CSA AI Controls Matrix v1.0.3 — SP 800-53 Coverage
How well do NIST SP 800-53 Rev 5 controls address each CSA AICM v1 requirement? This analysis maps from framework clauses back to SP 800-53, with expert coverage weightings and gap identification.
Clause-by-Clause Analysis
Sorted by clauseA&A-01 Audit and Assurance Policy and Procedures
Rationale
CA-01 establishes assessment policy and procedures; CA-02 defines control assessments; AU-01 covers audit and accountability policy. Together these address the policy and procedural foundations for audit and assurance.
Gaps
AICM requires AI-specific audit policies covering model governance, algorithmic accountability, and AI system lifecycle audit trails that NIST does not explicitly address.
A&A-02 Independent Assessments
Rationale
CA-02 requires independent assessments of security controls; CA-07 provides continuous monitoring; CA-08 covers penetration testing.
Gaps
AICM emphasizes independent assessment of AI systems including model validation, bias auditing, and algorithmic impact assessments not covered by NIST.
A&A-03 Risk Based Planning Assessment
Rationale
RA-03 covers risk assessment; CA-02 addresses control assessment planning; RA-07 covers risk response.
Gaps
AICM requires risk-based assessment planning that accounts for AI-specific risks (model drift, adversarial attacks, training data bias) beyond traditional IT risk.
A&A-04 Requirements Compliance
Rationale
CA-02 assesses control compliance; CA-05 produces plans of action and milestones; CA-09 covers internal system connections.
Gaps
AICM focuses on demonstrating compliance with AI-specific regulations (EU AI Act, NIST AI RMF) and cloud-specific evidence requirements.
A&A-05 Audit Management Process
Rationale
CA-02 manages security assessments; CA-05 tracks remediation via POA&M; AU-06 covers audit review, analysis, and reporting.
Gaps
AICM requires structured audit management including AI model audit trails, training data provenance audits, and algorithmic decision logging.
A&A-06 Remediation
AIS-01 Application and Interface Security Policy and Procedures
Rationale
SA-01 establishes system acquisition policy; SA-08 covers security engineering principles; SI-01 provides system and information integrity policy.
Gaps
AICM extends to AI application security policies including ML pipeline security, model serving infrastructure, and AI API protection requirements.
AIS-02 Application Security Baseline Requirements
Rationale
SA-08 defines security engineering principles; SA-11 covers developer testing and evaluation; SA-15 addresses development process and standards.
Gaps
AICM baseline requirements extend to AI-specific secure development practices including adversarial robustness, model integrity verification, and ML framework security.
AIS-03 Application Security Metrics
Rationale
CA-07 provides continuous monitoring; PM-06 covers security metrics; SA-11 addresses developer security testing.
Gaps
AICM requires AI-specific application security metrics including model performance degradation monitoring, drift detection, and adversarial input detection.
AIS-04 Secure Application Development Lifecycle
Rationale
SA-03 covers system development lifecycle; SA-08 addresses security engineering; SA-11 covers developer testing; SA-15 covers development standards.
Gaps
AICM extends SDLC to MLOps lifecycle including model training, validation, deployment, and monitoring phases with AI-specific security gates.
AIS-05 Application Security Testing
Rationale
CA-08 covers penetration testing; RA-05 addresses vulnerability scanning; SA-11 covers developer security testing.
Gaps
AICM requires AI-specific security testing including adversarial robustness testing, model extraction attacks, and training data poisoning assessments.
AIS-06 Secure Application Deployment
Rationale
CM-02 provides baseline configurations; CM-03 covers configuration change control; SA-03 addresses system development lifecycle.
Gaps
AICM addresses automated secure deployment pipelines for ML models including model versioning, rollback capabilities, and deployment validation.
AIS-07 Application Vulnerability Remediation
Rationale
RA-05 covers vulnerability monitoring and scanning; SA-11 addresses developer security testing and evaluation.
Gaps
AICM requires AI-specific vulnerability assessment including model vulnerability scanning, dependency analysis for ML frameworks, and AI supply chain security.
AIS-08 Input Validation
Rationale
SA-08 covers security engineering principles; SC-07 provides boundary protection; AC-04 addresses information flow enforcement for API security.
