| ID | Title | Objective | Control Family | Threat Mappings | Guideline Mappings | Assessment Requirements |
|---|---|---|---|---|---|---|
| CCC.GenAI.CN01 | Model Input Filtering and Sanitisation | Inspect and validate input before it is passed to a GenAI model in order to filter or sanitise adversarial queries and prevent sensitive data leakage. | MachineLearning | 2 | 12 | 2 |
| CCC.GenAI.CN02 | Model Output Filtering and Sanitisation | Inspect and validate GenAI model output before passing it to users, applications or plugins in order to filter or sanitise insecure or unreliable output and prevent sensitive data leakage. | MachineLearning | 5 | 10 | 2 |
| CCC.GenAI.CN03 | Data Provenance and Source Vetting | Ensure that all data for training, fine-tuning or RAG comes from trusted, approved sources and is authorised for the intended purposes in order to prevent the initial introduction of malicious content or leaked sensitive data. | MachineLearning | 2 | 3 | 2 |
| CCC.GenAI.CN04 | Sanitisation of Ingested Data | Validate and sanitise all data ingested by GenAI systems from extenal sources or internal knowledge bases, whether for training, conversion to vector embeddings, or real-time retireval, in order to remove or redact poisoned or sensitive data before further processing. | MachineLearning | 2 | 5 | 2 |
| CCC.GenAI.CN05 | Citations and Source Traceability | Require the GenAI system to provide citations or direct links back to the source documents used to generate a response, in to enhance the transparency, trustworthiness, and verifiability of AI-generated content. | MachineLearning | 2 | 1 | 1 |
| CCC.GenAI.CN06 | Least Privilege for Plugins | Restricts the permissions of any external tools the GenAI system can call to limit the potential damage if an agent is coerced to perform unintended actions or vulnerabilities in the tools are exploited. | Access | 2 | 5 | 1 |
| CCC.GenAI.CN07 | Model Version Pinning | Mandate that applications are locked ("pinned") to a specific, tested version of a foundational model to prevent unexpected behaviour changes introduced by provider-side updates. | MachineLearning | 1 | 1 | 1 |
| CCC.GenAI.CN08 | Quality Control and Red Teaming | Establish a formal program for quality evaluation and adversarial testing (red teaming) to ensure GenAI system meet all business, quality, security and compliance requirements before getting deployed into production environments. | MachineLearning | 5 | 5 | 2 |
Imports
| ID | Remarks |
|---|---|
| CCC.Core.CN01 | Prevent Unencrypted Requests |
| CCC.Core.CN02 | Ensure Data Encryption at Rest for All Stored Data |
| CCC.Core.CN03 | Implement Multi-factor Authentication (MFA) for Access |
| CCC.Core.CN04 | Log All Access and Changes |
| CCC.Core.CN05 | Prevent Access from Untrusted Entities |
| CCC.Core.CN06 | Prevent Deployment in Restricted Regions |
| CCC.Core.CN07 | Alert on Unusual Enumeration Activity |
| CCC.Core.CN08 | Enable Multi-zone or Multi-region Data Replication |
| CCC.Core.CN09 | Prevent Tampering, Deletion, or Unauthorized Access to Access Logs |
| CCC.Core.CN11 | Enforce Key Management Policies |