ASD ISM 2087 Verify the source and integrity of AI training data
What it says
The source and integrity of training data for AI models is verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck where the data used to train artificial intelligence (AI) models comes from and confirm it has not been tampered with before it is used.
Artificial intelligence (AI) models learn from large sets of data, and the quality of that data shapes how the model behaves. This control means you must know exactly where your training data came from (its source) and confirm it has not been changed, corrupted, or poisoned along the way (its integrity). If you train a model on data of unknown origin or data that someone has secretly altered, the model can make wrong, biased, or unsafe decisions, and you may not realise why.
Free. Save your status, tasks and notes.
Why it matters
If training data of unknown origin or that has been secretly altered is used, the AI model can produce wrong, biased, or manipulated outputs that the organisation trusts and acts on without realising the cause.
How to implement
The data team should record where every training dataset comes from (the supplier, the internal system, or the public source) and keep this provenance record alongside each dataset so its origin can always be traced back.
An engineer should generate a checksum (a unique digital fingerprint, such as a SHA-256 hash) for each dataset when it is received and recheck that fingerprint before the data is used for training, so any change to the file is detected.
The procurement or vendor manager should require data and AI suppliers to provide written confirmation of where their data originated and that it has not been altered, and capture this in the supply contract.
The AI project lead should run basic quality and sanity checks on incoming data (looking for unexpected entries, duplicated records, or signs of deliberate poisoning) and document the checks before approving the data for training.
The IT manager should store approved training datasets in a controlled location with restricted access and version control, so only verified data is used and any later change is logged and reviewable.
Keep it running
Re-verify source and integrity every time a dataset is refreshed or re-supplied, not just on first use, and keep provenance and checksum records for as long as the model is in service.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the provenance records for a sample of training datasets.
Look at
a clear, named source for each one (vendor, internal system, or public repository).
Good evidence
traces every dataset back to a documented, legitimate origin with no gaps.
- Check 2 of 5What an auditor asks for
Ask for
how the organisation confirms training data has not been altered.
Look at
checksums or hash values recorded on receipt and re-verified before use.
Good evidence
shows the fingerprint was recorded and matched, with evidence of what happens when it does not match.
- Check 3 of 5What an auditor asks for
Ask for
to see the contracts or agreements with data and AI suppliers.
Look at
clauses requiring the supplier to confirm data source and integrity.
Good evidence
shows these obligations are written into the agreement, not just assumed.
- Check 4 of 5What an auditor asks for
Ask for
evidence of the quality and integrity checks run on incoming data.
Look at
documented sanity checks and the results, including any datasets that were rejected.
Good evidence
shows checks are routine and that bad data is actually turned away.
- Check 5 of 5What an auditor asks for
Ask for
who can access and change the approved training datasets.
Look at
restricted access, version control, and change logs.
Good evidence
shows only authorised staff can touch the data and every change is recorded.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.21.
ISM-2087 requires the organisation to verify the source and integrity of training data used for AI models to prevent data poisoning. Annex A 5.21 addresses managing information security risks in the ICT supply chain, which overlaps where training data is sourced from third parties, data brokers, SaaS platforms, or outsourced data engineering pipelines. Annex A 5.21 is broader, covering suppliers/products/services generally, while ISM-2087 is narrower and more specific to provenance and integrity validation of AI training datasets.
ISO/IEC 42001: 6 mappings
This control partially overlaps A.4.3.
Annex A 4.3 requires documenting the data resources utilised for the AI system. ISM-2087 necessitates verification of source and integrity of AI training data. The overlap involves provenance and integrity checks being typically part of AI data documentation, focusing on different aspects of data handling.
This control partially overlaps A.7.2.
Annex A 7.2 requires defined, documented and implemented processes for managing data used to develop and enhance AI systems. ISM-2087 aligns by requiring verification of the source and integrity of AI training data, which is a specific data provenance and integrity component of AI data management. The overlap is limited to provenance/integrity assurance for training data; Annex A 7.2 is broader and expects a full set of data management processes across the AI lifecycle and dataset types (not only training inputs).
This control partially overlaps A.7.3.
Annex A 7.3 requires the organisation to determine and document details about how data for AI systems is acquired and selected, including provenance and selection criteria. This overlaps with ISM-2087 because verifying the source and integrity of AI training data relies on knowing and recording where the training data came from and what was accepted into the training corpus. ISM-2087 is more security-integrity focused (verification/assurance), whereas Annex A 7.3 is broader governance documentation across acquisition and selection for all AI data types, not only training data.
This control partially overlaps A.7.4.
Annex A 7.4 demands documented data quality requirements to ensure AI development and operational data meets those standards. ISM-2087 requires verifying the source and integrity of AI training data, addressing the provenance and integrity aspects of Annex A 7.4’s framework. Annex A 7.4 extends its focus to additional quality attributes and encompasses all data used in AI operations. The overlap lies in their mutual emphasis on integrity and provenance assurances.
This control partially overlaps A.7.5.
Annex A 7.5 requires the organisation to define and document an end-to-end process for recording the provenance of data used in AI systems throughout data and AI system life cycles. ISM-2087 relates by requiring verification of the source and integrity of AI training data. ISM-2087 is narrower, focusing on training data, whereas Annex A 7.5 covers all AI-system data and ongoing provenance recording.
This control partially overlaps A.7.6.
Annex A 7.6 requires documented criteria for choosing data preparation methods prior to training or operating an AI system. ISM-2087 overlaps because verifying the source and integrity of training data commonly drives which preparation steps are selected (e.g. provenance checks, integrity validation, quarantine/cleaning rules) and should be captured in the Annex A 7.6 selection criteria. ISM-2087 is narrower and targeted to provenance/integrity assurance, whereas Annex A 7.6 covers broader preparation method selection beyond integrity (e.g. formatting, normalisation, labelling strategies).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.