Gaps
AICM AIS-08 specifically addresses AI API security including model inference endpoint protection, rate limiting for AI services, and input validation for model queries. NIST lacks AI API-specific controls.
AIS-09 Output Validation
Rationale
SA-11 covers developer testing; SI-07 addresses software integrity; CM-03 covers change control. These partially address AI model integrity.
Gaps
AICM requires AI model integrity verification including cryptographic model signing, tamper detection for model weights, and inference integrity validation.
AIS-10 API Security
Rationale
SA-08/SA-11 cover security engineering and testing; RA-05 covers vulnerability scanning. These provide a general framework but lack AI specificity.
Gaps
AICM addresses adversarial robustness requirements including adversarial input detection, model hardening against evasion attacks, and robustness testing methodologies.
AIS-11 Agents Security Boundaries
Rationale
SA-03 covers development lifecycle; SA-15 addresses development standards; CM-03 covers change control for ML pipeline security.
Gaps
AICM requires ML pipeline security controls including secure training infrastructure, feature store protection, and automated ML security gates.
AIS-12 Source Code Managemement
Rationale
SI-04 covers information system monitoring; CA-07 provides continuous monitoring; AU-06 covers audit review and analysis.
Gaps
AICM addresses AI-specific runtime monitoring including model behavior anomaly detection, inference drift monitoring, and automated model rollback triggers.
AIS-13 AI Sandboxing
Rationale
SA-11 covers developer testing; CA-08 addresses penetration testing; SI-07 covers software integrity verification.
Gaps
AICM requires AI red teaming including adversarial ML attacks, prompt injection testing, model extraction attempts, and AI-specific threat simulation.
AIS-14 AI Cache Protection
Rationale
SA-08 covers security engineering; SC-13 addresses cryptographic protection; SI-07 covers software integrity.
Gaps
AICM addresses model provenance and supply chain security including model origin verification, training data lineage, and third-party model validation.
AIS-15 Prompt Differentation
Rationale
SA-03/SA-08/SA-11 provide general software security lifecycle controls applicable to AI development.
Gaps
AICM requires responsible AI development practices including fairness testing, explainability requirements, and human oversight integration. NIST 800-53 does not address responsible AI.
BCR-01 Business Continuity Management Policy and Procedures
BCR-02 Risk Assessment and Impact Analysis
BCR-03 Business Continuity Strategy
Rationale
CP-02/CP-07/CP-08 address contingency planning, alternate processing sites, and telecommunications services.
Gaps
AICM extends to AI-specific redundancy including model replication, distributed inference capabilities, and training infrastructure resilience.
BCR-04 Business Continuity Planning
BCR-05 Documentation
Rationale
PL-02 covers security concept of operations; PL-07 covers security concept consistency; CP-02 addresses contingency planning.
Gaps
AICM documentation requirements extend to AI model documentation, training data documentation, and AI system architecture records.
BCR-06 Business Continuity Exercises
BCR-07 Communication
BCR-08 Backup
BCR-09 Disaster Response Plan
BCR-10 Response Plan Exercise
BCR-11 Equipment Redundancy
CCC-01 Change Management Policy and Procedures
CCC-02 Quality Testing
CCC-03 Change Management Technology
CCC-04 Change Authorization
CCC-05 Change Agreements
CCC-06 Change Management Baseline
CCC-07 Detection of Baseline Deviation
CCC-08 Exception Management
CCC-09 Change Restoration
CEK-01 Encryption and Key Management Policy and Procedures
CEK-02 CEK Roles and Responsibilities
CEK-03 Data Encryption
CEK-04 Encryption Algorithm 85%
Rationale
SC-13 directly addresses the use of approved cryptographic algorithms and mechanisms.
Gaps
AICM may require emerging cryptographic standards for AI-specific use cases like homomorphic encryption for privacy-preserving ML.
Mapped Controls
CEK-05 Encryption Change Management
CEK-06 Encryption Change Cost Benefit Analysis
CEK-07 Encryption Risk Management
CEK-08 Customer Key Management Capability 85%
Rationale
SC-12 directly addresses cryptographic key establishment and management.
Gaps
AICM extends key management to AI-specific scenarios including federated learning key distribution.
