AI failure plan for security breaches

Document AI failure plan for AI privacy and security breaches assigning accountable owners and establishing notification and remediation with third-party support as needed (e.g. legal, PR, insurers)

Keywords

Incident Response

Security

Privacy

Regulatory Deadlines

Application

Mandatory

Frequency

Every 12 months

Type

Preventative

Crosswalks

Article 20: Corrective Actions and Duty of Information

Article 73: Reporting of Serious Incidents

A.8.4: Communication of incidents

A.8.5: Information for interested parties

GOVERN 4.3: Testing and incident sharing

MANAGE 1.3: Risk response planning

MANAGE 4.3: Incident communication

BCR-09: Disaster Response Plan

BCR-10: Response Plan Exercise

SEF-01: Security Incident Management Policy and Procedures

SEF-02: Service Management Policy and Procedures

SEF-03: Incident Response Plans

SEF-04: Incident Response Testing

SEF-05: Incident Response Metrics

SEF-07: Security Breach Notification

SEF-08: Points of Contact Maintenance

SEF-09: Incident Response

Control activities

Typical evidence

Assigning a breach response lead from existing staff. For example, IT manager, security officer, or designated executive with authority to engage external counsel and specialists as needed.

Defining breach notification procedures. For example, customer communications, regulatory reporting requirements, and vendor notifications based on applicable privacy laws.

Implementing security remediation measures. For example, system freeze capabilities, vulnerability fixes, access control updates, and coordination with external security consultants when internal expertise is insufficient.

Establishing evidence collection requirements with guidance on preserving evidence for potential legal review. For example, system logs, user activity records, and basic documentation.

E001.1 Documentation: AI failure plan for security breaches

Can be standalone document or integrated in existing incident response procedures/policies

AIUC-1 is built with industry leaders

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Phil Venables

Former CISO of Google Cloud

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."