ASD ISM 2091 Enforce resource limits for AI models
What it says
Resource limits are enforced for AI models.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAI models must have enforced resource limits to prevent excessive use.
Resource limits for AI models mean deliberately capping how much computational power or data an AI can use. This is important to stop AI from overloading systems, which could lead to crashing the server, slowing down operations, or incurring unexpected costs.
Free. Save your status, tasks and notes.
Why it matters
Without enforced AI resource limits, systems can crash, leading to downtime and increased costs due to uncontrolled processing demands.
How to implement
Managers should define clear resource allocation limits for AI models.
Determine how much computing power, memory, and data each AI model will be allowed to use. This involves understanding your organisation's overall capacity and ensuring individual use doesn't exceed it.
The IT team should monitor AI model performance and resource use.
Set up tools that can alert them if an AI model starts using more resources than allocated. This involves regular checking of system dashboards and setting alerts on unusual spikes.
Procurement officers should review AI software contracts.
Ensure that vendor agreements specify resource consumption limits and penalties for exceeding them. This includes negotiation terms aligned with expected operational needs and budget constraints.
System administrators should configure systems to enforce these limits.
Use software settings or external tools to automatically restrict AI models if they try to exceed their resources. Ensure these configurations are tested for effectiveness without affecting normal AI operations.
HR should train staff on the importance of adhering to AI resource limits.
Educate team members on how exceeding these can impact the business, using real-world scenarios. This ensures everyone understands the collective responsibility for maintaining these boundaries.
Keep it running
Regularly review AI resource usage logs to catch any breaches early and adjust limits as your operations grow and change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
documentation of resource limits: Request copies of the policies or guidelines outlining AI model resource allocations.
Look at
the specific numbers and conditions set for each model.
Good evidence
is clear documentation showing limits for power, memory, and data use.
- Check 2 of 5What an auditor asks for
Ask for
to see the monitoring system in action: Request a demonstration of how AI resource use is being watched.
Look at
systems in place that alert the team if limits are reached.
Good evidence
includes a working system that shows alerts or logs of past resource use issues.
- Check 3 of 5What an auditor asks for
Ask for
vendor contracts with AI providers: Request the contracts that were reviewed and signed when the AI tools were purchased. Check they clearly detail resource limits and associated penalties.
Good evidence
shows specific clauses addressing resource consumption.
- Check 4 of 5What an auditor asks for
Ask for
about recent training sessions: Request records of any recent staff training sessions regarding AI use.
Look at
attendance records and training materials used.
Good evidence
includes sign-in sheets and outlines of educational sessions on AI resource management.
- Check 5 of 5What an auditor asks for
Ask for
to review system configurations: Request access to the settings enforcing AI model resource limits. Inspect configurations or tools used to enforce these limits.
Good evidence
demonstrates restricted settings or the presence of third-party tools that cap resource use.
Mappings
Closest match in ISO/IEC 27001: A.8.6, Capacity management for resource use, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.6.
ISM-2091 requires organisations to enforce resource limits specifically for artificial intelligence models to prevent excessive consumption. ISO/IEC 27001:2022 Annex A 8.6 requires monitoring and adjusting resource use to meet current and expected capacity requirements, which can include setting quotas/limits for high-consumption workloads such as AI. Annex A 8.6 is broader (all ICT resource capacity), while ISM-2091 is a specific application focused on AI model resource limiting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.




