Applying CIS Controls to AI Workflows

LLMs enable everyday use and rapid enhancement of business processes. How can Information Security Teams address AI-related risks by leveraging their existing security programs and frameworks? What is missing, and how do Information Security Teams include AI-related risks in their security reporting?

AI presents a novel use of computing systems to provide advanced functionality. Information Security Teams must quickly understand and secure this emerging technology to identify, report, and mitigate risks incurred by the organization's use of AI solutions. The existing Information Security Frameworks are not focused on AI solutions and require interpretation to be effective. AI-specific frameworks and documentation provide insights and details for teams to understand and mitigate AI-related risks, but they assume traditional security solutions are already in place. However, the traditional security frameworks and the AI-specific frameworks are not integrated or easily translated.

This research provides guidance on using the CIS Controls in conjunction with AI-specific frameworks to build a robust information security program.