NIST Plans AI Security Control Overlays for Predictive, Generative and Agentic Systems

The National Institute of Standards and Technology (NIST) is developing five volumes of Control Overlays for Super Intelligence Systems (COSIS) guidance to adapt existing SP 800-53 controls for artificial intelligence systems. The planned overlays address predictive, generative and agentic AI, reflecting the different security and privacy considerations that can arise as federal agencies use AI to analyze information, generate content or take actions through automated processes. NIST plans to release the methodology and predictive-systems volumes in fall 2026; the source does not provide release dates for the other volumes.

For federal procurement teams, the effort offers a prospective reference for translating established security and privacy control practices into AI-specific acquisition and implementation considerations. Agencies may draw on the overlays when developing requirements, evaluating proposed safeguards or assessing how an AI solution fits within existing risk-management approaches. The guidance remains in development, however, and the available information does not establish a new government-wide mandate. Procurement officials and contractors should distinguish planned guidance from binding solicitation terms, agency policy or contract requirements.

Contractors supporting federal AI adoption can use the development period to inventory how their current security and privacy practices map to the control areas that NIST is adapting. That preparation may help companies explain their approach to protecting AI systems, managing implementation risks and supporting agency reviews. Because the overlays are intended to be tailored by agencies, a single mapping should not be treated as universally sufficient: teams will need to check each customer’s requirements, system context and implementation expectations as guidance and agency practices develop.

The procurement signal is therefore one of early planning rather than an immediate compliance deadline. Contractors can monitor NIST’s release of the methodology and predictive-systems volumes, then assess how the material affects relevant offerings and proposal practices. Agencies, in turn, may use the forthcoming documents as an input to their own AI security decisions. Until final guidance and agency-specific direction are available, vendors should avoid representing COSIS as a finalized control set or claiming that it automatically determines compliance for every federal AI deployment.

• NIST is developing five volumes of COSIS guidance for AI-related security and privacy practices.
• COSIS adapts existing SP 800-53 controls rather than being described as a wholly separate control framework.
• The planned coverage includes predictive, generative and agentic AI systems.
• NIST plans to release the methodology and predictive-systems volumes in fall 2026.
• The source does not specify release timing for the remaining volumes.
• Federal contractors can map existing security and privacy practices to the planned AI-focused controls as an early-readiness activity.
• Procurement teams may use the overlays as a reference when shaping AI security requirements or evaluating contractor approaches.
• The guidance is in development, not identified as a new mandatory requirement.
• Agencies may tailor controls, so contractors should plan for customer-specific implementation and avoid assuming one approach fits every procurement.
• Monitor NIST releases and review future solicitations and agency direction before treating COSIS provisions as contract obligations.