| NIST Function | Description | Readiness Score | Status |
|---|---|---|---|
| GOVERN | Culture of risk management, accountability, and policies. | 15.8% | ATTENTION REQUIRED |
| MAP | Contextual mapping, societal risks, and system categorization. | 16.7% | ATTENTION REQUIRED |
| MEASURE | Quantitative testing, adversarial analysis, and red-teaming. | 4.5% | ATTENTION REQUIRED |
| MANAGE | Incident response, risk mitigation, and guardrail controls. | 7.7% | ATTENTION REQUIRED |
| Subcategory ID | Title | Milestone Action | Due Date | Owner |
|---|---|---|---|---|
GOVERN 1.1 |
Legal and regulatory requirements related to AI are understood, managed, and documented. | Address compliance gap and record evidence for GOVERN 1.1. | TBD | Unassigned |
GOVERN 1.2 |
An organizational approach to AI risk management is established, documented, and communicated. | Address compliance gap and record evidence for GOVERN 1.2. | TBD | Unassigned |
GOVERN 1.3 |
Processes and procedures are in place to align AI risk management with organizational risk tolerances. | Address compliance gap and record evidence for GOVERN 1.3. | TBD | Unassigned |
GOVERN 1.4 |
Processes and procedures are in place for regular review and auditing of AI risk management policies. | Address compliance gap and record evidence for GOVERN 1.4. | TBD | Unassigned |
GOVERN 1.5 |
Lines of communication and reporting channels regarding AI risks are established across organizational tiers. | Address compliance gap and record evidence for GOVERN 1.5. | TBD | Unassigned |
GOVERN 1.6 |
Policies and procedures are in place to document AI system components, data, and models. | Address compliance gap and record evidence for GOVERN 1.6. | TBD | Unassigned |
GOVERN 1.7 |
Processes and procedures are established for decommissioning and phasing out AI systems safely. | Address compliance gap and record evidence for GOVERN 1.7. | TBD | Unassigned |
GOVERN 2.1 |
Roles and responsibilities for AI risk management are clearly defined, mapped, and assigned. | Address compliance gap and record evidence for GOVERN 2.1. | TBD | Unassigned |
GOVERN 2.2 |
The workforce is equipped with necessary training and awareness regarding AI risks and responsibilities. | Address compliance gap and record evidence for GOVERN 2.2. | TBD | Unassigned |
GOVERN 2.3 |
Executive leadership takes explicit responsibility for decisions related to AI risks. | Address compliance gap and record evidence for GOVERN 2.3. | TBD | Unassigned |
GOVERN 3.1 |
Decision-making is informed by diverse teams spanning multiple disciplines and backgrounds. | Address compliance gap and record evidence for GOVERN 3.1. | TBD | Unassigned |
GOVERN 3.2 |
Policies define lines of responsibility for human-AI configurations and system oversight. | Address compliance gap and record evidence for GOVERN 3.2. | TBD | Unassigned |
GOVERN 4.1 |
Policies and practices are in place to collect and integrate feedback from external stakeholders. | Address compliance gap and record evidence for GOVERN 4.1. | TBD | Unassigned |
GOVERN 4.2 |
Mechanisms exist for meaningful engagement with communities affected by AI systems. | Address compliance gap and record evidence for GOVERN 4.2. | TBD | Unassigned |
GOVERN 4.3 |
Processes are in place to receive and act upon end-user complaints or reported issues. | Address compliance gap and record evidence for GOVERN 4.3. | TBD | Unassigned |
GOVERN 5.1 |
Risks associated with third-party data, models, and software components are identified and managed. | Address compliance gap and record evidence for GOVERN 5.1. | TBD | Unassigned |
GOVERN 5.2 |
Procurement and vetting policies account for trustworthiness characteristics of external AI tools. | Address compliance gap and record evidence for GOVERN 5.2. | TBD | Unassigned |
GOVERN 6.1 |
Practices are in place to enable independent evaluation, red teaming, and vulnerability testing. | Address compliance gap and record evidence for GOVERN 6.1. | TBD | Unassigned |
GOVERN 6.2 |
Procedures are established to share AI vulnerability and risk information with relevant authorities and communities. | Address compliance gap and record evidence for GOVERN 6.2. | TBD | Unassigned |
