From policy to operational control
AI security governance is often documented as a set of principles, policies and committee responsibilities. The harder question is whether that governance model can make—and enforce—decisions when an AI system changes, fails or creates unacceptable risk.
Who owns each AI system? Who can approve its deployment, accept residual risk or suspend it during an incident? What evidence must exist before release? How are model changes, supplier dependencies, exceptions and incidents reported to the appropriate authority?
The AI Security Governance Model — Cheat Sheet provides a practical operating model for answering these questions.
What the cheat sheet covers
- Governance structures and decision rights
- Accountable ownership and segregation of duties
- Risk-tiered intake and delegated authority
- Enforceable lifecycle and deployment gates
- AI asset inventory and system-boundary controls
- Governance monitoring and escalation metrics
- Incident authority, containment and recovery
- Audit evidence and assessment readiness
The ODA3 integrated operating loop
The guide uses the ODA3 framework suite as an integrated operating loop:
- GAISSF™ structures governance, control objectives, evidence expectations and assurance.
- UAIF™ structures AI incident identification, classification and evidence.
- AI-IRF™ structures incident response, recovery and lessons learned.
Findings from incidents and assurance activities return to the governance layer so controls, risk treatment and oversight can be improved.
External framework orientation
The cheat sheet provides functional mappings to NIST AI RMF 1.0, NIST CSF 2.0, ISO/IEC 42001:2023, ISO/IEC 27001:2022, ISO/IEC 38507:2022, ISO/IEC 42005:2025, MITRE ATLAS, the OWASP Top 10 for LLM Applications and the EU AI Act.
These mappings support analysis and implementation planning. They do not establish equivalence, certification or regulatory compliance.