{"id":"AIBD-0705","title":"Mexico's Superior Audit Office finds that an AI service built on Eviden's AIsaac reduced risk events at CFE in 2022","summary":"Mexico's Superior Audit Office checked reports from CFE's AIsaac-based security service and found that AI correlation of events reduced risk events in 2022. It gave no count.","date_observed":"2022-01-01","date_basis":"event","date_precision":"year","benefit_status":"reported","source_collection":null,"source_entry":null,"account":"Mexico's state-owned electricity company, the Comisión Federal de Electricidad (CFE), buys a managed detection and response service for itself and its subsidiaries and affiliates. Two Mexican firms supply it under a contract from 24 February 2021 to 31 December 2024. The supplier's staff operate the AIsaac tool from Eviden, part of Atos Group. Its threat analysis combines machine learning with human threat hunters. It can contain incidents that machine-learning algorithms find, even automatically. It also includes an event correlator that detects known threats with rules. CFE paid 107,525.0 thousand pesos for the service in 2022. In an audit concluded on 13 October 2023, the Auditoría Superior de la Federación reviewed the service for 2022. The auditors validated reports and graphs from the tool and found that AI correlation of events and real-time analysis had reduced risk events. They also found that the service gave CFE centralized monitoring of cybersecurity. The auditors give no number of risk events before or after. They found that CFE lacked procedures for forensic evidence and its chain of custody, and they issued a recommendation.","category":"protective response","unexpected":false,"purpose":"Eviden (Atos Group) built the AIsaac platform to detect cyber threats and respond to incidents. CFE's suppliers run it as a managed service to strengthen the cybersecurity of CFE's technology.","system":"Solución Avanzada de Detección de Amenazas y Respuesta por Inteligencia Artificial, Managed Detection and Response (MDR), delivered with Eviden's AIsaac tool","model_version":null,"developer":"Eviden (Atos Group), maker of AIsaac. The service is supplied under contract 800961753 by Teliko Solutions, S.A.P.I. de C.V. and Grupo Vanguardia en Información y Conocimiento, S.A. de C.V.","deployer":"Comisión Federal de Electricidad (CFE), corporate office, with its subsidiaries and affiliates","location":"Mexico","domain":"Cybersecurity","segment":null,"benefit_type":"Reduced Risk","work_activities":["4.A.1.a.2","4.A.2.a.4"],"taxonomy_note":null,"registry_ids":{},"ratings":[{"group":"organizational","depth":null,"reason":"The auditors found that risk events fell but gave no count of the events or of any harm avoided."}],"ai_role":{"status":"unassessed","statement":"The auditors credit the reduction to AI correlation of events and real-time analysis, but they give no figures. They do not separate the machine-learning features from the correlator that uses rules or from the supplier's threat hunters."},"evidence":[{"kind":"audit report","citation":"Auditoría Superior de la Federación. Informe Individual del Resultado de la Fiscalización Superior de la Cuenta Pública 2022. CFE Corporativo, Auditoría de Cumplimiento a Tecnologías de Información y Comunicaciones 2022-6-90UJB-20-0040-2023 (Auditoría núm. 40), Resultado 5. Opinion issued 13 October 2023.","title":"Auditoría de Cumplimiento a Tecnologías de Información y Comunicaciones: 2022-6-90UJB-20-0040-2023","url":"https://www.asf.gob.mx/Trans/Informes/IR2022b/Documentos/Auditorias/2022_0040_a.pdf","date":"2023-10-13","written_by":"independent","quote":"a partir de la validación de reportes y gráficos obtenidos de la herramienta, se acreditó que se han reducido los eventos de riesgo mediante la correlación de eventos y análisis en tiempo real por medio de inteligencia artificial; sin embargo, existen deficiencias en los controles relacionados con la gestión de incidentes de ciberseguridad"}],"replication":{"produced_by":["The supplier's staff operated the AIsaac tool for CFE as a managed service.","The service monitored security events in the public cloud, on the internet, at the network perimeter, in inbound and outbound traffic and in possible lateral movements."],"must_hold":["CFE must validate the service's deliverables and reports.","Incident handling needs procedures for extracting forensic evidence and keeping its chain of custody."],"echoes":[]},"paired_incident":null,"headline":"Mexican auditors find fewer cyber risk events at CFE with *AIsaac*","metric":null,"comparator":null,"later":null,"value":null,"developer_country":"France","deployer_country":"Mexico","unrated_because":"The auditors found that risk events fell but gave no figure for the reduction or for any harm avoided.","brief_notes":null,"brief":null,"revisions":[{"date":"2026-10-31","change":"Added the record from the finding of the Auditoría Superior de la Federación.","source":"https://www.asf.gob.mx/Trans/Informes/IR2022b/Documentos/Auditorias/2022_0040_a.pdf","editor":"AIBD"}],"confidence":"found","shade":"high","claim_status":"Found by an auditor","claim_basis":"Sources: one independent audit report. The cited evidence includes no independent study or report.","case_jurisdictions":["Mexico"],"profile":{"case_id":"AIBD-0705","catalog_version":"1.0.0","source_fingerprint":"61c01c177e0dfa4f559130246c2f66e7728e4b85fab4736a48ca1e399cb8eb03","collection_refs":[{"collection_id":"aibd","version":"2026-10-31"},{"collection_id":"querist","version":"2026-10-25"},{"collection_id":"viator","version":"2026-10-25"},{"collection_id":"adyt","version":"2026-10-25"}],"source_ids":["AIBD-0705-source-0001"],"families":{"strategic