Framework mapping — NCSC / CISA Guidelines for Secure AI System Development


Framework	Guidelines for Secure AI System Development (NCSC, CISA and 21 partner agencies, November 2023)
Mapping version	1.0
Review date	2026-08-21
Next review	2027-02-21
Status vocabulary	Evidence available · Gap · Not evaluated · Customer

The guidelines are voluntary and aimed primarily at providers of AI systems. ScotiTech is the provider of the AXOS software; the model provider is a separate party the customer selects. This mapping records what we do across the four lifecycle stages. It is not a claim of conformance.

1. Secure design

Guideline	What AXOS does	Status
Raise staff awareness of threats and risks	Engineering team follows the disclosure policy and threat-informed review; no formal AI-security training programme yet	Partial
Model the threats to your system	Threat model covers: prompt injection via retrieved content, cross-tenant retrieval leakage, credential exposure in logs, admin-route abuse. Mitigations: ACL-first retrieval, PII-free logging, admin-key guard, rate limiting	Evidence available
Design your system for security as well as functionality and performance	Security headers, strict env validation (fails on placeholder secrets), least-privilege admin routes, no default credentials	Evidence available
Consider security benefits and trade-offs when selecting your AI model	Model is customer-selected; AXOS documents the trade-off (managed API vs self-hosted open-weight) in the integrations and sizing guidance	Customer decision; documentation evidence available

2. Secure development

Guideline	What AXOS does	Status
Secure your supply chain	Dependencies pinned via lockfile; tagged releases from version control; SBOM and signed checksums available on request	Evidence available
Identify, track, and protect your assets	Asset inventory in the technical documentation pack; data inventory in retention.md	Evidence available
Document your data, models, and prompts	Data inventory (retention.md); model connection is customer-configured and logged per request; system prompts are configurable and disclosable	Evidence available
Manage your technical debt	Tests, lint, and typecheck in CI; dependency updates triaged on a cadence	Evidence available (process)

3. Secure deployment

Guideline	What AXOS does	Status
Secure your infrastructure	Self-hosted inside customer boundary; reference network zoning and HA topology documented; for ScotiTech-operated services see Trust Center	Evidence available / Customer for self-hosted
Protect your model and data continuously	ACL-first retrieval; encryption at rest; customer-managed keys in self-hosted; no content telemetry to ScotiTech	Evidence available
Develop incident management procedures	Coordinated disclosure; 48-hour processor breach notice; operator runbooks	Evidence available
Release AI responsibly	AI output labelled; human review gates; AUP and Terms s.4 restrict misuse	Evidence available
Make it easy for users to do the right things	Non-essential cookies off by default; AI features can be disabled per workspace; secure defaults in env validation	Evidence available

4. Secure operation and maintenance

Guideline	What AXOS does	Status
Monitor your system's behaviour	Audit events exportable to customer SIEM; health endpoint reports DB state	Evidence available
Monitor your system's inputs	Retrieval scope logged per request; model endpoint logged	Evidence available
Follow a secure-by-design approach to updates	Signed releases; customer-controlled change window; rollback by tag pin	Evidence available
Collect and share lessons learned	Changelog; security advisories to customers with active engagements	Evidence available

Gaps and roadmap