Artificial intelligence is advancing faster than the policies formulated to govern it. In the United States, AI oversight is spread across federal laws, executive actions, agency guidance, and state requirements, creating a fragmented landscape that struggles to keep pace with the technology’s rapid evolution.

These measures continue to be necessary because the United States still lacks comprehensive laws governing AI, privacy, and the growing intersection between the two. Yet organizations cannot afford to wait for a unified regulatory framework before integrating AI into critical business processes.

Drawing on decades of experience translating complex security and compliance obligations into operational programs, Telos regulatory and security experts created the Telos Secure AI Framework (TSAIF™). TSAIF is an AI governance and assurance model that helps organizations manage risk throughout the AI lifecycle. It assures risks are consistently identified, controlled, tested, monitored, and documented from development through deployment.

Designed to Produce Evidence

TSAIF operationalizes guidance from several NIST® standards:

• NIST AI Risk Management Framework
• NIST Generative AI Profile
• NIST Cybersecurity Framework
• NIST Privacy Framework

Overall, TSAIF contains 75 actionable controls across eight domains applicable to AI use and development: policy and procedural controls; access control; audit and accountability; awareness and training; risk assessment and responses; system and information integrity; supply-chain risk management; and system and services acquisition.

The end result is a control system built on the following principles:

1. Safer AI begins with constrained authority. TSAIF includes several AI system security, trust, and governance controls (including least privilege, downstream authorization, and identity). It also calls for protections against known AI-specific threats such as prompt injection, insecure parameters, agent-reasoning manipulation, and others. The goal is simple: an AI system should adhere to the concept of least privilege and access only the data, systems, and actions required for its approved purpose.

2. Reliable AI requires disciplined testing and change control. TSAIF covers AI assurance, validation, and lifecycle management controls (such as source validation, output review, and many more). Post-deployment monitoring helps identify model drift, unexpected behaviors, and control degradation before they become larger risks.

3. Secure and accountable AI must remain traceable. Like other standard cybersecurity frameworks, TSAIF requires:

• Logging of activities and authorization decisions
• Provenance for models, data, and third-party components
• Continuous monitoring and alerting
• Periodic audits
• Defined risk responses; and
• Human review matched to consequences.

In short, when using TSAIF to develop and deploy AI systems, a reviewer should be able to understand what happened, what evidence supported it, who approved it, and what changed.

Evidence-Based Structure

Assurance requires artifacts: threat models, risk assessments, access records, test results, data and model provenance, monitoring evidence, change approvals, incident records, and documented human decisions.

TSAIF links each desired outcome to specific controls, implementation guidance, responsible stakeholders, and any evidence needed to demonstrate compliance. This structure makes gaps visible and provides teams across the organization with a shared view of which requirements have been met and which still require attention. It also creates a defensible record for customers and reviewers, demonstrating trustworthiness beyond simple checklists.

This emphasis on continuous evidence collection is not new for Telos. As early as 2002, Xacta introduced patented continuous assessment features that enabled organizations to move past static documentation in favor of real-time security control validation. This innovation established a precedent for what would become industry best practices, providing a risk management strategy now standard among regulated enterprises and government bodies.

Today, our team leverages decades of expertise in developing GRC practices to guide the design, development, deployment, and oversight of our own AI products, with this framework reinforcing the approach.

The Basis for Responsible, Future-Ready AI

As artificial intelligence continues to evolve, so do the technical, operational, and regulatory expectations surrounding it. Anticipating this, we have intentionally designed TSAIF controls to be stable enough to ensure accountability, yet flexible enough to incorporate new evidence and requirements.

When the United States enacts a comprehensive AI regulation, we can map each TSAIF control to the corresponding controls in the new regulation, identify which requirements are already addressed, and determine where additional work is needed to meet the requirements of newly defined controls. This ensures that work already done to ensure AI security carries over—no need to restart.

By combining innovation with accountability, TSAIF helps organizations adopt AI with greater confidence today while preparing for tomorrow’s regulatory requirements. Rather than treating governance as a barrier to innovation, TSAIF makes responsible AI a practical and scalable part of the development process.

Disclaimer: TSAIF is designed to help organizations manage risk throughout the AI lifecycle. However, no framework can cover every unique circumstance or anticipate every potential disruption in the rapidly evolving AI landscape. To secure AI effectively, organizations must first define their AI strategy and ensure it aligns with their mission, as well as their overall security practices and controls. TSAIF serves as a guide, but it’s not a substitute for careful planning and integration with organizational security practices.

Note: TSAIF is continually updated and available for use by Telos customers.