This Sunday Special maps the frameworks organisations use to show their AI and AI agents are secure, from the NIST AI Risk Management Framework and ISO/IEC 42001 to OWASP's agentic Top 10, MITRE ATLAS, the EU AI Act and ASD's agent guidance. The centrepiece is ISO/IEC 27090:2026, the new international guidance on threats to AI systems, explained from ISO's public material. We also cover why agent configuration drift needs monitoring and why prompt instructions are guidance, not a security control.
Deep dive, no news segment. Content about ISO/IEC 27090 is drawn from ISO's public product page and explainer; the paywalled text has not been read.
The NIST foundation
- NIST AI Risk Management Framework (AI 100-1): voluntary framework, January 2023, built on Govern, Map, Measure and Manage; under revision. NIST
- Generative AI Profile (NIST AI 600-1): July 2024 profile of risks new to or worsened by generative AI, with suggested actions. NIST
- CAISI AI Agent Standards Initiative: launched 17 February 2026, covering agent security, identity and authorisation, and interoperability. NIST
- Adversarial Machine Learning taxonomy (NIST AI 100-2 E2025): attack vocabulary for predictive and generative AI. NIST CSRC
The ISO family
- ISO/IEC 42001:2023: certifiable requirements for an AI management system. ISO
- ISO/IEC 23894:2023: guidance on AI risk management. ISO
- ISO/IEC 42006:2025: requirements for bodies that audit and certify AI management systems. ISO
Practitioner catalogues
- OWASP Top 10 for LLM Applications (2025): prompt injection ranked first. OWASP
- OWASP Top 10 for Agentic Applications 2026: agent goal hijack, privilege abuse, code execution, memory poisoning and rogue agents. OWASP
- MITRE ATLAS v2026.09: 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations and 73 case studies, with new agent techniques. MITRE ATLAS, release notes
Deep dive: ISO/IEC 27090:2026
- What it is: guidance on understanding, detecting and mitigating security threats to AI systems across the life cycle; published 14 October 2026, 56 pages, not certifiable on its own, builds on ISO/IEC 27001 and 27002. ISO, IEC webstore
- ISO's explainer: three areas covering information security applied to AI, AI-specific threats (poisoning, extraction, evasion, inference, inversion, prompt injection, unsafe outputs) and keeping protection effective over time, including retraining risk. ISO
- Our assessment: a strong common reference for auditors and procurement; for agent-specific controls, OWASP's agentic list and ASD's guidance currently go further. Based on public summaries, not the full text.
- Agent configuration drift: makers can add tools, knowledge sources and instruction changes after approval; baseline, monitor, alert and re-review.
- Prompts are guidance, not controls: system prompts can be overridden through prompt injection; enforce limits outside the model with least privilege, approval gates, harness controls and monitoring.
Regulation and the Australian angle
- EU AI Act after the AI Omnibus (Regulation (EU) 2026/1744): high-risk obligations moved to 2 December 2027 and 2 August 2028; content marking grace period ends 2 December 2026. EUR-Lex, Council of the EU timeline
- National AI Centre: Guidance for AI Adoption: six practices replacing the earlier Voluntary AI Safety Standard guardrails. Department of Industry
- ASD's ACSC: Careful adoption of agentic AI services: low-risk, non-sensitive tasks only; no broad or unrestricted access. cyber.gov.au
- ASD's ACSC: Agentic AI harnesses, the layer above the model: least privilege, secure design, monitoring and logging, human oversight and accountability. cyber.gov.au
Actions for defenders and leaders
- Build an AI inventory, including embedded AI and every agent with tool access.
- Map training and retraining data sources; treat feedback loops as poisoning paths.
- Least privilege and approval points for agents; govern the harness, not just the model.
- Do not count system prompts as security controls.
- Monitor agent configuration for drift and re-review on change.
- Watch for high-volume or patterned queries that could signal model extraction.
- Red-team against OWASP's agentic list and MITRE ATLAS before widening autonomy.
- Plan a 27001 to 27090 gap review; note EU dates of 2 December 2026 and 2 December 2027.