---
document: MVAP-SPECIFICATION
version: 1.0
status: adopted
adopted_date: 2026-06-22
board_vote: 22/27
source_session: sessions/2026-06-22-cybersecurity-ai-diligence-rounds-1-20.md
moderator: Arthur Vance
court_reporter: Eleanor Vance
---

# Minimum Viable AI Diligence Program (MVAP) — Specification v1.0

## Document Purpose

This specification implements the boardroom consensus from Round 19 (five pillars adopted) and Round 20 (22/27 final endorsement). MVAP defines the **minimum** diligence required before an enterprise deploys LLM-based applications to production.

**MVAP is necessary but not sufficient** for:
- Regulated financial/healthcare entities under active examination
- Critical infrastructure (OT AI) — requires separate IEC 62443 tier
- Nation-state threat profiles — requires enhanced red team and firmware layers

## Scope

| In Scope | Out of Scope (Separate Tiers) |
|----------|-------------------------------|
| Customer-facing and internal LLM apps | OT/ICS predictive AI (IEC 62443 tier) |
| RAG-backed chatbots and agents | Open-weight model redistribution programs |
| Fine-tuned models on enterprise data | Firmware/GPU driver layer (advisory only, v1.0) |
| AI API endpoints and tool-calling | Academic robustness certification |

## Maturity Levels

| Level | Description | Target |
|-------|-------------|--------|
| **MVAP L1** | All five pillars implemented with documented evidence | Day 0–90 |
| **MVAP L2** | L1 + purple-team validation + automated pipeline gates | Day 90–180 |
| **MVAP L3** | L2 + SLSA L3, 24h KEV patch SLA, firmware advisory controls | Future board review |

---

## Pillar 1 — AI Governance & Inventory

**Vote:** 25/27 PASS

### Requirements

| ID | Control | Evidence Artifact |
|----|---------|-------------------|
| P1-01 | Maintain AI system registry (all LLM apps, models, data sources) | Registry export with owner, risk tier, deployment date |
| P1-02 | Apply NIST AI RMF **Govern** and **Map** functions | AI RMF workbook or GRC mapping document |
| P1-03 | Risk tier every AI system (Low / Medium / High / Critical) | Tiering matrix with business impact and data classification |
| P1-04 | Prohibit shadow AI — unregistered systems blocked at network egress | Quarterly shadow-AI scan report |
| P1-05 | Align with NIST GenAI Profile (NIST.AI.600-1) for generative systems | Profile mapping checklist |

### References

- [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework)
- [NIST GenAI Profile (NIST.AI.600-1)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)

---

## Pillar 2 — Application & LLM Security

**Vote:** 24/27 PASS

### Requirements

| ID | Control | Evidence Artifact |
|----|---------|-------------------|
| P2-01 | OWASP LLM Top 10 coverage assessment per application | Completed LLM Top 10 checklist with mitigations |
| P2-02 | Input/output guardrails on all user-facing LLM endpoints | Guardrail config + bypass test results |
| P2-03 | RAG retrieval sanitization — block indirect prompt injection via documents | Retrieval filter rules + poisoned-doc test log |
| P2-04 | Tool-calling authorization — least-privilege per agent tool | IAM policy matrix for agent actions |
| P2-05 | SAST/DAST on AI service code paths (Python/TypeScript inference services) | CI pipeline scan results (Semgrep/CodeQL/Burp) |
| P2-06 | OWASP LLM01 (Prompt Injection) — tested annually minimum | Red team or automated injection test report |

### OWASP LLM Top 10 (2025) — Mandatory Coverage

1. LLM01 Prompt Injection
2. LLM02 Sensitive Information Disclosure
3. LLM03 Supply Chain
4. LLM04 Data and Model Poisoning
5. LLM05 Improper Output Handling
6. LLM06 Excessive Agency
7. LLM07 System Prompt Leakage
8. LLM08 Vector and Embedding Weaknesses
9. LLM09 Misinformation
10. LLM10 Unbounded Consumption

### References

- [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/)
- [MITRE ATLAS](https://atlas.mitre.org/)

---

## Pillar 3 — Supply Chain Integrity

**Vote:** 23/27 PASS

### Requirements

| ID | Control | Evidence Artifact |
|----|---------|-------------------|
| P3-01 | SBOM for all AI service dependencies (SPDX or CycloneDX) | SBOM file in artifact repository |
| P3-02 | Model registry with signed artifacts (cosign/Sigstore or HSM equivalent) | Signature verification log on deploy |
| P3-03 | Dependency pinning with hash verification in CI/CD | Lockfile + hash-check CI gate |
| P3-04 | Hugging Face / external model scan for pickle deserialization gadgets | Pre-import scan report |
| P3-05 | SLSA Level 2+ aspirational for tier-1 (High/Critical) AI systems | SLSA provenance attestation (target L2) |

