Infrastructure

AI data stores and control planes shall not be publicly reachable without authentication—proven by a current CSPM or network scan plus authenticated edge controls or private-only exposure, not by private-subnet intent alone.

Artifact

Inventory of in-scope AI data stores and control-plane endpoints; CSPM/network scan covering those surfaces (measuredAt ≤90 days); Authenticated edge-control config, or private-only exposure proven by the scan; Open high/critical public-exposure findings closed or waived with owner and expiry

Pass condition

Inventory of in-scope AI data stores and control-plane endpoints exists; 0 of those endpoints are publicly reachable without authentication in the latest CSPM/network scan; findings severity ≥ high are closed or waived with owner and expiry; authenticated edge controls are configured or private-only exposure is proven by the scan (measuredAt ≤90 days). If no AI data stores or control planes exist, score NOT_APPLICABLE.

Production AI runtime environments shall comply with the organization's documented patching SLA—or hold approved time-boxed waivers—proven by inventory plus vulnerability/age evidence, not by image-tag pinning alone.

Artifact

Documented patching SLA for production AI runtime environments; Inventory of production AI runtime environments (containers, VMs, serverless, managed AI platforms, or equivalent); Vulnerability scan and/or image/runtime age report covering that inventory (measuredAt ≤90 days); CVE/patch backlog disposition + waiver register for any SLA exceptions (owner and expiry)

Pass condition

Inventory of production AI runtime environments exists; a documented patching SLA covers those environments; 100% comply with that SLA or approved time-boxed waivers exist with owner and expiry; report shows 0 SLA breaches without such waivers and vulnerability/age evidence covers the inventory (measuredAt ≤90 days). If no production AI runtime environments exist, score NOT_APPLICABLE.

Agent and tool runtimes shall communicate only with documented dependencies required for their intended function—enforced by least-privilege network and/or identity controls, not by open east-west access inside the environment.

Artifact

Inventory of agent/tool runtimes and their documented required dependencies; Least-privilege connectivity controls for those runtimes (network policy, security groups, service mesh, workload identity, egress gateway, private endpoints, or equivalent); Probe or reviewed test showing unauthorized internal-service access is blocked (measuredAt ≤90 days)

Pass condition

Inventory of agent/tool runtimes and their documented required dependencies exists; those runtimes can communicate only with those dependencies; attempts to access unauthorized internal services are blocked by network and/or identity controls (measuredAt ≤90 days). If no agent or tool runtimes exist, score NOT_APPLICABLE.

Shared AI accelerator infrastructure shall enforce tenant isolation and noisy-neighbor controls—proven by documented isolation design plus a fresh isolation/capacity test meeting stated limits—not by GPU presence alone.

Artifact

Scope note: shared AI accelerator infrastructure present (or explicit N/A for managed-API/CPU-only/single-tenant/dedicated); Isolation design (GPU scheduling, MIG/vGPU, resource quotas, tenant QoS, or equivalent); Isolation and/or capacity test report meeting stated limits (measuredAt ≤90 days)

Pass condition

Inventory or explicit scope confirms shared AI accelerator infrastructure; isolation and noisy-neighbor controls are documented; and the latest isolation/capacity test (measuredAt ≤90 days) meets stated limits. If the organization does not operate shared AI accelerator infrastructure (e.g. managed-API-only, CPU-only, single-tenant, or dedicated GPU per workload), score NOT_APPLICABLE.

Deprecated: superseded by SCI-R1 (SLSA-aligned signed model/container verify-on-deploy). Retained for N−1 readers; new assessments should use the supply-chain successor Check.

Artifact

Cluster/admission controller config requiring signed images + last failed-unsigned admission event or drill

Pass condition

Unsigned model/container images cannot schedule in production namespaces; policy verified by a failed admission test within 90 days. Prefer scoring SCI-R1 instead.

Production AI infrastructure shall be declared in infrastructure-as-code with CIS-aligned (or equivalent) policy checks on every apply/PR—proven by IaC modules, policy-scan config, and a fresh production-stack report—not by console-built stacks alone.

Artifact

IaC modules covering production AI infrastructure; CIS-aligned (or equivalent) policy-scan config wired to apply/PR; Latest policy-scan report for production stacks (measuredAt ≤90 days); Critical findings closed or waived with owner and expiry

Pass condition

Production AI infrastructure is declared in IaC; CIS-aligned (or equivalent) policy checks run on every apply/PR; critical findings for production stacks are 0 or have dated exceptions with owner and expiry (measuredAt ≤90 days). If no production AI infrastructure is managed by the organization, score NOT_APPLICABLE.