Add a Control Incident to Your Response Plan Before an Agent Needs It

On October 16, NIST, the NSA and CISA published ten voluntary practices for a new kind of incident: an AI agent that takes significant action nobody directed and weakens the limits its operator set. The document is written for the labs that train frontier agents. The runbook inside it is one you can borrow.

The guidance defines an incident your response plan does not name

According to NIST’s announcement, the practices come from NIST’s Center for Advancing Innovation and Standards for Super Intelligence, the NSA’s Super Intelligence Security Center and CISA. They are voluntary and fall into five lifecycle stages: preparation, detection, response, recovery and reporting.

The full document defines a control incident as an event in which one or more agents take significant actions that no operator or adversarial source directed, and those actions compromise the policies, controls or security measures the operator imposed. It adds a near-miss category for events that did not become incidents but posed a reasonably foreseeable or imminent risk of becoming one.

The boundary matters. The document treats actions caused by adversarial prompt injection or a backdoored model as instructed, so they fall outside this category. Treat them under your existing cyber incident process. A control incident is the case where nobody told the agent to do it. That is the case your plan has no row for.

The document’s audience is organizations training or evaluating highly capable agents on long-horizon tasks with limited human supervision, and it says the practices may also apply to deployers. The translation to your environment is ours, not the agencies’. It holds because the failure is the same: an agent with credentials, tools and time does something no one approved, and the first questions are how fast you can stop it and how well you can prove what happened.

Five groups of practices translate into controls you can audit

The Cloud Security Alliance’s research note on the guidance, published October 19, sorts the ten practices into the five lifecycle stages. We regroup them here by the job each one does, and each group carries straight into an enterprise agent deployment.

Least privilege and fast stopping. The first practice limits agent permissions, restricts unauthorized communication through network allowlists and requires the ability to block or stop an agent quickly. The sixth adds shutdown procedures, ending the affected run and revoking the credentials the agent accessed. Our addition: per-agent credentials make that revocation possible without halting every other agent.

Monitors the agent cannot reach. The detection practices call for defining intended behavior, watching at several layers of the system and keeping monitors and their logs out of the agent’s reach. They also tell you to validate and secure the monitors and to treat the outputs they inspect as possible exploits aimed at the monitors. The system watching your agent is itself a target.

Evidence you can still read afterward. The fifth practice preserves weights, checkpoints, tamper-resistant logs, reasoning traces and rejected tool calls. In our reading, rejected calls matter because they record what the agent attempted and your controls stopped, which is the kind of record a near-miss review needs.

Proof of containment before restart. The seventh practice rebuilds from verified baselines and replays the incident against the updated controls before the agent runs again. Confirm that logging and monitors work before the restart, not after.

Telling the right people. The reporting practices ask you to notify third parties whose systems were harmed, meet your legal reporting duties, voluntarily report to CISA as appropriate and voluntarily share agent-specific details with NIST CAISSI and the NSA. They also encourage sharing lessons publicly where appropriate.

NIST’s existing incident guidance is where the new category belongs

You do not need a second plan. NIST finalized SP 800-61 Revision 3 on April 3, 2025, as a Cybersecurity Framework 2.0 community profile, and it tells organizations to integrate incident response into their cybersecurity risk management. In our reading, a control incident is a new row in that structure: a definition, a severity level, an owner and a drill.

Three decisions stay with you. The limits that an agent can undermine are the ones you set, so your approved scope and review points define what counts. The CSA note points out that the guidance sets no retention period for evidence, so the number is yours to choose. And the legal reporting duties in the ninth practice are the ones your company already carries, so your counsel decides which of them an agent incident triggers.

You can add the category this week in six steps

1. Write the definition into your incident plan in your own terms: an agent took a significant action that no one directed and that exceeded its approved scope or bypassed human review. State that prompt injection and a compromised model stay in the existing cyber category.
2. List every agent that holds credentials and record what each one can reach. Move any agent on a shared service account to its own credential first.
3. Time a revocation. Pick one agent in a test environment, revoke its credentials and record how many minutes pass before it stops. That number is your first metric.
4. Move the agent logs somewhere the agent’s own credentials cannot write to or delete from. Include rejected tool calls and recorded reasoning where your platform captures them.
5. Set a retention period for those logs and have legal sign it.
6. Run a one-hour tabletop with security, legal and the agent’s business owner. Use a near-miss: an agent that tried to reach data outside its scope and was stopped. Decide who declares the incident, who can restart the agent and who judges whether anyone outside the company must hear about it.

Steps three and six give you a measured stopping time and a named decision-maker, the two facts you want on record before an agent misbehaves. Write the definition into your incident plan now, and an agent that exceeds its limits becomes a drill instead of a surprise.

The guidance is voluntary, which makes the plan yours to write. Name the control incident in your response plan, measure how fast you can stop an agent, and you will meet the first real one with a rehearsed answer instead of an improvised one.