GOV-19: Agent incident response
In short: Maintain a runbook for agent incidents that covers detection, containment, owner notification, evidence capture and recovery, and rehearse it twice a year. Agent incidents move faster than human ones and cross many systems. A rehearsed runbook replaces improvisation with known steps and named people.
1GOV-19
What does GOV-19 require?
Maintain a runbook for agent incidents that covers detection, containment, owner notification, evidence capture and recovery, and rehearse it twice a year.
Why does it matter?
Agent incidents move faster than human ones and cross many systems. A rehearsed runbook replaces improvisation with known steps and named people.
How do you test it?
- Ask for the runbook and the date of the last rehearsal.
- Check the runbook names the kill switch and who may use it.
- Confirm evidence capture happens before cleanup.
Which platforms document GOV-19?
No platform in the register documents this control in full.
- 9.10NewCore partly documentedSource: NewCore: Govern, read
- 7.30Astrix Security partly documentedSource: Astrix product, read
- 6.35Clutch Security partly documentedSource: Clutch Security platform, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- NIST AI RMFManage function: Responding to and recovering from incidents. Source: NIST AI Risk Management Framework
Which controls are related?
- GOV-11Revocation and kill switch
- GOV-14SIEM export
- GOV-23Evidence retention
Reviewed by The Register desk