Quick Start Guide

Document Control

Copyright, Licensing and Reliance Notice

© 2026 ODA3 Pvt Ltd. Published by ODA3 Institute. GAISSF™ is used as the framework identifier. Use, reproduction, adaptation, certification, credential, and trademark rights are governed by the applicable GAISSF publication terms and licensing instruments. This document does not constitute legal advice and does not guarantee security, safety, regulatory compliance, or absence of harmful outcomes.

Precedence Statement

This guide provides implementation guidance only. It does not create or modify GAISSF requirements. Use GAISSF-NOR-001 and GAISSF-NOR-004 for authoritative requirements and control records.

1. Rapid Onboarding Sequence

2. Scope Decision

Document legal entities, business units, AI systems, models, datasets, agents, tools, APIs, third parties, interfaces, environments and excluded components. An exclusion should be supported by a risk-based justification and should not remove a dependency that materially affects the assessed system.

3. Select the Conformance Path

The seven D9 controls are not part of the canonical Foundational scope, but they become applicable where physical AI, robotics, autonomous actuation, operational technology or cyber-physical effects are in scope.

4. Build the Statement of Applicability

5. Evidence Starter Set

Create an evidence index that links each applicable control to policies, system records, configurations, logs, test results, approvals, supplier records, incident records and corrective actions. Preserve original timestamps, signatures, hashes and chain-of-custody information where relevant.

6. First 30/60/90 Days

7. Common Failure Modes

Common failures include counting policies as operating evidence, omitting supplier dependencies, treating the 52-control Foundational scope as optional sampling, ignoring D9 applicability, using maturity scores to conceal nonconformity, accepting indefinite exceptions, and making certification claims broader than the assessed boundary.

8. Foundational Control Checklist — 52 Controls

9. Additional Physical-AI Checklist — 7 Controls

10. Readiness Gate

Do not proceed to certification assessment until scope is approved, all applicable controls are represented in the SoA, required evidence is available, tests have been executed, major gaps are closed, exceptions are valid and time-bound, and public claims are controlled. Certification may be offered or claimed only under a separately issued GAISSF certification scheme, assessment rules and claims policy.

Annex A — Complete 59-Control Reference

Control Index

Controlled Profile Reconciliation Notice

The Foundational profile comprises the 52 canonical controls in D1-D8. The seven D9 controls are additional mandatory controls whenever physical AI or cyber-physical actuation is within the assessed scope.

Any earlier wording that described the Foundational profile as spanning all nine domains, or that treated D9 as universally mandatory or universally excluded, is superseded by this statement. D9 applicability shall be determined and justified for every assessed scope.

Complete Quick-Start Sequence

First Assessment Workshop

• Bring system, security, data, legal, risk, privacy, safety, procurement and operations representatives.
• Review scope before discussing scores.
• Use exact control text and evidence requirements.
• Record disagreements and assumptions rather than forcing consensus.
• End with owners, actions, dates and escalation decisions.

Minimum Viable Evidence Pack

The Foundational profile comprises the 52 canonical controls in D1-D8. The seven D9 controls are additional mandatory controls whenever physical AI or cyber-physical actuation is within the assessed scope.

Publication Completeness and Intended Use

This full publication edition of GAISSF-NOR-003 is designed to stand on its own for its stated role: rapid but complete onboarding and initial adoption sequence. It includes purpose, scope, governance, operating guidance, evidence expectations, limitations, decision criteria and reusable records appropriate to that role.

Completeness does not mean that the document replaces the normative control statements, applicable law, sector-specific engineering, organizational procedures or professional judgement. Cross-referenced GAISSF documents remain part of the controlled document system.

Evidence-State and Reassessment Rules

Configuration, policy, architecture, and deployment records demonstrate design or implementation. They do not, by themselves, demonstrate sustained operating effectiveness. Period-of-operation evidence shall cover a duration and event population appropriate to the control, risk, deployment stage, and assessment objective; no universal 30-day threshold applies to every control.

Material changes to the assessed system, model, data, prompts, tools, privileges, deployment context, suppliers, interfaces, intended use, or physical-actuation capability shall trigger documented impact analysis. Where applicability, risk, implementation, or evidence requirements may have changed, the affected Statement of Applicability entries shall be reassessed.