Controls/Monitoring & Response/10.3
L1 EssentialManual verification

10.3 Kill Switch

10. Monitoring & ResponseHow do we detect and respond?

Description

Agents MUST have an immediate termination capability that requires no agent cooperation.

Rationale

When an agent is compromised, rapid termination is essential to limit damage.

Audit Procedure

1. Verify kill switch exists
2. Test kill switch can terminate agent
3. Verify it works without agent cooperation

Remediation

1. Implement out-of-band kill switch
2. Ensure no agent cooperation required
3. Document and test procedure

Framework Mappings

CIS Control 17.1NIST RS.RP-1