assessments":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"Editorial assignment.","review_state":"not_assessed","coverage":"partial","record_ids":[]},"evaluations":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"Editorial assignment.","review_state":"not_assessed","coverage":"partial","record_ids":[]},"monetary observations":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"Editorial assignment.","review_state":"not_assessed","coverage":"partial","record_ids":[]},"institutional decisions":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"Editorial assignment.","review_state":"not_assessed","coverage":"partial","record_ids":[]}},"fields":{"actors[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"developer":"Eviden (Atos Group), maker of AIsaac. The service is supplied under contract 800961753 by Teliko Solutions, S.A.P.I. de C.V. and Grupo Vanguardia en Información y Conocimiento, S.A. de C.V.","deployer":"Comisión Federal de Electricidad (CFE), corporate office, with its subsidiaries and affiliates"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["developer","deployer"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"actors[].ownership_control":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"ai_contribution":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"ai_relationship":{"state":"value_present","value":{"kind":"record_fields","fields":{"category":"protective response","ai_role":{"status":"unassessed","statement":"The auditors credit the reduction to AI correlation of events and real-time analysis, but they give no figures. They do not separate the machine-learning features from the correlator that uses rules or from the supplier's threat hunters."}}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["ai_role","category"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"assessments[].alternatives":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"assessments[].assessor_date":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"assessments[].depth":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"assessments[].display_confidence":{"state":"value_present","value":{"kind":"structured","data":{"confidence":"high","evidence_word":"found","claim_status":"Found by an auditor","basis":"Sources: one independent audit report. The cited evidence includes no independent study or report.","interpretation":"Existing display rule preserved; the richer outcome-specific confidence question still needs review."}},"provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"assessments[].rationale":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","reason":"The auditors found that risk events fell but gave no count of the events or of any harm avoided."}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["ratings"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"assessments[].rubric_version":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"assessments[].status_basis":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"assessments[].target":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","reason":"The auditors found that risk events fell but gave no count of the events or of any harm avoided."}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["ratings"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"availability":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"brief":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"case_kind":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"case_links[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"claims[].evidence_links":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"claims[].evidence_strength":{"state":"value_present","value":{"kind":"structured","data":{"answer":"Found by an auditor. Sources: one independent audit report. The cited evidence includes no independent study or report.","evidence_word":"found","claim_status":"Found by an auditor"}},"provenance":{"kind":"source_review","basis":"Editorial assignment.","record_fields":["evidence"],"source_refs":["AIBD-0705-source-0001"],"reviewed_on":"2026-10-29"},"review_state":"reviewed","coverage":"complete","display":{"answer":"Found by an auditor. Sources: one independent audit report. The cited evidence includes no independent study or report.","inferred":false}},"claims[].missingness":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"claims[].proposition":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"cross_border_flows[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"decisions[].action_outcome":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"institutional decisions"},"decisions[].grounds":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"institutional decisions"},"decisions[].institution_task":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"institutional decisions"},"decisions[].success_criterion":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"institutional decisions"},"deployment_stage":{"state":"value_present","value":{"kind":"structured","data":{"classification":"routine use","answer":"The system was in routine use. CFE used the service throughout 2022 under a contract that runs from February 2021 to December 2024.","scope":"The period and activity described in the case."