Compatible-standard reports are lenses on AI Controls Matrix (AICM) answers from the function diagnostic — the AI Consensus Assessments Initiative Questionnaire (AI-CAIQ) is the attestation view of that spine, shown as a sample. Not certification.
Pick the line that matches where you are today, least to most mature. Each question is a real control objective; the verification note says where to confirm it. 9/9 to answer.
Re-assessing Globex. A rated sample: illustrative answers are loaded, nothing is saved. Change what improved and the maturity and the gate recompute live.
Organization Management
CCC-01Is there a written process for how changes to AI systems and their cloud configuration are made?
verify · Ask for the change-management procedure and confirm AI/cloud changes follow it.
CCC-04Are changes to AI systems authorized and reviewed before they go live?
verify · Pull the last few AI deployments and check for an approval record before release.
CCC-06Is there a known-good configuration baseline for your AI cloud estate?
verify · Ask for the baseline definition and how it is kept current.
CCC-07Do you automatically detect when the AI cloud configuration drifts from the approved baseline?
verify · Review the posture-management tool for baseline-deviation alerts on the AI estate.
Infrastructure Security and Resilience
I&S-03Is the cloud network around your AI workloads locked down to only what is needed?
verify · Review the security groups / network policies around the AI workloads for default-deny.
I&S-04Are the cloud images and containers running AI hardened to a defined baseline?
verify · Check image-scan results against the hardening baseline for the AI containers.
I&S-06Are AI workloads isolated from other cloud workloads so a compromise cannot spread?
verify · Confirm the AI workloads run in their own boundary and test lateral movement is blocked.
Governance
HRS-15Are the cloud and container engineers trained on using AI safely and verifying its output?
verify · Ask for this team’s training record and whether it covers verifying AI output.
GRC-15Is there a named person accountable for reviewing AI-driven cloud changes?
verify · Get the name and the review cadence; confirm it is a real responsibility.