How do I demonstrate the NIST AI RMF secure-and-resilient characteristic for an AI agent?

To demonstrate the NIST AI RMF secure-and-resilient characteristic for an AI agent, an organization must integrate trustworthiness goals into its practices and evaluate the AI system's security and resilience. This involves establishing clear policies, implementing risk-aware engineering, and maintaining robust monitoring and response mechanisms.

• Integrate Trustworthiness Goals: A risk-management culture should be in place, integrating characteristics of trustworthy AI, including secure and resilient properties, into organizational practices.
• Implement Risk-Aware Engineering: Organizational practices should treat AI risks as first-class engineering concerns, incorporating secure-by-design principles, threat modeling, and change control. This also includes addressing risks from third-party models, datasets, and tools, tracking provenance, licensing, and model-update risks (NIST-GOVERN-6.1), which cross-maps to OWASP LLM03/LLM05 (supply chain).
• Evaluate Security and Resilience: AI system security and resilience, encompassing adversarial robustness, prompt-injection resistance (OWASP LLM01), and abuse resistance, must be evaluated and documented (NIST-MEASURE-2.7).
• Ensure Transparency and Accountability: Mechanisms should exist to log decisions and trace AI behavior, providing a forensic audit trail of every AI agent action, including API calls, data movements, and identity events (NIST-MEASURE-2.8). This is akin to an "AI Agent Flight Recorder".
• Establish Incident Response and Monitoring: Post-deployment monitoring and an AI/agent incident-response plan are essential for detection, escalation, containment, communication, and learning (NIST-MANAGE-4.1). Procedures should also be in place to deactivate, roll back, or retire AI systems that exceed risk tolerances (NIST-MANAGE-2.3).
• Address Generative AI-Specific Risks: For generative AI agents, specific risks like prompt injection (OWASP LLM01), data exfiltration (OWASP LLM02), and insecure tool use (OWASP LLM06) must be addressed.