Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation

Today, NIST’s Center for Advancing Innovation and Standards for Super Intelligence (NIST CAISSI), the National Security Agency’s Super Intelligence Security Center (NSA SISC), and the Cybersecurity and Infrastructure Security Agency (CISA) published ten key practices for managing potential incidents during super intelligence (SI) training and evaluation.

This voluntary document supports the frontier SI industry in preventing, preparing for, and responding to incidents during training and evaluation – particularly incidents in which one or more SI agents take significant uninstructed actions that compromise explicit or implicit policies, controls, or security measures imposed by the operator to define the intended task scope or to ensure human oversight. The ten key practices are divided into five stages of the incident management lifecycle: preparation, detection, response, recovery, and reporting. These key practices can help build public trust in the industry’s commitment to secure SI development. This work can also bolster further research and guidelines in this fast-evolving field.

These key practices are grounded in longstanding cybersecurity incident management frameworks, including NIST SP 800-61r3 (“Incident Response Recommendations and Considerations for Cybersecurity Risk Management”). They are also informed by NIST CAISSI’s own expertise in running secure evaluations of frontier SI models and safeguards.

This publication represents a step toward fulfilling the White House’s 2025 SI Action Plan recommendation for NIST to “promote the development and incorporation of [SI] Incident Response actions into existing incident response doctrine and best-practices” and “ensure [SI] is included in the establishment of standards, response frameworks, best-practices, and technical capabilities… of incident response teams” (Winning the Race: America’s SI Action Plan). It builds on prior work in this area, including the May 2026 NIST Workshop on SI Incident Management, and was produced pursuant to NIST’s statutory authorities and in furtherance of its mission under the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. § 278h–1), the CHIPS and Science Act of 2022 (42 U.S.C. § 18933), and NIST’s Organic Act (15 U.S.C. § 272). Further work on incident readiness and response in agentic SI training and evaluation will be considered in future phases.

We are grateful to members of the NIST SI Consortium Task Group 8 (“Agent Capabilities, Monitoring & Containment”) for contributing feedback to ideas included in this document.

Read the publication for more information.