}},"provenance":{"kind":"source_review","basis":"Editorial assignment.","record_fields":["account","evidence"],"source_refs":["AIBD-0705-source-0001"],"reviewed_on":"2026-10-29"},"review_state":"reviewed","coverage":"complete","display":{"answer":"The system was in routine use. CFE used the service throughout 2022 under a contract that runs from February 2021 to December 2024.","inferred":false}},"economics[].amount":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].costs[]":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].counterfactual":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].currency_price_basis":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].gross_net":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].measure_type":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].period_unit":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].realization":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].recipient_payer":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].return_payback":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"economics[].valuation_method":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"monetary observations"},"evaluations[].ai_uplift":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].comparator":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].design":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].effect":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].exposure":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].id":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].measurement_method":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].metric":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].reproduction_materials":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].setting_sample":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"evaluations[].uncertainty_limitations":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"evaluations"},"external_references[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"follow_up[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"human_oversight":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"id":{"state":"value_present","value":{"kind":"record_fields","fields":{"id":"AIBD-0705"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["id"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"infrastructure_dependencies[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].beneficiaries":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].beneficiary_count":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].benefit_type":{"state":"value_present","value":{"kind":"record_fields","fields":{"benefit_type":"Reduced Risk"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["benefit_type"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"outcomes[].claim":{"state":"value_present","value":{"kind":"record_fields","fields":{"account":"Mexico's state-owned electricity company, the Comisión Federal de Electricidad (CFE), buys a managed detection and response service for itself and its subsidiaries and affiliates. Two Mexican firms supply it under a contract from 24 February 2021 to 31 December 2024. The supplier's staff operate the AIsaac tool from Eviden, part of Atos Group. Its threat analysis combines machine learning with human threat hunters. It can contain incidents that machine-learning algorithms find, even automatically. It also includes an event correlator that detects known threats with rules. CFE paid 107,525.0 thousand pesos for the service in 2022. In an audit concluded on 13 October 2023, the Auditoría Superior de la Federación reviewed the service for 2022. The auditors validated reports and graphs from the tool and found that AI correlation of events and real-time analysis had reduced risk events. They also found that the service gave CFE centralized monitoring of cybersecurity. The auditors give no number of risk events before or after. They found that CFE lacked procedures for forensic evidence and its chain of custody, and they issued a recommendation.","benefit_type":"Reduced Risk"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["account","benefit_type"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"outcomes[].distribution":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].duration":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].id":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].stakeholder_group":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","reason":"The auditors found that risk events fell but gave no count of the events or of any harm avoided."}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["ratings"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"outcomes[].status":{"state":"value_present","value":{"kind":"record_fields","fields":{"benefit_status":"reported"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["benefit_status"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"outcomes[].tradeoffs":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"outcomes[].unexpected":{"state":"value_present","value":{"kind":"record_fields","fields":{"unexpected":false,"purpose":"Eviden (Atos Group) built the AIsaac platform to detect cyber threats and respond to incidents. CFE's suppliers run it as a managed service to strengthen the cybersecurity of CFE's technology."}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["unexpected","purpose"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"places[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"location":"Mexico","developer_country":"France","deployer_country":"Mexico"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["location","developer_country","deployer_country"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"purpose":{"state":"value_present","value":{"kind":"record_fields","fields":{"purpose":"Eviden (Atos Group) built the AIsaac platform to detect cyber threats and respond to incidents. CFE's suppliers run it as a managed service to strengthen the cybersecurity of CFE's technology."