Compatible-standard reports are lenses on AI Controls Matrix (AICM) answers from the function diagnostic — the AI Consensus Assessments Initiative Questionnaire (AI-CAIQ) is the attestation view of that spine, shown as a sample. Not certification.
Network & Infrastructure Security. Answer for Hooli.
Pick the line that matches where you are today, least to most mature. Each question is a real control objective; the verification note says where to confirm it. 9/9 to answer.
Re-assessing Hooli. A rated sample: illustrative answers are loaded, nothing is saved. Change what improved and the maturity and the gate recompute live.
Infrastructure Security and Resilience
I&S-01Is there a written standard for securing the infrastructure your AI runs on?
verify · Ask for the infrastructure security policy and check whether AI hosting is in scope.
I&S-03Is the network around your AI infrastructure controlled, so traffic in and out is restricted to what is needed?
verify · Review the firewall/security-group rules around the AI workloads for default-deny and stale allow rules.
DCS-06Are the systems and assets that host AI catalogued and classified by how sensitive they are?
verify · Pull the asset inventory and confirm the AI-hosting systems are present and classified.
I&S-04Are the machines and operating systems running AI workloads hardened to a defined baseline?
verify · Ask for the hardening baseline and a recent compliance scan of the AI hosts against it.
I&S-06Are AI workloads separated from the rest of the environment so a problem cannot spread freely?
verify · Confirm the AI workloads sit in their own segment and test that lateral movement is blocked.
DCS-08Is physical and logical access to where AI infrastructure lives controlled at defined entry points?
verify · Check the access-point controls and logs for the facilities/cloud accounts hosting AI.
I&S-09Is there active network defense around the AI systems that detects and responds to attacks, with metrics?
verify · Review the network-defense metrics: detections, response times, coverage of the AI estate.
Governance
HRS-15Are the network and infrastructure engineers trained on using AI safely and verifying its output?
verify · Ask for this team’s training record and whether it covers verifying AI output.
GRC-15Is there a named person accountable for reviewing AI-driven infrastructure changes?
verify · Get the name and the review cadence; confirm it is a real responsibility.