Encryption Monitoring and Reporting

[All Actors]
1. AI Data Encryption Compliance: Collaborate with relevant stakeholders to ensure that AI datasets (training data, inference inputs, outputs) are encrypted in transit and at rest.

2. Policy Alignment and Key Ownership: Document cryptographic policies dictating AI data handling, including data classification, key ownership, and approved encryption methods. Specify reporting channels for incidents or deviations from established cryptographic standards.

3. Access Control and Key Management: Enforce strict role-based permissions to limit access to cryptographic keys for AI workloads (e.g., training, testing, production). Integrate automated key lifecycle management (generation, rotation, retirement) aligned with AI model stages, logging all key-related events.

4. Monitoring and Reporting: Log and audit all cryptographic operations associated with AI data (encryption/decryption events, certificate usage, key access). Implement real-time dashboards or alerts to visualize encryption status and flag anomalies (e.g., unauthorized key usage, suspicious access patterns).

5. Model Integrity and Output Verification: Incorporate checks during AI inference to confirm model outputs have not been tampered with. Automate alerts that notify security teams when cryptographic inconsistencies or anomalies are detected in AI pipelines.

6. Secure Logging and Retention: Store cryptographic logs (key usage, encryption events) in encrypted form with defined retention policies suitable for AI data and model parameters. Use role-based access to restrict who can view or modify these logs, preventing unauthorized disclosure or tampering.

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for establishing and maintaining monitoring and internal reporting capabilities over cryptographic, encryption, and key management operations for cloud infrastructure and AI processing resources to understand their oversight processes for customer data protection and infrastructure security. Verify their understanding of monitoring controls for encryption of customer workloads, internal reporting mechanisms for infrastructure cryptographic operations, and procedures for maintaining ongoing oversight of key management for customer isolation and service security.

2. Inspecting Records and Documents

2.1 Confirm monitoring mechanisms are in place to detect encryption failures or unauthorized decryption attempts for cloud infrastructure data, customer workloads, and inter-service communications.

2.2 Verify reports are generated on the use of encryption in cloud infrastructure data transmission, customer data storage, and compute resource protection.

2.3 Review documentation on how cryptographic keys are handled, rotated, and monitored for cloud infrastructure security, customer data protection, and tenant isolation.

2.4 Validate that cloud infrastructure teams receive alerts for deviations in encryption policy adherence affecting customer security and infrastructure integrity.

2.5 Check integration with central SIEM tools for real-time visibility into cloud infrastructure cryptographic operations and customer protection events.

2.6 Ensure audit logs capture cloud infrastructure encryption-related events like certificate expiration, invalid key use, or customer data encryption failures.

2.7 Confirm documentation of encryption algorithms and configurations in use for cloud infrastructure operations, customer data protection, and hardware security.

2.8 Examine internal reporting processes for communicating cloud infrastructure cryptographic and key management findings to infrastructure operations and customer security teams.

2.9 Review periodic assessment and reporting schedules for cloud infrastructure cryptographic policy compliance and customer protection effectiveness.

2.10 Validate that monitoring and reporting capabilities cover all aspects of cloud infrastructure cryptographic operations including customer isolation, infrastructure security, and regulatory compliance.

2.11 Confirm centralized monitoring of encryption operations across all cloud services.

2.12 Validate reporting systems track usage of KMS, HSMs, and customer-managed keys.

2.13 Review incident handling procedures for failed or suspicious cryptographic operations.

2.14 Verify customer access to audit logs involving key lifecycle events.

2.15 Ensure tools are in place to alert on anomalies in key access patterns.

2.16 Confirm monitoring of compliance with configured encryption policies across multi-tenant platforms.

2.17 Check evidence of periodic reporting to external auditors or customers.