AI Governance Framework for CISOs: Mapping Controls to Security Frameworks

TL;DR

• CISOs do not need a new control catalog for AI; they need the AI control set mapped onto the frameworks they already own (SOC 2, ISO 27001, ISO/IEC 42001, NIST AI RMF, NIST CSF 2.0, EU AI Act).
• The eight AI controls that repeat across those frameworks are LLM traffic routing, virtual keys, budgets and rate limits, guardrails, PII and secrets redaction, immutable audit logs, model and provider access lists, and MCP tool governance.
• Every one of those controls is enforced at the AI gateway; Bifrost is the enterprise control plane where the mappings turn into working configuration.
• Shadow AI (Claude Desktop, ChatGPT in the browser, coding agents, MCP servers on employee laptops) keeps CISOs out of ISO 27001, SOC 2, and EU AI Act attestations. A gateway alone does not cover it; the reference architecture pairs the gateway with Bifrost Edge on the endpoint.
• Bifrost Edge is currently in alpha; it extends the gateway's virtual keys, budgets, guardrails, and audit logs to every laptop through MDM (Jamf, Intune, Kandji), so the same policies apply where employees use AI.

Security teams are being asked to govern AI systems that use the same data, identities, and networks as everything else in the enterprise, but with no dedicated control catalog to work from. An AI governance framework built on existing security controls closes that gap by mapping AI-specific requirements (LLM traffic routing, virtual keys, budgets, guardrails, PII redaction, prompt logging, MCP tool governance) onto the frameworks CISOs already own: SOC 2, ISO 27001, NIST AI RMF, NIST CSF 2.0, and the EU AI Act. Bifrost, the open-source AI gateway built by Maxim AI, is the control plane where those mapped controls are enforced. This post walks the mapping framework by framework, then presents a reference architecture pairing the gateway with Bifrost Edge to bring endpoint AI (Claude Desktop, ChatGPT in the browser, coding agents, MCP servers) under the same policy set.

What Is an AI Governance Framework?

An AI governance framework is a structured set of policies, roles, and technical controls that decides which AI systems an organization allows, what data those systems may process, and how the resulting risks are measured and evidenced. For a CISO, the framework is useful only when it produces auditable controls, not principles. The eight AI controls that produce evidence across regulators are traffic routing, virtual keys, budgets and rate limits, guardrails, PII and secrets redaction, audit logs, model access lists, and MCP tool governance. Each maps back to a control family the security team already reports on, and each is enforced in the Bifrost AI gateway and in Bifrost Edge at the endpoint.

Two properties matter. First, the framework has to cover data plane and control plane together: routing a prompt through a gateway is worthless if the same prompt can leave the endpoint through an ungoverned browser tab. Second, it has to produce artifacts an auditor can read: immutable logs, signed events, exportable configuration, role-scoped review.

Why CISOs Are Being Asked to Own AI Risk

CISOs are being asked to own AI risk because most AI incidents look like security incidents: exfiltrated data, leaked credentials, or unauthorized model access. The AI-specific version is that employees connect enterprise data to consumer AI apps and MCP tools the security team never approved, turning model providers into unmanaged data processors.

Shadow AI is the term of art for that ungoverned surface. Coding-agent adoption pushes the same problem into engineering fleets through Cursor, Claude Code, Codex CLI, and connected MCP servers; desktop and browser AI (Claude Desktop, ChatGPT) does the same for the rest of the organization. Governance that only covers traffic explicitly routed through a gateway will fail an ISO 27001 or SOC 2 audit whose scope is the whole information system. Existing coverage of the shadow AI risk surface across enterprise teams makes the gap concrete.

Map AI Controls to SOC 2 Trust Services Criteria

SOC 2 evaluates a system against five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy), with Security shared across all engagements through the Common Criteria (CC1 through CC9). Mapping AI controls into SOC 2 means treating the AI gateway as an in-scope system component and producing evidence against CC6 (Logical Access), CC7 (System Operations), and CC8 (Change Management). The AICPA Trust Services Criteria document is the authoritative reference.

Bifrost audit logs support HMAC-signed events, configurable retention, and object-storage archival to S3, GCS, MinIO, or R2, so a Type 2 audit can reconstruct any policy change during the observation window. The same logs export as JSON, JSON Lines, or RFC 5424 Syslog for SIEM ingestion, which is what SOC 2 auditors expect.

Map AI Controls to ISO 27001 and ISO/IEC 42001

ISO 27001 is the general information security management system standard; ISO/IEC 42001 is the AI-specific management system standard published in 2023. The two are complementary: 27001 covers the security controls; 42001 covers the AI management overlay (impact assessments, model lifecycle, human oversight, transparency to affected individuals). A CISO writing a single AI governance framework should treat 42001 as the AI extension of the 27001 Annex A control set rather than a separate program.

The mapping below points to Annex A controls in ISO/IEC 27001:2022 that translate to AI gateway configuration.

