ASD ISM 2089Monitor AI Model Performance and Investigate Anomalies
Official control statement
AI model performance metrics are monitored and anomalies are investigated.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Keep track of AI model performance and check any unusual behaviours.
What this means in practice
This control is about continuously checking how well your AI systems are working and quickly digging into anything unusual. It matters because if you miss odd behaviour, you could end up with poor decisions, unhappy customers, or even legal issues if things go wrong.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Detective
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentTopic
Unbounded consumption
Why it matters
If AI performance issues are ignored, businesses risk making poor decisions, damaging customer trust, and facing legal trouble.
Operational notes
Regularly update your AI model monitoring processes to keep pace with changes in technology and business needs.
Implementation tips
- The IT team should regularly review AI model performance data. They should set up automated alerts to notify them of any unexpected changes in the model's outputs.
- Managers need to designate a specific staff member to investigate anomalies. They should ensure this person has a clear process for identifying and examining unusual model behaviour.
- System owners should define 'normal' performance metrics for their AI models. They should work with analysts to specify what variances from these norms require further investigation.
- The IT department should implement logging of AI model outputs. They should do this by using software that records each decision or prediction made by the AI for audit and troubleshooting.
- Business leaders should review anomaly reports with their IT team at regular intervals. This ensures that any identified issues are being timely addressed and lessons are learned for future prevention.
Audit / evidence tips
- AskAsk for the protocol or procedure that outlines the steps for monitoring AI model performance.Look atCheck whether it includes periodic reviews and anomaly checks, with clear roles and a defined frequency.GoodA detailed document with clear roles and review frequency, approved and signed by management.
- AskRequest logs of AI model decisions and predictions.Look atCheck for consistency in how these logs are maintained and whether anomalies are flagged within them.GoodOrganised logs showing regular entries and flagged anomalies.
- AskAsk for anomaly investigation reports.Look atConfirm each report includes a summary of findings and the actions taken.GoodA comprehensive report that outlines the incident, the investigation steps and the corrective actions.
- AskRequest the list of performance metrics used for AI models.Look atConfirm the metrics are tailored to the specific AI model's objectives and are reviewed over time.GoodMetrics that align with business goals and known risks, and are regularly updated.
- AskAsk about training materials for staff on handling AI anomalies.Look atLook for detailed roles and expected response times for investigating anomalies.GoodDocumented training sessions and attendance records demonstrating proactive education.
Cross-framework mappings
How ISM-2089 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 8.15 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies | |
| Annex A 8.16 | ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies in model behaviour or outputs | |
ISO 42001
| Control | Notes | Details |
|---|---|---|
extensionDepends on(1)expand_less | ||
| Annex A 6.2.8 | Annex A 6.2.8 requires enabling AI system event logging at defined lifecycle phases (at least during operational use) to ensure traceabil... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.