Control #
F
2
.
4
Review model policies for offensive security use
Review and document whether your systems—and any third-party models—permit or restrict use cases related to offensive cybersecurity, including hacking, red teaming, or penetration testing tasks.
Evidence
We'll list specific evidence that demonstrates compliance with this control. Typically, this is screenshots, proof of a legal or operational policy, or product demonstrations.
Recommended actions
We'll recommend specific practices and actions for complying with this control.