Compatible-standard reports are lenses on AI Controls Matrix (AICM) answers from the function diagnostic — the AI Consensus Assessments Initiative Questionnaire (AI-CAIQ) is the attestation view of that spine, shown as a sample. Not certification.
Endpoint & Workload Security. Answer for Northwind Retail.
Pick the line that matches where you are today, least to most mature. Each question is a real control objective; the verification note says where to confirm it. 8/8 to answer.
Re-assessing Northwind Retail. A rated sample: illustrative answers are loaded, nothing is saved. Change what improved and the maturity and the gate recompute live.
Infrastructure Security and Resilience
UEM-01Is there a written standard for securing the endpoints and workloads that run or reach AI?
verify · Ask for the endpoint policy and check whether AI access from endpoints is in scope.
UEM-04Do you know every endpoint and workload that can reach your AI systems?
verify · Pull the endpoint inventory and reconcile it against what actually holds AI credentials.
UEM-05Are those endpoints and workloads centrally managed so security settings are enforced, not optional?
verify · Check the management console for enrolment coverage and enforced (not just recommended) settings.
UEM-09Do those endpoints and workloads have working protection against malware and tampering?
verify · Review the protection-coverage report and the alert handling for the endpoints with AI access.
Security Monitoring
LOG-03Are security events from those endpoints and workloads watched and alerted on?
verify · Confirm the endpoint telemetry reaches the monitoring tool and that alerts are triaged.
LOG-05When an endpoint alert fires, is it triaged and responded to on a defined process?
verify · Pull the last few endpoint alerts and check the response timeline against the process.
Governance
HRS-15Are the endpoint and workload engineers trained on using AI safely and verifying its output?
verify · Ask for this team’s training record and whether it covers verifying AI output.
GRC-15Is there a named person accountable for reviewing AI-driven endpoint/workload actions?
verify · Get the name and the review cadence; confirm it is a real responsibility.