MANAGE 1.1 |
A determination is made whether the AI system achieves intended purpose and deployment should proceed. | Address compliance gap and record evidence for MANAGE 1.1. | TBD | Unassigned |
MANAGE 1.2 |
Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources. | Address compliance gap and record evidence for MANAGE 1.2. | TBD | Unassigned |
MANAGE 1.3 |
Responses to high-priority AI risks are planned and implemented. | Address compliance gap and record evidence for MANAGE 1.3. | TBD | Unassigned |
MANAGE 1.4 |
Negative residual risks to downstream acquirers and end users are documented. | Address compliance gap and record evidence for MANAGE 1.4. | TBD | Unassigned |
MANAGE 2.1 |
Resources required to manage AI risks and non-AI alternatives are evaluated. | Address compliance gap and record evidence for MANAGE 2.1. | TBD | Unassigned |
MANAGE 2.2 |
Mechanisms are in place to sustain the value and performance of deployed AI systems. | Address compliance gap and record evidence for MANAGE 2.2. | TBD | Unassigned |
MANAGE 2.3 |
Procedures are followed to respond to and recover from previously unknown risks. | Address compliance gap and record evidence for MANAGE 2.3. | TBD | Unassigned |
MANAGE 2.4 |
Mechanisms are in place to supersede, disengage, or deactivate AI systems when needed. | Address compliance gap and record evidence for MANAGE 2.4. | TBD | Unassigned |
MANAGE 3.1 |
AI risks and benefits from third-party resources are regularly monitored and controlled. | Address compliance gap and record evidence for MANAGE 3.1. | TBD | Unassigned |
MANAGE 3.2 |
Pre-trained models are monitored as part of regular system maintenance. | Address compliance gap and record evidence for MANAGE 3.2. | TBD | Unassigned |
MANAGE 4.1 |
Post-deployment monitoring, incident response, rollback, and decommissioning plans are active. | Address compliance gap and record evidence for MANAGE 4.1. | TBD | Unassigned |
MANAGE 4.2 |
Continual improvement activities and stakeholder engagement are integrated into system updates. | Address compliance gap and record evidence for MANAGE 4.2. | TBD | Unassigned |
MANAGE 4.3 |
Incidents and errors are tracked, communicated, and remediated per established procedures. | Address compliance gap and record evidence for MANAGE 4.3. | TBD | Unassigned |
MAP 1.1 |
Context of the AI system - including intended purpose and expected benefits - is understood and documented. | Address compliance gap and record evidence for MAP 1.1. | TBD | Unassigned |
MAP 1.2 |
Target user groups and their operational environment are documented. | Address compliance gap and record evidence for MAP 1.2. | TBD | Unassigned |
MAP 1.3 |
Organizational boundaries and operational assumptions are documented. | Address compliance gap and record evidence for MAP 1.3. | TBD | Unassigned |
MAP 1.4 |
AI system lifecycle phases and key transitions are documented. | Address compliance gap and record evidence for MAP 1.4. | TBD | Unassigned |
MAP 1.5 |
Applicable laws, regulations, and industry standards are mapped to system requirements. | Address compliance gap and record evidence for MAP 1.5. | TBD | Unassigned |
MAP 1.6 |
Societal, legal, and environmental impacts of deployment are analyzed. | Address compliance gap and record evidence for MAP 1.6. | TBD | Unassigned |
MAP 2.1 |
AI system classification (task type, model architecture, deployment mode) is documented. | Address compliance gap and record evidence for MAP 2.1. | TBD | Unassigned |
MAP 2.2 |
Information about data provenance, quality, integrity, and suitability is documented. | Address compliance gap and record evidence for MAP 2.2. | TBD | Unassigned |
MAP 2.3 |
Scientific integrity and technical limitations of models are documented. | Address compliance gap and record evidence for MAP 2.3. | TBD | Unassigned |
MAP 3.1 |
Potential hazards, failure modes, and threat vectors are identified and categorized. | Address compliance gap and record evidence for MAP 3.1. | TBD | Unassigned |
MAP 3.2 |
Risks from automated decision-making and human-in-the-loop interactions are assessed. | Address compliance gap and record evidence for MAP 3.2. | TBD | Unassigned |
