AI CORE / DOCUMENTATION

Requirements based on actual capabilities

Two profiles use a common control catalog. Each item has an objective, applicability condition, method, criterion and required evidence.

AI INDUSTRY

The profile covers the security auditability of a publishing system: public interfaces, separation of administration, external material, authorization of actions, limits and publication traceability. The Audit AI INDUSTRY plan is a specific application of the profile, not an independent assessment report on the magazine.

AI assistants and agents with tools

The profile applies to systems providing information or performing bounded actions. Scope follows capabilities: public reading, private data, write tools, memory, delegation and MCP. A simple informational assistant may not need an item intended for delegation, but the reason for exclusion must be recorded.

Selection without weakening requirements

Before assessment, describe trust boundaries, user roles, authorized tools and the most serious possible consequences. Determine applicability only then. A missing safeguard is not a reason to mark it inapplicable. Exclusions must follow functions and risks, not a desired favorable result.

Limited scope

The profiles do not provide a complete methodology for medical, critical industrial or other safety-critical systems. B2B describes business use, not a security level. An expert must assess whether the selected profile is adequate for the intended purpose and add requirements where necessary.

Reading a control item

A source reference identifies supporting material, not confirmation of full equivalence. Local AI CORE identifiers remain distinct from OWASP or NIST identifiers. Evidence requirements describe necessary content; their format may be adapted to the system as long as reviewability is preserved.

Open the complete profiles and control items