ISO/IEC 27001：AI-FW 控制与组织责任
了解框架义务、AI-FW 技术控制和组织责任。
ISO/IEC 27001：AI-FW 控制与组织责任 · 已生效
本页说明框架与 AI-FW 的关系。产品支持部分运行时控制，但不替代组织的合规或审计责任。
AI-FW 的定位
- 说明：AI-FW supports controls for AI traffic and should itself be included as an ISMS asset. The ISMS, risk treatment, Statement of Applicability and audit programme remain organisational responsibilities.
产品不负责的事项
- 说明：Establishing ISMS context, scope, leadership or improvement.
- 说明：Running risk assessment and treatment.
- 说明：Maintaining the organisation-wide asset inventory.
- 说明：Running internal audits and management reviews.
- 说明：Conducting certification audits.
控制映射
- 说明：Asset inventory: 说明：Know information and associated assets. AI-FW: 说明：Model inventory contributes AI provider and endpoint data.
- 说明：Access control: 说明：Limit access according to business need. AI-FW: 说明：Identity-bound API keys, roles and certificates.
- 说明：Change management: 说明：Control and trace security changes. AI-FW: 说明：Audit Events record rule and configuration changes.
- 说明：Logging: 说明：Monitor relevant activity. AI-FW: 说明：Transaction metadata, dashboards and export.
证据预期
- 说明：Authentication: 说明：Enabled modes and role configuration.
- 说明：Rule state: 说明：Active rules, directions and actions.
- 说明：Change records: 说明：Actor and timestamp.
组织责任
- 说明：Define ISMS scope, risks and Statement of Applicability.
- 说明：Maintain policies, control owners and audits.
- 说明：Assess assets beyond AI-FW.
- 说明：Select applicable ISO edition and qualified advice.
- 说明：Validate evidence in the audit programme.
常见问题
说明：Does AI-FW certify an organisation to ISO 27001?
说明：No. Certification assesses the organisation's ISMS, not the gateway product.
说明：Do gateway logs cover the whole ISMS?
说明：No. They cover AI-FW-observed activity and enabled features.
说明：Do logs prove a control worked for the entire audit period?
说明：Not by themselves. Validate coverage, operation and evidence sufficiency.
一般信息，不构成法律或审计建议。