Mapped Controls
CEK-09 Encryption and Key Management Audit
CEK-10 Key Generation
CEK-11 Key Purpose 85%
Rationale
SC-12 addresses key establishment and management including key distribution.
Gaps
AICM extends to secure key distribution for distributed AI systems and federated learning.
Mapped Controls
CEK-12 Key Rotation 82%
Rationale
SC-12 addresses key management including key access and authorization.
Gaps
AICM extends key access controls to AI pipeline components and model serving infrastructure.
Mapped Controls
CEK-13 Key Revocation
CEK-14 Key Destruction
CEK-15 Key Activation 82%
Rationale
SC-12 comprehensively covers key lifecycle management including activation and suspension.
Gaps
AICM extends key activation/deactivation to AI model lifecycle events.
Mapped Controls
CEK-16 Key Suspension 82%
Rationale
SC-12 covers key management including key recovery mechanisms.
Gaps
AICM extends key recovery to AI-specific disaster recovery scenarios.
Mapped Controls
CEK-17 Key Deactivation 80%
Rationale
SC-12 covers key management including key escrow where applicable.
Gaps
AICM addresses AI-specific key escrow requirements for regulated AI systems.
Mapped Controls
CEK-18 Key Archival
CEK-19 Key Compromise
CEK-20 Key Recovery
CEK-21 Key Inventory Management
DCS-01 Off-Site Equipment Disposal Policy and Procedures
DCS-02 Off-Site Transfer Authorization Policy and Procedures
DCS-03 Secure Area Policy and Procedures
DCS-04 Secure Media Transportation Policy and Procedures
DCS-05 Assets Classification
DCS-06 Assets Cataloguing and Tracking
DCS-07 Controlled Physical Access Points
DCS-08 Equipment Identification
DCS-09 Secure Area Authorization
DCS-10 Surveillance System
DCS-11 Adverse Event Response Training
DCS-12 Cabling Security
DCS-13 Environmental Systems
DCS-14 Secure Utilities
DCS-15 Equipment Location
DSP-01 Security and Privacy Policy and Procedures
Rationale
AC-01 establishes access control policy; PL-01 covers planning policy; PT-01 addresses personally identifiable information processing policy.
Gaps
AICM extends to AI-specific data security policies including training data governance, model data handling, and AI output data protection.
DSP-02 Secure Disposal
DSP-03 Data Inventory
DSP-04 Data Classification
DSP-05 Data Flow Documentation
DSP-06 Data Ownership and Stewardship
DSP-07 Data Protection by Design and Default
DSP-08 Data Privacy by Design and Default
DSP-09 Data Protection Impact Assessment
DSP-10 Sensitive Data Transfer
Rationale
AC-04 enforces information flow; SC-08 provides transmission confidentiality; SC-13 covers cryptographic protection.
Gaps
AICM extends data transfer controls to AI-specific transfers including model weight distribution and federated learning communications.
DSP-11 Personal Data Access, Reversal, Rectification and Deletion
DSP-12 Limitation of Purpose in Personal Data Processing
DSP-13 Personal Data Sub-processing
DSP-14 Disclosure of Data Sub-processors
DSP-15 Limitation of Production Data Use
DSP-16 Data Retention and Deletion
DSP-17 Sensitive Data Protection
DSP-18 Disclosure Notification
DSP-19 Data Location
DSP-20 Data Provenance and Transparency
Rationale
PT-01/PT-03 cover PII processing and minimization; SA-08 covers security engineering principles.
Gaps
AICM addresses training data governance including data provenance, consent for training use, data quality requirements, and bias assessment in training datasets. NIST lacks AI training data-specific controls.
DSP-21 Data Poisoning Prevention & Detection
DSP-22 Privacy Enhancing Technologies
Rationale
AC-04 covers information flow; PT-01 addresses PII processing; SC-13 covers cryptographic protection for privacy-preserving computation.
Gaps
AICM addresses privacy-preserving machine learning techniques including differential privacy, federated learning governance, and secure multi-party computation for AI. NIST does not address these AI-specific privacy techniques.
DSP-23 Data Integrity Check
DSP-24 Data Differentiation and Relevance
Rationale
SI-12 covers information management; PT-03 addresses data minimization; AU-02 covers audit events.
Gaps
AICM addresses model data lineage requirements including end-to-end traceability from training data through model artifacts to inference outputs. NIST does not address AI data lineage.
