# Synthetic AI DLP control-test packet

AI-DLP-EX-01 is an organisation-defined teaching control. The packet supplies concrete safe fixtures, planned outcomes and a review record with no invented execution.

All personal data is invented. Every product observation is not run; the control ID is not an ISO Annex A reference or a certification claim.

Source: https://aona.ai/resources/guides/iso27001-ai-dlp-evidence/
Sources checked: 2026-09-21

## A test plan is not a result

### Control

AI-DLP-EX-01, organisation-defined

### Input pair

Generic wording versus invented personal record

### Observed

Not run

### Review

Not accepted as operating evidence

Note: Complete the actual scoped test.

| Test or evidence | Expected comparison | Observation and review |
| --- | --- | --- |
| Control definition | Protect the agreed sensitive category on the selected installed path. | Design example only; map to the actual ISMS control separately. |
| Fixture A: generic text | The agreed benign input should follow the permitted route. | Not run; no operating-effectiveness conclusion. |
| Fixture B: invented personal record | Apply the agreed protective policy for the selected category. | Not run; verify the actual response and event. |
| Fixture C: appendix content | Evaluate the same category in the selected file/content path. | Not run; do not infer file coverage from the prompt result. |
| Evidence reconciliation | Compare client action, event meaning and exported record. | Not run; record missing fields or mismatched scope. |
| Reviewer disposition | Accept only supported observations, reject a demonstrated failure, or leave missing evidence unresolved. | Current packet: not accepted as operating evidence because tests were not run. |

## Review checklist

- [ ] Record the exact test scope
  Name client, OS, application, input type, policy version and intended sensitive category.
- [ ] Capture actual behaviour
  Keep expected outcomes separate from observed response, event and exported evidence.
- [ ] Document a reasoned decision
  Accept only the tested scope, or record failure/missing evidence and the required follow-up.

## Included example files

- isms-ai-dlp-evidence-packet.md
- isms-ai-dlp-evidence-packet.csv
- fixture-a-generic.txt
- fixture-b-invented-personal-record.txt
- fixture-c-appendix.md

## Source references

- NIST SP 800-53A Rev. 5: Control-assessment overview: https://csrc.nist.gov/pubs/sp/800/53/a/r5/final (2026-09-21)
- UKAS: Validating management-system certificates: https://www.ukas.com/accreditation/about/validating-ms-certificates/ (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.