安全能力尽调清单Security Capability Due-Diligence Checklist
Security Capability Due-Diligence Checklist
把「你们安全做得怎么样」换成一组能核对的证据项，而不是形容词。Replaces "how good is your security?" with a set of evidence items you can actually check.
问证据不问声明：政策文件名与版本、上一次测试的报告编号与日期、事件记录与复盘、可独立验证的第三方材料。
骨架可以直接借公开框架：NIST 的 AI 风险管理框架自述用途是「更好地管理与个人、组织和社会相关的 AI 风险」，并把动作组织成 GOVERN、MAP、MEASURE、MANAGE 四个职能，逐格要求填证据。
风险项按清单而不是按印象问：OWASP 大模型应用 Top 10（官方源仓库，2026 版，条目编号 LLM01 至 LLM10，CC BY-SA 4.0 授权）适合当追问目录，逐项问「这条你们怎么防、怎么测、上次测是什么时候」。
条款层单独核对：能不能用输出训练模型、日志留存多久、子处理者清单、停服与降级时的数据取回路径，这些常在合同而不是在安全白皮书里。
拿不到证据的格子就记为未知，并写明缺什么。厂商未公开测试频率或事件响应口径时，「官方未说明」是合格答案，「大厂应该都做过了」不是。
Ask for artefacts, not adjectives: policy names with versions, report numbers and dates for the last test, incident records and reviews, and anything a third party can verify independently.
Public frameworks give you the grid. NIST's AI Risk Management Framework states its purpose as better managing risks to individuals, organisations and society associated with AI, and organises the work into GOVERN, MAP, MEASURE and MANAGE - each cell asking for evidence.
Walk the risk list rather than your gut. The OWASP Top 10 for LLM Applications (official source repository, 2026 edition, items LLM01 to LLM10, CC BY-SA 4.0) works as a question catalogue: for each entry, how do you defend it, how do you test it, and when was it last tested.
Check the contract layer separately: whether outputs may train models, how long logs and prompts are retained, the subprocessor list, and the data-retrieval path when service is suspended or degraded. Those live in terms, not in a security whitepaper.
Cells without evidence stay blank and marked unknown, with the missing item named. When a vendor does not publish testing frequency or incident-response commitments, "not stated officially" is an acceptable answer; "a big company must have done it" is not.
选型阶段没人核对证据，事故阶段就没有人可以回溯。清单的作用是让「我们很安全」这句话变成一列有名字、有日期、有负责人的东西，也让你提前知道哪几格是空的。If nobody collects evidence during selection, nobody can reconstruct it after an incident. The point of the list is to turn "we are secure" into a column of named artefacts, dates and owners - and to show you in advance which cells are empty.
安全尽调
回到名词地图看第6站的其他 34 个词 →Back to the map: the other 34 terms in station 6 →