### References

- [SLSA v1.0](https://slsa.dev/spec/v1.0/)
- [Sigstore cosign](https://docs.sigstore.dev/cosign/overview/)

---

## Pillar 4 — Detection & Response

**Vote:** 24/27 PASS

### Requirements

| ID | Control | Evidence Artifact |
|----|---------|-------------------|
| P4-01 | AI API request logging (prompt hash, token count, user, model version) — no raw PII in logs unless encrypted | Log schema + sample retention proof |
| P4-02 | Token usage baselines and anomaly alerts | SIEM detection rule IDs |
| P4-03 | MITRE ATT&CK-mapped detections for AI service accounts | ATT&CK coverage map |
| P4-04 | Annual AI-focused red team engagement | Red team report with remediation tracker |
| P4-05 | SOAR playbook for AI service account compromise (isolate, revoke, preserve) | Playbook IR-AI-01 test record |
| P4-06 | Immutable backup for model weights and training data (Object Lock or equivalent) | Backup test restore log (quarterly) |

### References

- [NIST SP 800-61](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---

## Pillar 5 — Human Layer

**Vote:** 22/27 PASS

### Requirements

| ID | Control | Evidence Artifact |
|----|---------|-------------------|
| P5-01 | Quarterly AI-enhanced phishing simulations (personalized lures) | Click-rate report with trend |
| P5-02 | Executive-specific deepfake/voice-clone awareness training (annual minimum) | Training completion records |
| P5-03 | Helpdesk verification protocol for AI-impersonation pretexts | Updated helpdesk runbook |
| P5-04 | Incident reporting channel for suspected AI-generated fraud | Ticket category metrics |

### References

- [NIST SP 800-50](https://csrc.nist.gov/publications/detail/sp/800-50/final)

---

## Staffing & Budget Guidance (Non-Binding)

Board Round 18 did not reach majority on exact figures. Planning guidance:

| Resource | L1 Minimum | Notes |
|----------|------------|-------|
| FTE | 3–7 | AI security lead, AppSec, SOC liaison |
| Budget | $500K–$1.2M annually | 5,000-employee enterprise estimate — [Projected Speculation] |
| External | Annual red team + quarterly phishing vendor | Required for P2-06 and P5-01 evidence |

---

## Dissent Record (v1.0)

| Dissenter | Position | Vote Share |
|-----------|----------|------------|
| Aether, Hex | Firmware/GPU mandatory in MVAP | 9/27 |
| NullByte, Kira | SLSA L3 + 24h KEV patch SLA | 8/27 |
| GridLock | OT tier needs dedicated MVAP funding | 11/27 |
| Marcus Thorne | Continuous compliance must not dilute regulatory floor docs | 3/27 |
| Jordan Taylor | Academic robustness metrics (membership inference eval) missing | 6/27 |

Dissent items queued for MVAP v1.1 review at 90-day maturity session.

---

## Compliance Crosswalk

| MVAP Control | NIST AI RMF | ISO 27001:2022 | SOC 2 |
|--------------|-------------|----------------|-------|
| P1-02 Govern/Map | Govern, Map | A.5, A.8 | CC1, CC2 |
| P2-01 LLM Top 10 | Measure, Manage | A.8.26 | CC7 |
| P3-01 SBOM | Manage | A.8.28 | CC8 |
| P4-01 Logging | Measure | A.8.15 | CC7 |
| P5-01 Training | Govern | A.6.3 | CC1 |

---

## Implementation Checklist

```
[x] P1 — AI registry live, 47 systems tiered (L1 certified 2026-09-20)
[x] P2 — OWASP LLM Top 10 complete; P2-03/P2-04 production certified 2026-09-21
[x] P3 — SBOM + model signing in CI/CD (L1 certified 2026-09-20)
[x] P4 — IR-AI-02 production; MTTC 14m avg (L2 certified 2026-09-21)
[x] P5 — Q2+Q3 AI-phishing simulations complete (L1 certified 2026-09-20)
[x] Red/Blue exercise — Pillars 2+4 executed and remediated
[x] Verification Ledger — sessions/verification-ledger.md (updated 2026-09-21)
[x] 90-day L2 review — sessions/2026-09-20-mvap-level-2-maturity-review.md
[x] Remediation sprint — CLOSED (mvap/REMEDIATION-SPRINT-30DAY.md)
[x] MVAP L2 — OPERATIONAL (18/27 vote 2026-09-20)
```

**Remediation tracker:** `mvap/REMEDIATION-SPRINT-30DAY.md`

**Certified by:** Eleanor Vance, Chief Documentation & Verification Officer  
**Approved by:** Arthur Vance, Chief Facilitator & Risk Strategist  
**Adopted by:** Boardroom majority 2026-06-22