Ai Incident Response Readiness
Objective
Reduce breach impact (MTTC from days to hours).
Control / requirement
AI-IR runbook + tabletop exercises + containment automation.
Business impact
Without AI-specific IR capabilities, containment takes days instead of hours, increasing breach costs by 40-60% (IBM Cost of a Data Breach Report 2025).
Validation approach
Test ID: D6-CTL-04-VTS-001 Test Type: Manual (tabletop) Test Design: Simulate AI security incident (prompt injection causing data leak); execute AI-IR runbook Execution Steps: 1. Facilitate tabletop 2. Inject incident 3. Time containment 4. Document lessons Pass Criteria: ai_ir_runbook_activated = True; containment_within_sla (≤ 4h critical); lessons_learned_documented = True Independent Verification: Auditor observes tabletop and reviews runbook.
Expected evidence
Not separately specified in the available source.
Mapping and source
Not separately specified in the available source.
Implementation guidance
Translate the requirement into system-specific procedures, responsible roles, technical configurations and review conditions. Retain evidence showing both design and operating performance. Where the source provides no separate implementation instruction, do not infer that a single technical mechanism is sufficient.
Assessment considerations
- Confirm scope and applicability.
- Inspect control design and responsible ownership.
- Test representative operation and adverse conditions where appropriate.
- Evaluate evidence provenance, completeness and contradictory evidence.
- Record limitations and notably absent outcomes.