NIST, NSA and CISA publish incident readiness and response practices for rogue AI agents
NIST, the NSA and CISA released a report, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, on handling AI agents that behave in unexpected or harmful ways. The report uses the term super intelligence (SI) instead of AI, in line with presidential executive order 14434. It sets out ten key practices in five stages: prepare, detect, respond, recover and report. It also defines three terms: AI agents, AI control incident and AI control near-miss. SecurityWeek assesses that the document offers no new AI agent governance concepts but works as a clear, thorough checklist for security teams.
Detalhes técnicos
- Prepare: asset and risk inventories, defense-in-depth, least privilege, zero-trust controls, credential management and supply chain risk management.
- Detect: continuous monitoring for correct behavior, anomalous activity and indications of compromise.
- Respond: isolate affected systems, revoke credentials, rebuild compromised environments, determine the blast radius and run root-cause analysis that looks past the specific vulnerability exploited.
- Recover: test restoration procedures in advance and document recovery decisions and any accepted residual risk.
- Report: notify government where legally required (including reporting obligations to CISA and law enforcement), notify all affected parties, and share details publicly and early where appropriate.
- No stage or practice is weighted above the others; the five stages should be treated as a single target.
Remediação
- Adopt the ten practices as an incident readiness and response checklist for agentic systems.
- Test restoration procedures before an incident.
- Document recovery decisions and accepted residual risk.
- Establish legal and public reporting processes for AI control incidents and near-misses.
Linha do tempo
-
NIST, NSA and CISA publish incident readiness and response practices for rogue AI agents
ler a análise desta fonte ocultar
NIST, the NSA and CISA released a report, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, on handling AI agents that behave in unexpected or harmful ways. The report uses the term super intelligence (SI) instead of AI, in line with presidential executive order 14434. It sets out ten key practices in five stages: prepare, detect, respond, recover and report. It also defines three terms: AI agents, AI control incident and AI control near-miss. SecurityWeek assesses that the document offers no new AI agent governance concepts but works as a clear, thorough checklist for security teams.
Technical Details
- Prepare: asset and risk inventories, defense-in-depth, least privilege, zero-trust controls, credential management and supply chain risk management.
- Detect: continuous monitoring for correct behavior, anomalous activity and indications of compromise.
- Respond: isolate affected systems, revoke credentials, rebuild compromised environments, determine the blast radius and run root-cause analysis that looks past the specific vulnerability exploited.
- Recover: test restoration procedures in advance and document recovery decisions and any accepted residual risk.
- Report: notify government where legally required (including reporting obligations to CISA and law enforcement), notify all affected parties, and share details publicly and early where appropriate.
- No stage or practice is weighted above the others; the five stages should be treated as a single target.
Remediation
- Adopt the ten practices as an incident readiness and response checklist for agentic systems.
- Test restoration procedures before an incident.
- Document recovery decisions and accepted residual risk.
- Establish legal and public reporting processes for AI control incidents and near-misses.