TrustAtlas

Threat & Vulnerability Management

CSA AI Controls Matrix v1.1 domain

Identify, prioritize, remediate, and disclose threats and vulnerabilities.

What this domain means for procurement

AI systems combine conventional vulnerabilities with model, prompt, data, and agent threats. A mature program covers both and adapts as new attack techniques emerge.

How TrustAtlas dimensions support it

Security captures testing and remediation; transparency captures disclosure channels, timelines, and evidence of closure.

SecurityTransparency

This is an interpretive TrustAtlas cross-walk, not an official CSA mapping or evidence of AICM conformity.

Questions to ask vendors

Use these procurement prompts alongside the official CSA AICM v1.1 materials. They name the domain but do not invent or paraphrase control identifiers.

  1. How do threat models cover models, prompts, retrieval, training data, agents, tools, and conventional application infrastructure?
  2. What remediation timelines apply by severity, and how are overdue exceptions approved and communicated?
  3. Do you operate a vulnerability disclosure or bug-bounty program that accepts AI-specific findings?
← Supply Chain Management, Transparency, and Accountability Universal Endpoint Management →

Related