Policies addressing third-party and supply-chain AI risk are directly required.
Responsibility allocation across the value chain overlaps; a shared security responsibility policy is narrower.
Responsibilities are allocated with suppliers; applying a security responsibility model chain-wide is more specific.
Customers receive instructions and responsibilities; dedicated shared-responsibility guidance is narrower.
Responsibility allocation exists; delineating ownership of every AICM control is framework-specific.
No anchor requires reviewing shared-responsibility documentation.
Operating and assessing owned shared-model controls is not a distinct anchor duty.
AI systems and third-party components are inventoried; a register of all supplier relationships is broader.
Resources and third-party components are documented; a formal service bill of materials is not required.
Third-party AI risks must be regularly monitored with controls applied.
Written supplier agreements on information and access exist; the full list of contract terms is not.
Periodic review of supplier agreements is not required by anchors.
Control effectiveness is assessed and suppliers aligned; formal annual conformance assessments are more.
Suppliers must align with the responsible-AI approach; explicit security and privacy obligations are narrower.
Supplier risk is monitored; reviewing suppliers’ IT governance policies is a narrower task.
Third-party risk controls are assessed; a risk-based security assessment of suppliers is more specific.
Vulnerability management policy is general infosec outside our anchors.
Adversarial manipulation resilience overlaps malicious instructions; malware protection policy is not covered.
Monthly vulnerability scanning of managed assets is not covered by anchors.
Foreseeable risks and adversarial threats are analysed; formal threat modelling of infrastructure is broader.
Updating detection signatures and indicators is not covered.
Third-party software risk is monitored; tracking library updates for vulnerabilities is more specific.
Independent assessors and security evaluation overlap; periodic third-party penetration testing is not required.
Planned and emergency remediation timelines for vulnerabilities are not covered.
Vulnerability prioritisation with a recognised scoring method is not covered.
Risks are prioritised and treated; use of a recognised threat framework is not required.
Vulnerability tracking and stakeholder reporting is not covered.
Vulnerability management metrics are not covered.
Risk mitigations must be applied and tested; continuously re-evaluating runtime guardrails is more specific.
Endpoint device policy is outside our anchors.
Approved application lists for endpoints are not covered.
Device compatibility validation is not covered.
Endpoint inventory is not covered.
Endpoint policy enforcement is not covered.
Screen lock is not covered.
Endpoint OS change management is not covered.
Device storage encryption is not covered.
Endpoint anti-malware is not covered.
Host firewalls are not covered.
Endpoint data loss prevention is not covered.
Remote device location is not covered.
Remote wipe is not covered.
Third-party endpoint security is not covered.
Control and requirement IDs belong to the Cloud Security Alliance (AICM) and the Artificial Intelligence Underwriting Company (AIUC-1). Descriptions and mappings are AutoGovern's own; read the official standard for the requirement text.
Official pages: CSA AI Controls Matrix (AICM) v1.1 · AIUC-1 · the AIUC-1 standard
Two analysts mapped every item independently to the anchor controls; on disagreement the lower strength and the union of anchor controls were kept, and the item is marked disputed. This is AutoGovern's analysis, not an official CSA or AIUC crosswalk. "Not covered" means our AI-governance anchor controls do not address the item (most cloud-infrastructure controls). It does not mean an organization fails it.