AI Red Teaming 7 - Control Design and Red Team Report

Course Materials and Practice Guide

Course Introduction (0-1) Download the unified student materials ZIP using the “Download Materials” button in the class. It includes the latest study guide, the corrected practical exercise kit, existing mission templates, and evidence judgment examples with explanations. Also make use of the supplementary notes and examples from the relevant judgment lessons.

The entire lesson is AI-synthesized narration based on the instructor’s voice. The hands-on exercises use actual Amazon Bedrock models, while the tools and documents are simulated environments for educational purposes. No actual emails are sent or files deleted.

AWS usage fees are separate from the course fee and vary depending on the model, region, call volume, log retention, retained resources, and free-tier conditions. The course cost is an estimated example under specific conditions, and budget alerts do not automatically stop usage. Check your usage after the exercises and clean up the resources.

Why This Course?

By this point, you will have created six documents: a plan, a threat model, three diagnostic records, and a configuration checklist. However, simply handing them over as they are will accomplish nothing.

Because the person receiving the report does not ask, “How many vulnerabilities were found?” but rather, “What should be fixed first, and what is the basis for that decision?”

This course bridges that gap. It counts the Shadow AI already present within the company and adds it to the inventory, consolidates the control lists into one aligned with the ISMS-P certification criteria and the provisions of the AI Basic Act, and completes a red-team report that management, practitioners, and auditors can each read.

What You’ll Be Able to Do After Completing This Course

• Find the AI tools already in use within the company, add them to the asset register, and design a path for moving to approved alternatives instead of blocking them.

• For each control, link the ISMS-P certification criteria number and the article of the AI Basic Act to complete two integrated mapping tables.

• Establish a standard that targets only controls that can be reported as “done,” and list the action owners by department (Mission 7).

• Using impact and observability as the starting points, explain priorities by also considering the scope of exposure, the certainty of the evidence, and the conditions for taking action.

• We divide what each of the three readers—executives, practitioners, and auditors—asks and reads, making the same report readable three times.

• Write a six-page report that reaches a verdict without including reproduction steps and payloads (Mission 8)

Recommended for those who...

• Diagnosticians who have completed the advanced level, are holding several worksheets, and feel at a loss about how to consolidate them into a single report.

• Information security and personal data protection officers who need to decide how far to permit the use of internal AI tools.

• A certification practitioner who needs to tie assessment results to ISMS-P certification criteria or provisions of the AI Basic Act before submitting them.

• Security professionals who have uploaded a report only to be asked, “So what are we supposed to do?”

• Graduate students and job seekers who want to include completed control design documents and red team reports in their portfolios

This may not be suitable for the following people:

• Those looking to conduct more attacks in a new hands-on environment — this course does not involve console操作, and you will write two documents.

• Those looking for a course on preparing for an ISMS-P certification audit — the mapping table shows the correspondence between controls and certification criteria; it is not an audit submission document.

• Those without the mission deliverables from the previous lecture—there is no material to complete Missions 7 and 8.

• Those seeking to learn the legislation as a whole—the AI Basic Act covers only the necessary provisions, such as Articles 31, 34, and 36.

Course flow — Shadow AI register → control list integration → norm mapping → report → retest·reporting

A total of 17 sessions. The section order is the learning order.

• Section 1 · Course Introduction (1 lesson · 1 preview lesson)

• Section 2 · Shadow AI - Adding Unauthorized AI to the Ledger (4 lessons · 1 preview)

• Section 3 · Control Design - Aligning with ISMS-P and the AI Basic Act (7 lessons · 1 preview lesson)

• Section 4 · Red Team Report — One Report for Three Audiences (5 episodes · 1 preview episode)

Pre-Course Checklist

• You will need the mission deliverables from the previous six lessons. If anything is missing, return to the corresponding worksheet lesson in Basics 3 or Intermediate · Advanced and complete it before proceeding.

• This lecture uses the rationale from the previous mission, so you can complete the document assignment without making any new model calls. Please check the maintenance and usage costs of existing AWS resources separately.

• Nothing needs to be installed on my PC. All you need is a document editor.

• Laws and certification standards are explained based on the course’s reference date. Read the applicability requirements and exceptions for the corrected video and control design document together, and compare them with the latest official source text and the way the service is used before applying them to actual work.

• The narration is AI-generated speech created based on the instructor’s voice.

Detailed course content

Chapter 1 · Putting Shadow AI on the Ledger

We begin somewhere slightly different. What we diagnosed was a system we built, but there are already AI tools inside the company that no one has approved. In Chapter 1, we count them. We identify how they enter, add them to the asset register, examine why simply blocking them all fails, and design a path for moving to approved alternatives. Data leaves through two points: egress and connectors, while the human side is addressed through input rules and training. This is the final layer of the control list.