}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["purpose"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"record_dates":{"state":"value_present","value":{"kind":"record_fields","fields":{"date_observed":"2022-01-01","date_basis":"event","date_precision":"year","revisions":[{"date":"2026-10-31","change":"Added the record from the finding of the Auditoría Superior de la Federación.","source":"https://www.asf.gob.mx/Trans/Informes/IR2022b/Documentos/Auditorias/2022_0040_a.pdf","editor":"AIBD"}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["date_observed","date_basis","date_precision","revisions"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"replication.attempts[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"replication.conditions":{"state":"value_present","value":{"kind":"record_fields","fields":{"replication":{"produced_by":["The supplier's staff operated the AIsaac tool for CFE as a managed service.","The service monitored security events in the public cloud, on the internet, at the network perimeter, in inbound and outbound traffic and in possible lateral movements."],"must_hold":["CFE must validate the service's deliverables and reports.","Incident handling needs procedures for extracting forensic evidence and keeping its chain of custody."],"echoes":[]}}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["replication"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"revision_history[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"revisions":[{"date":"2026-10-31","change":"Added the record from the finding of the Auditoría Superior de la Federación.","source":"https://www.asf.gob.mx/Trans/Informes/IR2022b/Documentos/Auditorias/2022_0040_a.pdf","editor":"AIBD"}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["revisions"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"sector":{"state":"value_present","value":{"kind":"record_fields","fields":{"domain":"Cybersecurity"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["domain"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"sources[].access_version":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"sources[].citation_locator":{"state":"value_present","value":{"kind":"record_fields","fields":{"evidence":[{"kind":"audit report","citation":"Auditoría Superior de la Federación. Informe Individual del Resultado de la Fiscalización Superior de la Cuenta Pública 2022. CFE Corporativo, Auditoría de Cumplimiento a Tecnologías de Información y Comunicaciones 2022-6-90UJB-20-0040-2023 (Auditoría núm. 40), Resultado 5. Opinion issued 13 October 2023.","title":"Auditoría de Cumplimiento a Tecnologías de Información y Comunicaciones: 2022-6-90UJB-20-0040-2023","url":"https://www.asf.gob.mx/Trans/Informes/IR2022b/Documentos/Auditorias/2022_0040_a.pdf","date":"2023-10-13","written_by":"independent","quote":"a partir de la validación de reportes y gráficos obtenidos de la herramienta, se acreditó que se han reducido los eventos de riesgo mediante la correlación de eventos y análisis en tiempo real por medio de inteligencia artificial; sin embargo, existen deficiencias en los controles relacionados con la gestión de incidentes de ciberseguridad"}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["evidence"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"sources[].id":{"state":"value_present","value":{"kind":"identifiers","identifiers":["AIBD-0705-source-0001"],"role":"Existing evidence items, in their original order"},"provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"review_state":"record_mapped","coverage":"complete"},"sources[].language":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"sources[].relationship":{"state":"value_present","value":{"kind":"record_fields","fields":{"evidence":[{"kind":"audit report","citation":"Auditoría Superior de la Federación. Informe Individual del Resultado de la Fiscalización Superior de la Cuenta Pública 2022. CFE Corporativo, Auditoría de Cumplimiento a Tecnologías de Información y Comunicaciones 2022-6-90UJB-20-0040-2023 (Auditoría núm. 40), Resultado 5. Opinion issued 13 October 2023.","title":"Auditoría de Cumplimiento a Tecnologías de Información y Comunicaciones: 2022-6-90UJB-20-0040-2023","url":"https://www.asf.gob.mx/Trans/Informes/IR2022b/Documentos/Auditorias/2022_0040_a.pdf","date":"2023-10-13","written_by":"independent","quote":"a partir de la validación de reportes y gráficos obtenidos de la herramienta, se acreditó que se han reducido los eventos de riesgo mediante la correlación de eventos y análisis en tiempo real por medio de inteligencia artificial; sin embargo, existen deficiencias en los controles relacionados con la gestión de incidentes de ciberseguridad"}]}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["evidence"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"sources[].upstream_sources":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"strategic_assessments[]":{"state":"unresolved","review_state":"not_assessed","coverage":"partial","family":"strategic assessments"},"summary":{"state":"value_present","value":{"kind":"record_fields","fields":{"summary":"Mexico's Superior Audit Office checked reports from CFE's AIsaac-based security service and found that AI correlation of events reduced risk events in 2022. It gave no count.","account":"Mexico's state-owned electricity company, the Comisión Federal de Electricidad (CFE), buys a managed detection