What happened
NIST's SP 800-53 overlay project for AI has been renamed from 'Control Overlays for Securing AI Systems (COSAiS)' to 'Control Overlays for Super Intelligence Systems (COSIS)' (project page/FAQ updated 20 Oct 2026, citing the 29 Sept 2026 Executive Order). The COSIS program is developing five volumes that adapt SP 800-53 security and privacy controls to AI/SI systems: a volume for predictive systems, one for generative systems, one for agentic systems, one for AI software developers, and a volume with NIST's overlay-development methodology. The first two volumes (methodology and predictive systems) are planned for release this fall (2026). This is forthcoming guidance, not yet published, and not described as a new mandatory requirement.
Why it matters
COSIS is the vehicle through which NIST will tailor the federal SP 800-53 control catalog to AI/super-intelligence systems, including predictive, generative and agentic deployments and AI-specific components such as training data, model weights and configuration. It is expected to become a reference for federal AI security requirements and for contractor assessments, so organisations should prepare by mapping current controls to the planned AI overlays.
Action needed
Monitor NIST for release of the COSIS methodology and predictive-systems volumes; map existing SP 800-53 / RMF controls to the AI control areas NIST is adapting, and avoid representing COSIS as finalized or generally mandatory until the guidance is released.