For 42001-specific overlays (model lifecycle, human oversight for high-impact decisions), the same virtual key scope decides which models a consumer may reach, which is the mechanical basis for a documented "allowed models" register. Cluster these under one enterprise-facing framework rather than two: the enterprise AI governance framework and best practices guide covers the umbrella structure in depth.

Map AI Controls to the NIST AI Risk Management Framework

The NIST AI Risk Management Framework (AI RMF 1.0, plus the 2024 Generative AI Profile) is organized around four functions: GOVERN, MAP, MEASURE, and MANAGE. It is voluntary but is now the reference the US government uses for its own AI systems, so its vocabulary is showing up in enterprise procurement questionnaires and vendor risk assessments. The NIST AI Risk Management Framework resource page is the authoritative starting point.

For a CISO, the mapping into gateway controls is:

The MAP function is the one most enterprises fail because they cannot answer "what AI systems are in production." Bifrost inventories provider configurations, models, virtual keys, and MCP tool groups in one system of record, which produces the artifact MAP requires. On the MANAGE side, budget and rate limits enforce hierarchical spending controls at the customer, team, virtual key, and provider level, so a runaway consumer can be capped without pulling access.

Map AI Controls to NIST CSF 2.0 (GOVERN Function)

NIST released Cybersecurity Framework 2.0 in early 2024. The version-2 change most relevant to AI is the new GOVERN function, which sits alongside the original five (IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER). GOVERN codifies enterprise risk oversight, roles, policy, and supply-chain governance, all of which apply to AI systems.

The AI gateway maps to CSF 2.0 as follows:

• GOVERN (GV.OC, GV.RM, GV.SC): Third-party model providers are supply-chain risk. Provider access lists, virtual key scopes, and vault-managed credentials support GV.SC (Supply Chain Risk Management).
• IDENTIFY (ID.AM, ID.RA): Inventory of AI assets (models, providers, keys, MCP tools) supports ID.AM (Asset Management); guardrail baselines support ID.RA (Risk Assessment).
• PROTECT (PR.AA, PR.DS): Virtual keys and OIDC provisioning support PR.AA (Identity and Access Control); PII and secrets guardrails support PR.DS (Data Security).
• DETECT (DE.CM, DE.AE): Guardrail interventions and log exports support DE.CM (Continuous Monitoring) and DE.AE (Adverse Event Analysis).
• RESPOND (RS.CO, RS.MI): Signed audit trails support RS.CO; rate-limit and key-deactivation actions support RS.MI (Mitigation).
• RECOVER (RC.RP): Fallback routing and provider health monitoring support RC.RP for AI-dependent workflows.

This mapping is a common reason enterprises adopt an AI gateway: the controls that back a CSF assessment already exist and can be reused, so the AI program does not need a parallel evidence pipeline. The enterprise AI governance guide on turning policy into gateway controls walks the implementation.

EU AI Act Obligations for High-Risk Systems

The EU AI Act is the first horizontal AI regulation with binding penalties (up to 7% of global annual turnover). It classifies AI systems into unacceptable-risk (prohibited), high-risk (regulated), limited-risk (transparency obligations), and minimal-risk tiers. For CISOs, the high-risk tier is where technical controls translate directly into obligations: risk management (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency (Article 13), human oversight (Article 14), and accuracy, robustness, and cybersecurity (Article 15).

The direct control mappings are:

• Article 10 (data governance): PII and secrets redaction and per-virtual-key data scoping.
• Article 12 (record-keeping): Immutable, signed audit logs of governance changes and inference requests.
• Article 14 (human oversight): Guardrail interventions that block or redact before a model call completes; MCP execution defaults requiring explicit tool-call approval.
• Article 15 (cybersecurity): RBAC, OIDC provisioning, vault-backed credentials, and rate limits to bound resource abuse.

General-purpose AI model providers carry their own obligations under the Act, so virtual-key-scoped provider access matters: the CISO decides which GPAI models the organization uses and can revoke access if a provider's compliance posture changes. The Bifrost enterprise deployment path supports in-VPC and air-gapped installs for EU-processing scenarios that require data residency.

AI Governance Best Practices: Where the Gateway and Endpoint Fit

AI governance best practices for a CISO come down to five actions that make the framework mappings above operational. Each assumes an AI gateway is present; without one, the controls remain policy statements.

1. Centralize AI traffic through one gateway. Every direct-to-provider integration is a control gap. Route SDK, application, and agent traffic through Bifrost using its drop-in replacement for the OpenAI, Anthropic, Bedrock, and other SDKs, which changes one base URL rather than requiring app rewrites.
2. Issue a virtual key per consumer. Every team, application, and customer gets its own key with a provider and model allow-list, its own budget, and its own rate limit. This is the mechanical basis for CC6.1, A.5.15, PR.AA, and Article 15 evidence.
3. Enable guardrails on inputs and outputs. Secrets detection catches leaked API keys before they reach a provider; PII regex catches personal data; content-safety providers (AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, GraySwan Cygnal, Patronus AI) plug in for regulated domains.
4. Turn on signed audit logs and export them. HMAC signing, configurable retention, and Syslog or JSONL export feed the SIEM the security team already runs, closing the evidence loop for SOC 2 CC7.2 and CSF DE.CM.
5. Extend the same controls to the endpoint. A gateway only governs traffic that reaches it; the next section covers the endpoint layer.