GRC-01 Governance Program Policy and Procedures
GRC-02 Risk Management Program
GRC-03 Organizational Policy Reviews
GRC-04 Policy Exception Process
GRC-05 Information Security Program
GRC-06 Governance Responsibility Model
GRC-07 Information System Regulatory Mapping
GRC-08 Special Interest Groups
GRC-09 Acceptable Use of the AI Service
Rationale
PM-01/PM-09 cover security program and risk strategy; RA-01 establishes risk assessment policy.
Gaps
AICM addresses AI governance frameworks including responsible AI principles, AI ethics policies, and organizational AI strategy alignment. NIST 800-53 does not address AI governance specifically.
GRC-10 AI Impact Assessment
GRC-11 Bias and Fairness Assessment
GRC-12 Ethics Committee
GRC-13 Explainability Requirement
GRC-14 Explainability Evaluation
GRC-15 Human supervision
HRS-01 Background Screening Policy and Procedures
HRS-02 Acceptable Use of Technology Policy and Procedures
HRS-03 Clean Desk Policy and Procedures
HRS-04 Remote and Home Working Policy and Procedures
HRS-05 Asset returns 82%
Rationale
PS-04 covers personnel termination procedures.
Gaps
AICM extends termination to AI-specific access revocation including model repositories, training infrastructure, and AI service accounts.
Mapped Controls
HRS-06 Employment Termination
HRS-07 Employment Agreement Process
HRS-08 Employment Agreement Content
HRS-09 Personnel Roles and Responsibilities
HRS-10 Non-Disclosure Agreements
HRS-11 Security Awareness Training
HRS-12 Personal and Sensitive Data Awareness and Training
HRS-13 Compliance User Responsibility
HRS-14 AI Competency Training
Rationale
AT-02/AT-03 cover security awareness and role-based training; PM-02 addresses roles.
Gaps
AICM requires AI-specific competency development including ML security skills, adversarial ML knowledge, and AI safety training programs. NIST does not address AI competency frameworks.
HRS-15 AI Acceptable Use
I&S-01 Infrastructure and Virtualization Security Policy and Procedures
Rationale
SA-01 covers acquisition policy; SC-01 covers system protection policy; CM-01 addresses configuration management.
Gaps
AICM extends infrastructure security to AI-specific infrastructure including GPU clusters, ML platforms, and model serving infrastructure.
I&S-02 Capacity and Resource Planning
I&S-03 Network Security
I&S-04 OS Hardening and Base Controls
I&S-05 Production and Non-Production Environments
I&S-06 Segmentation and Segregation
I&S-07 Migration to Hosted Environments
I&S-08 Network Architecture Documentation
I&S-09 Network Defense
IAM-01 Identity and Access Management Policy and Procedures
IAM-02 Strong Password Policy and Procedures
IAM-03 Identity Inventory
IAM-04 Separation of Duties
IAM-05 Least Privilege
IAM-06 User Access Provisioning
IAM-07 User Access Changes and Revocation
IAM-08 User Access Review
IAM-09 Segregation of Privileged Access Roles
IAM-10 Management of Privileged Access Roles
IAM-11 Customers' Approval for Agreed Privileged Access Roles
IAM-12 Safeguard Logs Integrity
IAM-13 Uniquely Identifiable Users
IAM-14 Strong Authentication
IAM-15 Passwords and Secrets Management
IAM-16 Authorization Mechanisms
IAM-17 Knowledge Access Control - Need to Know
Rationale
AC-02 covers account management; IA-02 covers authentication; SC-07 provides boundary protection for AI API access.
Gaps
AICM addresses AI API authentication and authorization including model inference API security, rate limiting, and API key management for AI services.
IAM-18 Output Modification and Special Authorization
Rationale
AC-02 covers account management; AC-06 addresses least privilege; IA-03 covers device identification.
Gaps
AICM addresses machine-to-machine identity for AI systems including model-to-model authentication, pipeline service identities, and automated AI agent identity management.
IAM-19 Agent Access Restriction
Rationale
AC-05 covers separation of duties; AC-06 addresses least privilege; CM-05 restricts changes.
Gaps
AICM requires role-based access control specific to AI lifecycle including separate roles for data scientists, ML engineers, model validators, and AI operations staff.
