Propose new control: AI Supply Chain Security

[amberb617]

Proposed control

Name: AI Supply Chain Security
Tier: 02 (Enforce & Monitor)
ID: AISECA-02-008 (proposed)

Description

Assess and monitor the security posture of the AI supply chain -- model providers, training data sources, fine-tuning pipelines, and plugin/tool ecosystems.

Rationale

Enterprises increasingly depend on third-party models, APIs, and plugins. Compromises in the AI supply chain (model poisoning, backdoored plugins, training data contamination) represent a growing threat vector.

Implementation

• Model provenance tracking (SBOM for AI)
• Third-party model security assessments
• Plugin/tool vetting processes
• Training data lineage documentation
• Dependency monitoring for AI libraries

NIST Mapping

• MAP 5.1 (Third-party risks)
• GOVERN 5.1 (Policies for third-party AI)
• MANAGE 3.1 (Pre-deployment risk management)