Skip to main content
Security standards for AI agents multiplied sharply in the first half of 2026. OWASP, CIS, ISO, NIST, CSA, CoSAI, and the OpenID Foundation have each published documents of their own, and it has become hard to tell which one to read when. The sections below sort them by the stage where each one applies, from threat modeling to certification.

​
OWASP Top 10 for Agentic Applications 2026

Use this when you start threat modeling an agent. It organizes agent-specific threats into ten items, including goal hijacking, tool misuse, identity and privilege abuse, and memory poisoning. It extends rather than replaces the OWASP Top 10 for LLM Applications; most agents are also LLM applications, so both apply. MITRE ATLAS sits alongside it as a catalog of real-world attack techniques, and Google SAIF provides the map for surveying risk across the whole organization.

​
Identity Management for Agentic AI

Use this when you design identity and authorization for your agents. The OpenID Foundation whitepaper organizes current best practice for treating agents as OAuth 2.1 clients, covering workload identity with SPIFFE, agent lifecycle management through SSO and SCIM, and asynchronous approval with CIBA. It centers on replacing user impersonation with delegated authority, and surveys the unsolved problems ahead: recursive delegation, consent fatigue, and trust across domains. If you’re designing identity management for agents, read this first.

​
CIS Controls v8.1 AI Companion Guide

Use this when you implement controls. The guide comes in three volumes covering LLMs, agents, and MCP. It describes everything from input sanitization at the model layer to tool execution authorization and auditing of access through MCP, all as extensions of the existing CIS 18 controls. The reason to pick it is that your security team doesn’t have to learn a new framework; the controls arrive in the vocabulary they already use. The CSA AI Controls Matrix serves as a cross-reference table covering the same control domains.

​
CSA Agentic AI Red Teaming Guide

Use this once you have a working agent and need to verify that it’s safe. The guide lays out test perspectives for each of twelve threat categories, including authorization hijacking, goal manipulation, and manipulation of memory and context. Take the items you surfaced during threat modeling and put them to the test here.

​
CoSAI AI Incident Response Framework

Use this once your agents run in production and you’re building monitoring and incident response. The framework presents an incident response lifecycle for AI systems. It defines agent-specific telemetry such as prompts and outputs, tool calls, memory updates, and MCP messages, and provides detection and containment playbooks for prompt injection, memory poisoning, and RAG contamination.

​
ISO/IEC 42001

Use this when you need to show outside parties that your organization governs its AI. It also works as a yardstick when you’re the one vetting vendors. It’s the only AI management standard you can be certified against: you document your AI system inventory, impact assessments, and lifecycle controls, then undergo third-party audit. The NIST AI RMF Playbook maps these management requirements to concrete actions.

​
AI Guidelines for Business version 1.2

This is the anchor document for internal policy and audit work in Japan. Version 1.2, dated March 31, 2026, makes access control requirements for AI systems explicit and comes with a crosswalk to the NIST AI RMF. The AISI methodology guide is a red teaming procedure manual written in Japanese, and for government-related work the Digital Agency’s generative AI procurement guidelines apply. For how to fold these standards into an internal guideline, see Internal AI Security Guidelines.

​
References