GOV-24: Board reporting
In short: Report agent governance to the board or its risk committee on a set schedule, using a short page of consistent measures. Boards are asked about AI risk by regulators, auditors and insurers. A regular report shows oversight is real and keeps funding tied to evidence.
1GOV-24
What does GOV-24 require?
Report agent governance to the board or its risk committee on a set schedule, using a short page of consistent measures.
Why does it matter?
Boards are asked about AI risk by regulators, auditors and insurers. A regular report shows oversight is real and keeps funding tied to evidence.
How do you test it?
- Ask for the last two board reports on agents.
- Confirm the measures are the same in both.
- Check each measure traces to a system of record.
Which platforms document GOV-24?
No platform in the register documents this control in full.
- 9.10NewCore not found in public materialChecked: NewCore: Discover; NewCore: Secure; NewCore: Govern; NewCore: Identity foundation; NewCore emerges from stealth; NewCore on AWS Marketplace, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- NIST AI RMFGovern function: Oversight of AI risk by leadership. Source: NIST AI Risk Management Framework
Which controls are related?
- GOV-15Periodic access review
- GOV-23Evidence retention
Glossary: ai management system, control crosswalk.
Reviewed by The Register desk