NIST, NSA and CISA Issue Super Intelligence Incident Guidance

National Institute of Standards and Technology, the National Security Agency and the Cybersecurity and Infrastructure Security Agency (CISA) published ten voluntary practices for managing incidents during super intelligence training and evaluation, NIST announced on its website. The guidance covers preparation, detection, response, recovery and reporting.

The agencies define a control incident as significant uninstructed action by one or more agents that compromises policies, controls or security measures intended to limit a task or maintain human oversight. The document primarily applies to developers and evaluators running capable agents on extended tasks with limited supervision.

According to a LegalTech Daily analysis of the 14 page document, the practices call for organizations to retain evidence needed for investigations, including model weights, checkpoints, rejected tool calls, timestamps and records from sandbox and network activity. They also recommend tamper resistant logs, credential revocation, rebuilding compromised environments from verified baselines and testing containment systems before restarting agents. The guidance does not specify how long organizations should retain incident records.