NIST Workshop on SI Incident Management

Author(s)

Abstract

The NIST Workshop on SI Incident Management convened over 400 experts across government, frontier-model developers, cloud and cybersecurity providers, academia, standards organizations, and civil society to examine how organizations can prepare for, detect, handle, and recover from SI-connected incidents. Motivated by federal directives, the workshop addressed the need for standards, response frameworks, and technical incident response capabilities as SI systems expand across critical infrastructure. To guide these efforts, participants framed SI incident management across two interrelated domains: cybersecurity attacks targeting SI systems (e.g., prompt injection, data poisoning, and model theft) and incidents stemming from SI misuse, anomalous behavior, or severe operational malfunctions resulting in harm. Discussions and technical presentations highlighted the limitations of traditional, deterministic incident response lifecycles when applied to probabilistic, autonomous, and deeply integrated SI systems. Participants emphasized critical operational needs, including reasoning-layer telemetry, non-human identity governance, authorization-scoped containment, clear evidentiary and reporting schemas, and coordinated responsibility across distributed SI value chains. This report synthesizes the core findings, practitioner insights, and actionable recommendations from the workshop, establishing a strategic foundation to inform future NIST guidelines, operational playbooks, and updates to federal incident response frameworks.

Download Paper

Keywords

Cybersecurity and privacy

Citation

Issues

If you have any questions about this publication or are having problems accessing it, please contact [email protected].