AI Solution Onboarding Security Checklist

Professional: Form a cross-functional committee (Security, Compliance, Legal, Product) and publish an AI governance policy.
Description's: Decide who is in charge of AI decisions and put it in writing.
Example: Monthly AI steering meetings, formal policy document.

Professional: Document acceptable risk thresholds and classification for AI use-cases (safety-critical vs non-critical).
Description: Decide how much risk you will accept for each AI use.
Example: Customer-facing diagnosis = low risk tolerance; internal reports = moderate tolerance.

Professional: Map AI assets to ISMS processes, assign owners, and include in management reviews.
Description: Make AI part of your regular security program and name who owns each control.

Professional: Validate vendor certifications (SOC2/ISO), require incident SLA, audit rights, and data handling clauses.
Description: Check vendor security, and put protections in contracts.
Example: Right-to-audit clause; data deletion on termination.

Professional: Request SBOMs for model artifact components and libraries to track vulnerabilities and licensing.
Description: Ask vendors what components are inside their model so you can patch vulnerabilities.

Professional: Require vendors to notify of critical vulnerabilities and patch timelines.
Description: Make sure vendors tell you about security issues and fix them fast.

Professional: Maintain catalog of training & inference datasets and label sensitivity (PII, PHI, IP).
Description: Know what data you use for AI and how sensitive it is.
Example: Customer PII = restricted; public scraped web = public.

Professional: Encrypt sensitive data at rest & in transit; manage keys with KMS/HSM and rotate keys regularly.
Description: Use locks to protect sensitive data and control who has the keys.

Professional: Implement minimization, anonymization and consent handling; document retention schedules.
Description: Collect only what you need, and respect user consent.
Example: Anonymize PII before training, delete raw logs after X days.

Professional: Enforce secure coding, peer review, automated testing and gated deployments for model changes.
Description: Build models in a controlled pipeline with checks before releasing.
Example: Unit tests, adversarial tests, approval gates in CI/CD.

Professional: Maintain provenance metadata, sign artifacts, and verify integrity before deployment.
Description: Track where models came from and make sure they weren't tampered with.

Professional: Implement metrics, alerts, and automated rollback for model performance and fairness drift.
Description: Watch model results and revert if things get worse.

Professional: Schedule periodic adversarial testing including prompt injection, model evasion and API hardening.
Description: Try to break the model to find weaknesses before attackers do.

Professional: Define playbooks for data leak, model theft, bias incidents and model poisoning.
Description: Have step-by-step instructions when something goes wrong.

Professional: Regular training for developers, data scientists and business users on secure AI practices.
Description: Teach staff how to use AI safely and responsibly.

Professional: Track legal & regulatory obligations (GDPR, EU AI Act, sector rules) and map controls.
Description: Keep a list of laws and how you meet them.