Article
Most organizations discover their AI evidence gaps at the worst possible moment — mid-incident, mid-audit, or mid-assessment, when it’s too late to go back and capture what was never logged in the first place.
That’s the problem our newest practitioner cheat sheet, CHT-SEC-009: AI Security Evidence Collection Guide, is built to prevent.
AI systems generate evidence across a fragmented, often ephemeral stack — model versions, prompts, retrieval sets, agent tool-calls, vendor telemetry the operating organization doesn’t fully control. Most of it disappears by default unless someone deliberately configures it to persist. This guide maps out what to collect, where it’s most commonly lost, and how to prioritize limited collection effort where it actually matters for classification and root cause.
Inside, practitioners will find:
- An evidence architecture map showing how evidence flows — and where it typically drops — across the full AI request pipeline, from API gateway through inference, retrieval, and agentic tool-calls to the evidence repository
- A Minimum Evidence Package — the ten artifacts any assessment or investigation should be able to produce on demand
- Evidence priority classification (Critical / High / Supporting / Contextual) to help teams focus on what actually matters
- Common evidence loss scenarios — disabled logging, log rotation, discarded agent memory — framed as architectural risks to close before an incident forces the question
- Chain-of-custody guidance and an evidence confidence status model (Verified / Partial / Corrupted / Missing / Derived) for documenting what an investigation can and can’t support
- Mapping to UAIF™, AI-IRF™, and GAISSF™, plus a reference table of relevant external frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act, MITRE ATLAS, OWASP) — cited for orientation, not endorsement
- A full Notably Absent section, so readers know exactly what this guide does and doesn’t claim
As with all ODA3 Institute cheat sheets, every non-obvious claim is evidence-tagged (T1–T4), and the guide makes no certification, compliance, or endorsement claims — it maps to our frameworks under the GAISSF Ecosystem License (GEL) v1.0.
Read the full cheat sheet: [CHT-SEC-009 on oda3.org]