The AI governance best practices for enterprise teams article covers implementation details for a broader audience. What the CISO adds is the framework mapping and the endpoint coverage.

Reference Architecture: AI Gateway + Bifrost Edge

Bifrost, the AI gateway, is the control plane and policy engine: virtual keys, budgets, rate limits, routing, guardrails, and audit logs are configured and enforced here. Bifrost Edge extends that same governance to the endpoint. Together they cover both the traffic developers configure and the traffic employees produce on their machines. Bifrost Edge is currently in alpha and is available through early-access registration.

The reference architecture looks like this:

• Applications, agents, and SDKs call the Bifrost API. Every request carries a virtual key, is checked against budgets and rate limits, is evaluated against guardrails, and is logged.
• Employee laptops run Bifrost Edge, which routes AI traffic from Claude Desktop, ChatGPT (web and app), Cursor, Claude Code, Codex CLI, Gemini CLI, and OpenCode through the same Bifrost. Edge also inventories MCP servers configured across the fleet and enforces per-server allow or deny on the device.
• The admin console manages both surfaces: RBAC for administrators, DAC for row-level data scoping, one guardrail configuration for every request path, and one audit log stream. Edge policies sync to every machine automatically.
• Rollout is silent through MDM. Edge deploys through Jamf, Microsoft Intune, Kandji, Omnissa Workspace ONE, and JumpCloud with a managed configuration that points each machine at the organization's Bifrost. Users sign in once through SSO.

Edge closes the shadow AI gap that keeps CISOs out of full-scope 27001 or SOC 2 attestations. The same guardrail profiles that protect gateway traffic protect prompts and responses from desktop and browser AI before a request leaves the machine. Adopting Edge does not add a second policy engine; it extends the reach of the one already in place. See the Bifrost governance resource hub for the concept model.

Frequently Asked Questions

What should be in an AI governance policy?

An AI governance policy for a CISO should define allowed AI systems and models, data classification for AI inputs, approved deployment patterns, incident response for AI-specific events, and evidence artifacts. The policy should reference the underlying security framework (SOC 2, ISO 27001, or NIST CSF 2.0) rather than duplicate it, and every control should identify the enforcement point in the AI gateway that produces evidence.

What are the key principles of AI governance?

The key principles are accountability (an owner for every AI system), traceability (every prompt, response, and configuration change logged), least privilege (per-consumer virtual keys, model allow-lists, RBAC and DAC on the admin surface), safety (guardrails on inputs and outputs), and continuous risk assessment (usage monitoring, cost budgets, drift detection). Each maps to one or more control families in the frameworks above.

How does an AI gateway support SOC 2 and ISO 27001?

An AI gateway supports SOC 2 and ISO 27001 by centralizing the technical controls both frameworks require: identity-scoped access (virtual keys), data protection (guardrails, redaction), monitoring (usage, guardrail interventions), and change management (signed audit logs). Because the gateway is the single point every request passes through, evidence collection is centralized rather than scattered across application logs, which is what makes Type 2 audits tractable.

What is the NIST AI RMF and how does it apply to CISOs?

The NIST AI Risk Management Framework is a voluntary US federal framework with four functions (GOVERN, MAP, MEASURE, MANAGE) covering AI-specific risks. For a CISO, its value is a shared vocabulary with regulators, procurement teams, and vendor risk assessments. Its functions map cleanly to gateway controls: MAP to inventory (provider and model catalog), MEASURE to guardrail logging, MANAGE to budgets and key deactivation.

How do you cover shadow AI in an AI governance framework?

Shadow AI (unmanaged AI use by employees through desktop apps, browser AI, coding agents, and MCP servers) is covered by extending the AI gateway to the endpoint. Bifrost Edge runs on every machine and routes AI traffic through Bifrost so the same virtual keys, budgets, guardrails, and log signing apply, and it inventories MCP servers running on the fleet and enforces per-server allow or deny on the device.

Does the EU AI Act apply if we are not selling AI systems in Europe?

The EU AI Act applies to providers and deployers of AI systems used in the EU regardless of where the organization is established, so a US-based CISO deploying AI in an EU subsidiary or serving EU users is in scope. High-risk system obligations require documented risk management, data governance, record-keeping, human oversight, and cybersecurity controls, all of which map onto controls a mature security program already runs.

Getting Started with Bifrost

Building an AI governance framework is easier when the enforcement points already exist. Bifrost gives a CISO one place to configure virtual keys, budgets, guardrails, and audit logs for every AI request, and Bifrost Edge extends the same governance to the AI running on every laptop. To evaluate the reference architecture against your SOC 2, ISO 27001, NIST CSF 2.0, or EU AI Act obligations, book a demo with the Bifrost team.