NIST SP 800-53 AI Audit Evidence: What an Assessor Reads Before the COSAiS Overlays Land

NIST launched the Control Overlays for Securing AI Systems project in July 2025 to adapt and supplement SP 800-53 for AI, published a concept paper on 14 August 2025 covering generative AI, predictive AI, and AI agent use cases, and released an annotated outline for the predictive AI overlay on 8 January 2026 with feedback due by 13 February. The first full draft overlay is still ahead.

Waiting for it is a mistake, and the reason is structural. Revision 5 organises its catalogue into 20 control families, and an AI system placed inside an authorisation boundary is assessed against the families that already exist. An assessor does not need an overlay to ask who called a model endpoint, what left the boundary in the prompt, and which record proves the answer. I want to walk the artifacts those questions require today, family by family, because the overlays will tighten expectations rather than create them.

AU: Audit and Accountability

The AU family covers event logging, audit record content, audit record retention, and protection of audit information from unauthorised modification or deletion. Applied to an AI system, the assessed question is whether the record of a model interaction is trustworthy.

The artifact is a record holding the caller, the transmitted prompt, the classification found in it, the destination endpoint and model version, the policy state that governed the decision, and the outcome, produced by a system the calling application has no custody over. Application-controlled logging fails AU's protection expectations on three counts: selective logging of the successful path, modification by the same component that failed, and loss on crash between the model response and the log commit. I set that out in You Own the AI Liability, Not the Vendor.

IA: Identification and Authentication

IA governs how users and devices prove identity before access is granted, and it complements AC. For AI traffic the assessed question narrows to which principal sent a specific request to a specific model.

The artifact is a per-request record binding a named user or agent to a prompt. Deployments that authenticate the user at the application and then call the model with one system-level API key satisfy IA at the front door and lose the identity one layer before the request leaves the boundary. Every downstream family inherits that loss, because an AU record without an identity column answers a different question than the one asked. The architecture is set out in identity-aware AI gateway design.

AC: Access Control

AC is the largest family in the catalogue, covering account management, least privilege, information flow enforcement, and the conditions under which access is granted. Information flow enforcement is the control most directly engaged by an AI request, since a prompt moves data from one security domain to another.

The artifact is a per-request policy decision record naming the role, the rule, and the outcome, with a fail-closed default so an ambiguous request is denied. An assessor treats a detection and a control as different answers, which is why a system that logs a policy violation after the prompt left produces a weaker finding than one that blocked it.

SC: System and Communications Protection

SC covers boundary protection and the monitoring and control of communications at external interfaces. A commercial model API is an external interface, and in most system security plans written before hosted models entered daily use it appears nowhere.

The artifact is a destination allowlist plus a destination log naming every model endpoint actually called during the assessment period. Reconciling those two is what surfaces endpoints nobody registered, which is the same reconciliation behind shadow AI discovery arriving under an SC heading.

SI: System and Information Integrity

SI covers flaw remediation, malicious code protection, and information input validation. Where a model's response feeds an automated process inside the boundary, that response is external input entering a trusted context.

The artifact is a response-side inspection and policy record joined to the request that produced it. A model provider's own safety documentation covers the provider's controls and stops at the API boundary, which leaves the receiving system's input validation unevidenced without a record on your side.

SR and PT: supply chain and personal information processing

SR asks who is in the chain, and a model provider joins it the moment data reaches its endpoint. PT governs personally identifiable information processing and transparency, which engages whenever a prompt carries personal data across the boundary. Both are answered by the same pair of artifacts: the destination log for the chain, and the per-request classification decision for what the traffic carried.

My candid view: the COSAiS overlays are the most useful thing NIST has in flight on AI security, and the drafting timeline has produced an unhelpful side effect. Teams are treating "the overlay is not final" as a reason to defer, when the AU, IA, AC, and SC evidence an overlay will assume already sits unmet in most AI deployments. Building the record first and mapping it to the overlay later costs less than the reverse, and I have not seen a version of the reverse that finished on time.

The evidence set

Six families, one store. The overlays will add AI-specific tailoring on top of exactly these rows.

DeepInspect

This is the evidence layer an 800-53 assessment reaches for when an AI system sits inside the boundary. DeepInspect sits inline between your users or agents and the LLM APIs they call. It evaluates identity, prompt classification, and destination on every request, enforces per-role and per-route policy with a fail-closed default, inspects the response before it returns, and writes a signed, tamper-evident record that the calling application never had custody of.

That record answers the AU, IA, AC, SC, SI, and SR questions from one query rather than from six systems and a reconciliation. When the COSAiS overlays arrive, the tailoring lands on records that already exist. The COSAiS overlay mapping covers how the draft overlays line up against a zero-trust gateway design. Book a technical deep dive at deepinspect.ai.