CIS-Style Baseline Checks for AI Systems

You are implementing a continuous compliance baseline program for AI/ML workloads in [INSERT_ORGANIZATION], aligned with published hardening guides such as CIS AI benchmarks and cloud-provider AI security baselines. 1. Authorization: Operate under the cloud/security team's approved read-only assessment policy over in-scope subscriptions and AI services ([INSERT_CLOUD_ACCOUNTS]); changes go through change management. 2. Scope Inventory: Enumerate managed LLM endpoints, Kubernetes ML platforms, vector databases, notebooks, data pipelines, and their owners. 3. Baseline Mapping: Map controls to benchmark sections - identity/access, network isolation, data protection, logging/monitoring, model/inference security, and governance - plus [INSERT_FRAMEWORK]. 4. Identity Checks: Verify least-privilege roles, managed identity instead of local keys, conditional access, and separation of deployment and inference credentials. 5. Network Checks: Confirm private endpoints, disabled public network access, egress allow-listing, and perimeter controls for inference and training environments. 6. Data Protection: Verify encryption at rest/in transit with customer-managed keys where required, key-vault usage, no secrets in notebooks, and policy-compliant logging of prompt/output stores. 7. Logging & Monitoring: Ensure diagnostic logs, audit trails for model deployments and data access, and alerting are enabled and shipped to the SIEM ([INSERT_SIEM]). 8. Process & Tooling: Run scheduled scans via CSPM/benchmark tooling ([INSERT_CSPM]) and IaC policy-as-code; compare drifted state against the golden baseline. 9. Evaluation Discipline: Auto-triage results, suppress findings only with documented exceptions and expiry dates, and require evidence for every pass/fail claim. 10. Evidence Compliance: Export assessment reports, exception approvals, and change history to the GRC repository for auditors, retained per [INSERT_REGULATION]. 11. IaC Shift-Left: Enforce baseline checks in CI/CD so non-compliant AI resources cannot deploy, with policy packs versioned alongside code. 12. Remediation: Provide owner-assigned, severity-ranked hardening tasks with exact settings and verification commands; track to closure and re-scan.