Domain 3: Are security, integrations and AI requirements testable?

NIST CSF 2.0 includes identity, authentication and access-control outcomes. At a concrete implementation level, LogicGate’s API troubleshooting documentation explains that an authenticated request can still fail because the user or token lacks the necessary permissions. Treat access behaviour as something to test, not infer from a connector name. (nvlpubs.nist.gov)

7. Has security approved the requirements for sensitive GRC information?

A — 0: We have not classified the information the platform will contain.

B — 1: A generic supplier-security questionnaire exists, but workflow-specific restrictions are missing.

C — 2: Security and relevant privacy/legal owners have approved requirements for identity, privileged access, sensitive findings, audit trails, hosting, retention, resilience and supplier due diligence.

D — 3: A synthetic test pack specifies both permitted and denied actions across business units, administrators, integrations and reporting; reviewers have agreed the pass/fail criteria.

Evidence to retain: approved requirements, access matrix and negative-access tests—for example, a user who must not retrieve another entity’s restricted finding.

Mandatory gate: score at least 2. Production-data access still requires separate authorisation.

8. Have you specified integration behaviour and maintenance ownership?

A — 0: We are relying on statements such as “integrates with Jira” or “has an API”.

B — 1: Systems are listed, but data direction, ownership and failure handling are unclear.

C — 2: Each first-release interface specifies objects, fields, identifiers, authentication, synchronisation direction, frequency, error handling and a maintenance owner.

D — 3: Representative source payloads or extracts have been checked against the proposed mappings; tests cover failed authentication, retries, duplicate processing, stale data and reconciliation.

Evidence to retain: interface register, sample payloads, failure scenarios and responsibility split between buyer, supplier and partner.

No automated integrations planned? Apply the same progression to the controlled manual-import process. Full marks require a tested import/reconciliation procedure and an approved boundary on what remains manual.

9. Have you made an explicit, controlled decision about AI features?

A — 0: We have not decided what AI may access or do.

B — 1: AI demonstrations are being assessed mainly for convenience or apparent accuracy.

C — 2: Each proposed AI use has an owner, permitted data, approval boundaries and evaluation criteria—or AI is explicitly excluded from the first release.

D — 3: For included AI, a reviewed test pack covers source traceability, incorrect outputs, restricted evidence, human approval and stopping or reversing actions where relevant. For excluded AI, the exclusion is written into procurement requirements and later activation requires approval.

Evidence to retain: AI use-case register and test pack, or an approved exclusion and change-control decision.

NIST’s Generative AI Profile recommends verifying output sources and citations and cautions against extrapolating capability from narrow, anecdotal assessments. That supports testing on buyer-relevant material rather than treating a successful demonstration as general assurance. (doi.org)

Sources cited on this page

nvlpubs.nist.gov ↗nvlpubs.nist.gov
doi.org ↗doi.org