{"product_id":"ai-cybersecurity-management-system","title":"AI Cybersecurity Management System","description":"\u003cp\u003e\u003cem\u003eEditable policies, registers and assessment workbooks to secure AI systems, with one AI control set mapped to ISO\/IEC 27001:2022, ISO\/IEC 42001:2023 and NIST CSF 2.0.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eAI brings assets an information security management system was not written for: models, training data, prompts, plugins, AI interfaces and AI service providers. This system adds that AI layer. It identifies the assets, assesses the threats, sets the controls, and records the evidence that the controls work.\u003c\/p\u003e\n\u003cp\u003eAt its centre is an AI security control framework with a control applicability statement. A crosswalk maps each control to ISO\/IEC 27001:2022, ISO\/IEC 42001:2023 and the NIST Cybersecurity Framework 2.0, so the work counts towards frameworks you may already run. A defensive threat library links each threat scenario to the controls that address it.\u003c\/p\u003e\n\u003cp\u003eThe system is strictly defensive. It contains no exploitation instructions, attack code, payloads or scanners. Security testing is governed (authorised, scoped, reported and remediated), not performed. Legal and contractual obligations are left as placeholders for your own legal review. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSecurity governance:\u003c\/strong\u003e scope and context, roles and RACI, objectives, a KPI and KRI register, performance reporting, management review and a legal, regulatory and contractual register.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePolicies and procedures\u003c\/strong\u003e for AI assets, data security, access, the secure AI lifecycle, generative AI, third parties and supply chain, vulnerabilities, monitoring, incidents, evidence, change and security testing.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRegisters and risk:\u003c\/strong\u003e AI asset, model, data, interface and service-provider registers, an AI security risk methodology and register, threat scenarios and a threat-to-control matrix.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTesting and vulnerability governance:\u003c\/strong\u003e authorisation, scope, results, findings and remediation records.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDetection and response:\u003c\/strong\u003e logging and detection requirements, AI incident response with forensic readiness and chain of custody, and secure recovery planning.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssurance:\u003c\/strong\u003e evidence matrices and a control-to-evidence map, self-assessment and maturity assessment, gap assessment with a remediation roadmap, internal review and mock audit tools, corrective action and a 90-day implementation plan.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eOrganisations that develop, deploy, buy, integrate or use AI systems. The system is owned by an AI security lead working with an AI security steering committee. It suits most organisations that already run or are building an ISO\/IEC 27001 ISMS and want an AI-specific layer that maps back to it.\u003c\/p\u003e\n\u003cp\u003eIt pairs with the ISMS ISO\/IEC 27001:2022 toolkit for the wider ISMS, and with the AI Resilience Testing Management System for governing red-team and penetration test engagements on AI.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395131646292,"sku":"AGS-21-006","price":790.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-21-006.png?v=1790973825","url":"https:\/\/agskits.com\/products\/ai-cybersecurity-management-system","provider":"Apex Global Solutions","version":"1.0","type":"link"}