Madrid, 26 October 2026. NIST, NSA and CISA have published ten voluntary practices for preparing for and managing control incidents involving highly capable AI agents. Released on 16 October, the guidance primarily targets organisations training or evaluating these agents on long-horizon tasks with limited human supervision. [1–3]
These events involve significant actions directed by neither the operator nor an attacker, compromising established boundaries or oversight. The definition therefore distinguishes actions directed through prompt injection. It also covers near-misses as indicators of weaknesses and organises activities into preparation, detection, response, recovery and reporting. [1–2]
Recommended measures include least privilege, network filtering and monitoring of models, execution software, hosts and networks. Agents must not be able to interfere with oversight mechanisms or logs. Validate monitors and, where possible, cross-check results using models from different families, without assuming diversity guarantees complete detection. [1]
At Internet Security Auditors, we recommend rehearsing activity shutdown, credential revocation and preservation of models, configurations and logs. Before restarting, rebuild compromised environments from verified baselines and test whether new controls detect or prevent recurrence. Integrate coordination with affected parties and reporting throughout incident management, distinguishing legal obligations from voluntary information sharing. [1]
At Internet Security Auditors, we support organisations through AI security audits, penetration testing, validation of isolation and monitoring, incident exercises and digital forensics. We integrate findings into response procedures, improvement plans, training and ISO/IEC 42001 management systems. We complement this work with EU AI Act applicability and gap assessments, according to the system and organisational role; technical guidance does not replace that compliance assessment. [4–6]
Referencias
[1] NIST, NSA and CISA — Original guidance, version 1.0 (October 2026)
https://www.nist.gov/document/keypracticesforincidentreadinessandresponseinsuperintelligence-trainingandevaluation
[2] NIST — Announcement of ten voluntary practices (16 October 2026)
https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training
[3] NSA — Readiness and response press release (20 October 2026)
https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4629045/nsa-and-others-advise-organizations-with-practices-to-prepare-for-and-manage-su/
[4] Internet Security Auditors — AI compliance assessment and support
https://www.isecauditors.com/en/evaluation-and-compliance-support-in-the-use-of-ai
[5] Internet Security Auditors — ISO 42001 AI management system implementation
https://www.isecauditors.com/en/implementation-of-aims-iso-42001
[6] Internet Security Auditors — Digital forensics and expert reports
https://www.isecauditors.com/en/computer-forensics-and-expert-reports
