CSA AI Controls Matrix (AICM): Securing AI Systems in the Cloud

Programme Themes

• AI system inventory and ownership
• Training / inference data governance
• Model access control and change management
• Monitoring for abuse, drift, and prompt/tool misuse
• Third-party model and API assurance

Fit with Agentic Products

If you expose agents that call tools or customer data, map AICM themes to your SDLC and runtime monitoring — ThreatHawk use cases included.

How CyberSilo Helps

• Map CCM controls in CyberSilo CSA (Compliance Standards Automation)
• Monitoring evidence with ThreatHawk SIEM
• Advisory for STAR readiness — contact CyberSilo

Frequently Asked Questions

Does AICM replace CCM?

No. It complements CCM for AI-specific risks.

Is AICM required for STAR?

STAR centres on CCM. AICM is increasingly requested when AI features are in scope — confirm buyer language.

Where do agent permissions fit?

Under AI system access control, monitoring, and third-party tool assurance themes.

Related CSA CCM / STAR Resources

Hub · Shared responsibility · ThreatHawk