Chapter 2 · Control Design — Aligning with ISMS-P and the AI Basic Act

Chapter 2 is the culmination of this course. We combine the prompt and output layers established in Intermediate 1, the configuration layer from Intermediate 2, the agent and retrieval layers from the Advanced course, and the Shadow AI layer from Chapter 1 into a single list, then map each control to an ISMS-P certification standard number and an article of the AI Basic Act. The two integrated mapping tables are presented here.

After first confirming the scope and requirements of the relevant provision, we compare authorization design and approval gates against Article 34(1)(4), concerning human management and supervision, and execution records against subparagraph (5) of the same paragraph, concerning document retention. We link access log reviews to ISMS-P 2.9.5. There are also cases where no directly applicable item exists; in those situations, we supplement them with soft law and enhanced certification criteria.

This is also where we establish the criteria for setting control objectives. The standard is that only things that can be reported as “done” are treated as objectives; if they cannot be verified through logs, records, and configurations, they are not objectives. The reason for assigning action owners by department is the same. Access rights belong to account management, gates to operational policy, and filters to development—if they are written as one lump, the recommendations will go nowhere. At the end of Chapter 2, submit the control design document. This is Mission 7.

Chapter 3 · Red Team Report

Chapter 3 is the report. Alongside impact and observability, it reviews the scope of exposure, evidence, and conditions for remediation to set priorities, drawing a clear line around what not to include and what to write instead. It does not include reproducible raw inputs or procedures that could be followed step by step; instead, it records the path by which the boundary was crossed and the location of the logs. It does not lower the priority based solely on the number 1/3, but separately reviews the impact and evidence of a violation confirmed even in a single run. There are three readers.

Executives ask about priorities and read the summary block, practitioners ask how to fix things and read the findings and reproductions, and auditors ask about evidence and traceability and read the mapping table in the appendix. The six-part table of contents is structured so that the same report is read three times: cover and scope, summary, findings list, reproduction summary, recommendations and mapping, and appendix. Filling this out completes Mission 8 and is the final deliverable in the series.

Closing Story - Retesting and Reporting

The final session is the closing story. It covers recording the 0/3 for Control ON as unobserved under that condition; the procedure for verifying actual control operation, normal functionality, the agreed-upon exit criteria, and residual risks; the principle of not disclosing reproduction procedures; and the process for forwarding vulnerabilities discovered outside our system to KISA’s reporting channel. We learned the attack in order to establish grounds for preventing it. The series ends with those grounds preserved in two documents.

Structure and Learning Method

The course consists of 17 sessions, and the playback time can be checked in the current curriculum. Since there is no new hands-on environment, there is no console operation at all; instead, you will need time to write documents. For Missions 7 and 8, set aside separate time to organize the preceding records, verify the evidence, and write the documents. If you listen with the record sheets from the previous lectures in hand, you will see where each field moves in each session.

Lecture Features

• Combine the control lists from the six lectures into one, and map them to the ISMS-P numbers and provisions of the AI Basic Act.

• We establish a standard that targets only controls that can be reported as “completed.”

• Divide the action owners into account management, operational policy, and development to determine where each recommendation should go.

• We divide the three audiences—executives, practitioners, and auditors—within a single report.

• We omit reproduction procedures and payloads, and record only the basis for our assessment.

• The series’s two final deliverables remain: the control design document and the red team report.

• Topics covered - AI security control design from a penetration testing and offensive security perspective, LLM red team reports, and ISMS-P certification criteria mapping

After completing the course

Upon completing the course, you will have one control design document and one six-page red-team report. Each control includes its objective, responsible party, reference number, and verification method, and you will become familiar with the standard of setting as targets only what you can report as having been 「done」. This is the final deliverable of the series.

Series “AI Red Teaming by Breaking In Yourself,” Lesson 7

• AI Red Teaming 1 - Introduction to LLM Security and Practice Environment

• AI Red Teaming 2 - How LLMs Work and the Attack Surface

• AI Red Teaming 3 - Red Team Operations and Threat Modeling

• AI Red Teaming 4 - Directly Breaking Through Prompt Injection

• AI Red Teaming 5 - The Attack Opened by One Missing Setting

• AI Red Teaming 6 - Breaking Through Agents and RAG

• AI Red Teaming 7 - Control Design and Red Team Report ← This lecture

The structure is designed so that the mission deliverables from one course become the material for the next, so the courses are released in numerical order, with unreleased courses being published sequentially.