IPY-01 Interoperability and Portability Policy and Procedures
IPY-02 Application Interface Availability
IPY-03 Secure Interoperability and Portability Management
IPY-04 Data Portability Contractual Obligations 68%
Rationale
SA-04 covers acquisition process including portability and interoperability requirements.
Gaps
AICM extends portability to AI-specific scenarios including multi-cloud ML deployment and vendor-neutral AI infrastructure.
Mapped Controls
LOG-01 Logging and Monitoring Policy and Procedures
LOG-02 Audit Logs Protection
LOG-03 Security Monitoring and Alerting
LOG-04 Audit Logs Access and Accountability
LOG-05 Audit Logs Monitoring and Response
LOG-06 Clock Synchronization 88%
Rationale
AU-08 directly addresses time stamps and clock synchronization for audit records.
Gaps
AICM extends time synchronization to distributed AI systems including training cluster clocks and inference endpoint timestamps.
Mapped Controls
LOG-07 Logging Scope
LOG-08 Log Records
LOG-09 Log Protection
LOG-10 Encryption Monitoring and Reporting
LOG-11 Transaction/Activity Logging
LOG-12 Access Control Logs
LOG-13 Failures and Anomalies Reporting
LOG-14 Input Monitoring
Rationale
AU-02 covers audit events; AU-06 addresses audit review; SI-04 covers system monitoring.
Gaps
AICM requires AI decision logging including model inference decision trails, feature importance logs, and explanation records for automated decisions. NIST does not address AI decision transparency.
LOG-15 Output Monitoring
MDS-01 Training Pipeline Security
Rationale
SA-08 covers security engineering principles; CM-01 establishes configuration management; PL-01 covers planning. These provide general framework for model security governance.
Gaps
AICM MDS-01 establishes comprehensive model security policy and procedures including model lifecycle governance, model risk management, and model security standards. NIST 800-53 has no equivalent model security controls.
MDS-02 Model Artifact Scanning
Rationale
CM-08 covers component inventory; SA-03 addresses development lifecycle. These partially support model inventory.
Gaps
AICM requires model inventory and registry including model cards, versioning, lineage tracking, and model deprecation management. NIST has no model registry equivalent.
MDS-03 Model Documentation
Rationale
SA-11 covers developer testing; CA-08 addresses penetration testing; RA-05 covers vulnerability scanning. These provide a testing framework adaptable to models.
Gaps
AICM requires model validation and testing including accuracy validation, bias testing, robustness testing, and adversarial evaluation. NIST testing controls are not designed for ML model validation.
MDS-04 Model Documentation Requirements
MDS-05 Model Documentation Validation
Rationale
SI-04/CA-07 cover monitoring; AU-06 addresses audit review.
Gaps
AICM requires model monitoring including performance drift detection, data drift monitoring, concept drift alerts, and model behavior anomaly detection. NIST monitoring controls are infrastructure-focused.
MDS-06 Adversarial Attack Analysis
MDS-07 Robustness against Adversarial Attack / Model Hardening
MDS-08 Model Integrity Checks
Rationale
SA-11/RA-05 cover testing and vulnerability assessment; SI-07 covers integrity.
Gaps
AICM requires adversarial robustness including adversarial attack testing, evasion resistance, and model hardening against adversarial inputs. NIST has no adversarial ML controls.
MDS-09 Model Signing/Ownership Verification
Rationale
PT-01/PT-03 cover PII processing and minimization; SA-08 covers security engineering.
Gaps
AICM requires model privacy including membership inference protection, model inversion defense, differential privacy integration, and training data extraction prevention.
MDS-10 Model Continuous Monitoring
MDS-11 Model Failure
Rationale
CM-03/CM-09 cover change control and configuration plans; SA-03 addresses development lifecycle.
Gaps
AICM requires model versioning and lifecycle management including model retirement, version compatibility, and model lineage tracking across training iterations.
MDS-12 Open Model Risk Assessment
MDS-13 Secure Model Format
Rationale
RA-03/PM-09 cover risk assessment and strategy; SI-01 addresses integrity policy.
Gaps
AICM requires model risk quantification including model risk scoring, risk-based model tiering, and model failure impact assessment. NIST risk assessment is not designed for ML model risk.
