India’s CERT-In issues AI Security Auditing guidelines targeting model poisoning, prompt injection, agentic AI threats - Industrial Cyber
India’s national cybersecurity agency issued guidelines for auditing the security of artificial intelligence systems, setting out a risk-based framework for AI that organizations in India develop, buy, deploy, or operate, as well as systems that process Indian data or serve Indian users. Under the framework, AI systems are sorted into four risk tiers – low, moderate, high, and critical, which determine depth, frequency, and independence of audits and level of human oversight required. The guidelines set out nine core audit domains covering the AI lifecycle, from governance and data quality to adversarial resilience, human oversight and third-party supply-chain assurance.
Prepared by a working group of the Indian Computer Emergency Response Team, or CERT-In, the AI Security Auditing Guidelines, version 1.0, is aimed at government bodies, public sector entities, critical infrastructure operators, regulated entities, private companies, AI developers and service providers, and auditors, including CERT-In empanelled auditing organizations. It also includes added requirements for generative, agentic and other advanced AI to address risks such as prompt injection, data and model poisoning, and excessive agency. Audit findings are classified as critical, high, moderate or low, and a five-level maturity model lets organizations gauge their AI governance capability.
Linha do tempo
-
India’s CERT-In issues AI Security Auditing guidelines targeting model poisoning, prompt injection, agentic AI threats - Industrial Cyber
ler a análise desta fonte ocultar
India’s national cybersecurity agency issued guidelines for auditing the security of artificial intelligence systems, setting out a risk-based framework for AI that organizations in India develop, buy, deploy, or operate, as well as systems that process Indian data or serve Indian users. Under the framework, AI systems are sorted into four risk tiers – low, moderate, high, and critical, which determine depth, frequency, and independence of audits and level of human oversight required. The guidelines set out nine core audit domains covering the AI lifecycle, from governance and data quality to adversarial resilience, human oversight and third-party supply-chain assurance.
Prepared by a working group of the Indian Computer Emergency Response Team, or CERT-In, the AI Security Auditing Guidelines, version 1.0, is aimed at government bodies, public sector entities, critical infrastructure operators, regulated entities, private companies, AI developers and service providers, and auditors, including CERT-In empanelled auditing organizations. It also includes added requirements for generative, agentic and other advanced AI to address risks such as prompt injection, data and model poisoning, and excessive agency. Audit findings are classified as critical, high, moderate or low, and a five-level maturity model lets organizations gauge their AI governance capability.