and response service for itself and its subsidiaries and affiliates. Two Mexican firms supply it under a contract from 24 February 2021 to 31 December 2024. The supplier's staff operate the AIsaac tool from Eviden, part of Atos Group. Its threat analysis combines machine learning with human threat hunters. It can contain incidents that machine-learning algorithms find, even automatically. It also includes an event correlator that detects known threats with rules. CFE paid 107,525.0 thousand pesos for the service in 2022. In an audit concluded on 13 October 2023, the Auditoría Superior de la Federación reviewed the service for 2022. The auditors validated reports and graphs from the tool and found that AI correlation of events and real-time analysis had reduced risk events. They also found that the service gave CFE centralized monitoring of cybersecurity. The auditors give no number of risk events before or after. They found that CFE lacked procedures for forensic evidence and its chain of custody, and they issued a recommendation."}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["summary","account"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"systems[].autonomy_permissions":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"systems[].component_role":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"systems[].deployment_configuration":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"systems[].inputs_outputs":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"systems[].model_name":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"systems[].model_version":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"systems[].product_name":{"state":"value_present","value":{"kind":"record_fields","fields":{"system":"Solución Avanzada de Detección de Amenazas y Respuesta por Inteligencia Artificial, Managed Detection and Response (MDR), delivered with Eviden's AIsaac tool"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["system"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"systems[].provider":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"taxonomy_crosswalks[]":{"state":"unresolved","provenance":{"kind":"curatorial","basis":"Editorial assignment.","record_fields":[],"source_refs":[]},"reason":"This is an explicit unresolved assignment: the sources on record do not settle this question.","review_state":"not_assessed","coverage":"partial"},"title":{"state":"value_present","value":{"kind":"record_fields","fields":{"title":"Mexico's Superior Audit Office finds that an AI service built on Eviden's AIsaac reduced risk events at CFE in 2022","headline":"Mexican auditors find fewer cyber risk events at CFE with *AIsaac*"}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["title","headline"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"},"version":{"state":"value_present","value":{"kind":"identifiers","identifiers":["e2053e0be813f2ad3b2103d9820655a660e35b85cc3b6b39d8115c897bdd74cd"],"role":"SHA-256 of the complete public record and its assessments"},"provenance":{"kind":"curatorial","basis":"SHA-256 of the public record, its assessments, and its displayed answers and notes, excluding its own identifier and the derived coverage summary.","record_fields":[],"source_refs":[]},"review_state":"record_mapped","coverage":"complete"},"workflow":{"state":"value_present","value":{"kind":"record_fields","fields":{"account":"Mexico's state-owned electricity company, the Comisión Federal de Electricidad (CFE), buys a managed detection and response service for itself and its subsidiaries and affiliates. Two Mexican firms supply it under a contract from 24 February 2021 to 31 December 2024. The supplier's staff operate the AIsaac tool from Eviden, part of Atos Group. Its threat analysis combines machine learning with human threat hunters. It can contain incidents that machine-learning algorithms find, even automatically. It also includes an event correlator that detects known threats with rules. CFE paid 107,525.0 thousand pesos for the service in 2022. In an audit concluded on 13 October 2023, the Auditoría Superior de la Federación reviewed the service for 2022. The auditors validated reports and graphs from the tool and found that AI correlation of events and real-time analysis had reduced risk events. They also found that the service gave CFE centralized monitoring of cybersecurity. The auditors give no number of risk events before or after. They found that CFE lacked procedures for forensic evidence and its chain of custody, and they issued a recommendation.","replication":{"produced_by":["The supplier's staff operated the AIsaac tool for CFE as a managed service.","The service monitored security events in the public cloud, on the internet, at the network perimeter, in inbound and outbound traffic and in possible lateral movements."],"must_hold":["CFE must validate the service's deliverables and reports.","Incident handling needs procedures for extracting forensic evidence and keeping its chain of custody."],"echoes":[]}}},"provenance":{"kind":"legacy_record","basis":"Editorial assignment.","record_fields":["account","replication"],"source_refs":[]},"review_state":"record_mapped","coverage":"partial"}},"summary":{"total":91,"addressed":91,"known":27,"reviewed":2,"reviewed_complete":2,"reviewed_partial":0,"record_mapped":25,"review_not_assessed":64,"not_assessed":0,"complete":false,"by_state":{"value_present":27,"not_reported":0,"unresolved":64,"not_assessed":0,"not_applicable":0,"withheld":0,"source_unavailable":0}}},"presentation_version":"2100454bfb2856febc1bf57bc92643ba72cab2e2683d81222e7975ad57859814"}