SEF-01 Security Incident Management Policy and Procedures
SEF-02 Service Management Policy and Procedures
SEF-03 Incident Response Plans
SEF-04 Incident Response Testing 82%
Rationale
IR-03 directly addresses incident response testing.
Gaps
AICM extends testing to AI-specific incident scenarios including model failure drills and adversarial response exercises.
Mapped Controls
SEF-05 Incident Response Metrics
SEF-06 Event Triage Processes
SEF-07 Security Breach Notification
SEF-08 Points of Contact Maintenance
SEF-09 Incident Response
Rationale
IR-01/IR-04/IR-06 cover incident response policy, handling, and reporting.
Gaps
AICM requires AI-specific incident response procedures including adversarial attack playbooks, model compromise response, training data breach protocols, and AI system failure escalation paths.
STA-01 Supply Chain Risk Management Policies and Procedures
STA-02 SSRM Policy and Procedures
STA-03 SSRM Supply Chain
STA-04 SSRM Guidance
STA-05 SSRM Control Ownership
STA-06 SSRM Documentation Review
STA-07 SSRM Control Implementation
STA-08 Supply Chain Inventory
STA-09 Supply Chain Risk Management
STA-10 Primary Service and Contractual Agreement
STA-11 Supply Chain Agreement Review
STA-12 Supply Chain Compliance Assessment
STA-13 Supply Chain Service Agreement Compliance
STA-14 Supply Chain Governance Review
STA-15 Supply Chain Data Security Assessment
STA-16 Service Bill of Material (BOM)
TVM-01 Threat and Vulnerability Management Policy and Procedures
TVM-02 Malware and Malicious Instructions Protection Policy and Procedures
TVM-03 Vulnerability Identification
TVM-04 Detection Updates
TVM-05 External Library Vulnerabilities
TVM-06 Penetration Testing
TVM-07 Vulnerability Remediation Schedule
TVM-08 Vulnerability Prioritization
TVM-09 Vulnerability Management Reporting
TVM-10 Vulnerability Management Metrics
TVM-11 Guardrails
TVM-12 Threat Analysis and Modelling
Rationale
CA-08 covers penetration testing; RA-05 covers vulnerability scanning; SA-11 covers developer testing.
Gaps
AICM addresses AI red teaming including systematic adversarial testing of AI systems, automated attack generation, and AI-specific penetration testing methodologies.
TVM-13 Threat Response
UEM-01 Endpoint Devices Policy and Procedures
UEM-02 Application and Service Approval
UEM-03 Compatibility
UEM-04 Endpoint Inventory 80%
Rationale
CM-08 directly addresses information system component inventory.
Gaps
AICM extends inventory to AI-specific endpoints including GPU workstations, edge AI devices, and AI development environments.
Mapped Controls
UEM-05 Endpoint Management
UEM-06 Automatic Lock Screen 85%
Rationale
AC-11 directly addresses session lock and screen lock functionality.
Gaps
AICM extends device lock to AI workstations with access to sensitive training data and models.
Mapped Controls
UEM-07 Operating Systems
UEM-08 Storage Encryption
UEM-09 Anti-Malware Detection and Prevention 82%
Rationale
SI-03 directly addresses malicious code protection including anti-malware.
Gaps
AICM extends anti-malware to AI-specific threats on endpoints including adversarial sample detection.
Mapped Controls
UEM-10 Software Firewall
UEM-11 Data Loss Prevention
UEM-12 Remote Locate 78%
Rationale
CM-08 covers component inventory for remote access devices.
Gaps
AICM extends remote device management to AI development devices used remotely.
Mapped Controls
UEM-13 Remote Wipe
UEM-14 Third-Party Endpoint Security Posture
Methodology and Disclaimer
This coverage analysis maps from CSA AICM v1 clauses/requirements back to NIST SP 800-53 Rev 5 controls, assessing how well the SP 800-53 control set addresses each framework requirement.
Coverage weighting represents an informed estimate based on control-objective alignment, not a definitive compliance determination. Weightings consider whether SP 800-53 controls address the intent of each framework requirement, even where terminology and structure differ.
This analysis should be validated by qualified assessors for use in compliance or audit activities. The authoritative source for any compliance determination is always the framework itself.