Are there CIS-style security benchmarks for AI products?

The OWASP GenAI Security Project is worth a look. Its risk lists cover LLM and agentic systems, so they can help frame a review of what your organization is exposing.

That's different from a vendor-specific benchmark, though. A risk list won't necessarily tell you which switches to set in a particular admin console.

NIST has AI risk management guidance, but it isn't a technical configuration guide for each vendor's product. It may help with the governance side while you build a more specific baseline for the services you use.

For now, a practical route is to document your own baseline for each product and plan. Review identity integration, admin settings, connectors, and other integrations. Record what should be enabled, who owns it, and how new functionality gets reviewed.

Then use vendor announcements as a prompt to check whether the baseline or internal policies need updating. That's extra work, but it gives the team something concrete to check instead of relying on a generic framework alone.

One snag with a CIS-style guide is how fast these products change. A detailed setting-by-setting benchmark could get stale when a vendor adds or changes features. A broader framework may last longer, but it won't answer every console configuration question.