Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (NIST CAISSI, NSA SISC and CISA, PP-26-4396, version 1.0)
Ten voluntary key practices, grouped under prepare, detect, respond, recover and report, for incidents in super intelligence training and evaluation: limiting agent network access, monitoring agents cannot access or interfere with, automatic shutdown of affected agent trajectories, rebuilding environments from verified baselines before resuming, and notifying affected parties, government and the public.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Hard domain restriction C-E2 | Recommended | Practice 1, Design and Implement Technical Controls: 'Limit SI agent network access, via a strict allowlist where possible.' | high | 4 cases |
| Independent audit log C-V1 | Recommended | Practice 3, Monitor for Unexpected Activity: 'Ensure that SI agents cannot access or interfere with monitoring processes and logs.' | high | 1 case |
| Kill switch faster than the actor C-X2 | Recommended | Practice 6, Mitigate and Shut Down Undesired Activity: 'Automatically shut down impacted SI agent trajectories on detection of a control failure or in-progress SI control incident.' | medium | 2 cases |
| Containment and isolation C-E5 | Recommended | Practice 7, Verify and Strengthen Containment Before Resuming SI Agent Activity: 'Rebuild any environments that may have been compromised from verified baselines.' | medium | 5 cases |
| Coordinated disclosure program C-O1 | Recommended | Practices 8 to 10 (Coordinate with Affected Parties; Notify Government; Share Information Publicly): notify parties whose systems were compromised, voluntarily report to CISA, share details with the public | low | not yet seen missing in a case |