AWS wellarchitected high security documentation change
Summary
Added FSIOPS06-BP02 on establishing generative AI incident response procedures.
Security assessment
Directly addresses security incident response for AI-specific threats including prompt injection attacks, model poisoning, and data leakage events. Specific evidence includes documented procedures for security events and prompt injection attacks.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/fsiops6.md b/wellarchitected/latest/financial-services-industry-lens/fsiops6.md index e8217de94..4a293e5fb 100644 --- a//wellarchitected/latest/financial-services-industry-lens/fsiops6.md +++ b//wellarchitected/latest/financial-services-industry-lens/fsiops6.md @@ -5 +5 @@ -FSIOPS06-BP01 Manage cloud provider service events +FSIOPS06-BP01 Manage cloud provider service eventsFSIOPS06-BP02 Establish generative AI incident response procedures @@ -26,0 +27,23 @@ Check the [AWS Health Dashboard](https://health.aws.amazon.com/health/status) to +## FSIOPS06-BP02 Establish generative AI incident response procedures + +Create [specialized runbooks](https://aws.amazon.com/blogs/security/methodology-for-incident-response-on-generative-ai-workloads/) for generative AI-related incidents including model failures, hallucination detection, inappropriate outputs, security events, bias detection incidents, data leakage events, prompt injection attacks, model poisoning attempts, and regulatory violations. + +Define clear escalation paths and remediation procedures specific to AI/ML incidents and ensure integration with existing FSI regulatory reporting requirements. + +**Prescriptive guidance** + + * Document incident response procedures for common generative AI failures (like API throttling, model unavailability, and quality degradation). + + * Implement circuit breakers using AWS Lambda to automatically fail over to alternative models or fallback logic when performance thresholds are breached. + + * Create automated rollback mechanisms for prompt template updates that cause quality issues. + + * Establish a generative AI incident review board to assess model-related incidents and implement improvements. + + * Define acceptable degraded service levels during generative AI incidents with clear communication to affected business units and customers. + + * Create generative AI-specific incident response playbooks with automated escalation workflows and stakeholder notification procedures. + + + +