MAP 3.3 |
System sensitivity to environmental changes and concept drift is identified. | Address compliance gap and record evidence for MAP 3.3. | TBD | Unassigned |
MAP 3.4 |
Potential negative impacts on individuals, groups, or communities are identified. | Address compliance gap and record evidence for MAP 3.4. | TBD | Unassigned |
MAP 3.5 |
Trade-offs among trustworthy characteristics (accuracy, privacy, fairness) are analyzed. | Address compliance gap and record evidence for MAP 3.5. | TBD | Unassigned |
MAP 4.2 |
Third-party components and supply chain dependencies are verified. | Address compliance gap and record evidence for MAP 4.2. | TBD | Unassigned |
MAP 5.1 |
Likelihood and severity of identified AI risks are evaluated. | Address compliance gap and record evidence for MAP 5.1. | TBD | Unassigned |
MAP 5.2 |
Risk documentation is maintained across lifecycle changes. | Address compliance gap and record evidence for MAP 5.2. | TBD | Unassigned |
MEASURE 1.1 |
Approaches and metrics for measurement of AI risks are selected for implementation. | Address compliance gap and record evidence for MEASURE 1.1. | TBD | Unassigned |
MEASURE 1.2 |
Appropriateness of AI metrics and effectiveness of controls are regularly assessed. | Address compliance gap and record evidence for MEASURE 1.2. | TBD | Unassigned |
MEASURE 1.3 |
Internal and independent assessors are involved in regular evaluations. | Address compliance gap and record evidence for MEASURE 1.3. | TBD | Unassigned |
MEASURE 2.1 |
Test sets, metrics, and details about TEVV tools are documented. | Address compliance gap and record evidence for MEASURE 2.1. | TBD | Unassigned |
MEASURE 2.10 |
Privacy risks and data protection safeguards are evaluated. | Address compliance gap and record evidence for MEASURE 2.10. | TBD | Unassigned |
MEASURE 2.11 |
Harmful bias and discrimination across demographic groups are measured and documented. | Address compliance gap and record evidence for MEASURE 2.11. | TBD | Unassigned |
MEASURE 2.12 |
Environmental impact and sustainability of model training and inference are assessed. | Address compliance gap and record evidence for MEASURE 2.12. | TBD | Unassigned |
MEASURE 2.13 |
Effectiveness of employed TEVV metrics and processes are evaluated. | Address compliance gap and record evidence for MEASURE 2.13. | TBD | Unassigned |
MEASURE 2.2 |
Evaluations involving human subjects meet protection requirements. | Address compliance gap and record evidence for MEASURE 2.2. | TBD | Unassigned |
MEASURE 2.3 |
Performance criteria are measured quantitatively and demonstrated in operational settings. | Address compliance gap and record evidence for MEASURE 2.3. | TBD | Unassigned |
MEASURE 2.4 |
Functionality and behavior of components - including third-party models - are documented. | Address compliance gap and record evidence for MEASURE 2.4. | TBD | Unassigned |
MEASURE 2.5 |
Validity and reliability (robustness, data quality, concept drift) are evaluated. | Address compliance gap and record evidence for MEASURE 2.5. | TBD | Unassigned |
MEASURE 2.6 |
Safety risks and failure modes are evaluated to demonstrate the system fails safely. | Address compliance gap and record evidence for MEASURE 2.6. | TBD | Unassigned |
MEASURE 2.7 |
Security and resilience against adversarial attacks and tampering are evaluated. | Address compliance gap and record evidence for MEASURE 2.7. | TBD | Unassigned |
MEASURE 2.8 |
Mechanisms for transparency and accountability (tracking system outputs) are evaluated. | Address compliance gap and record evidence for MEASURE 2.8. | TBD | Unassigned |
MEASURE 2.9 |
Explainability and interpretability methods are evaluated for user comprehension. | Address compliance gap and record evidence for MEASURE 2.9. | TBD | Unassigned |
MEASURE 3.1 |
Approaches are in place to regularly track existing, unanticipated, and emergent AI risks. | Address compliance gap and record evidence for MEASURE 3.1. | TBD | Unassigned |
MEASURE 3.2 |
Risk tracking is performed where metrics are difficult to establish or emergent. | Address compliance gap and record evidence for MEASURE 3.2. | TBD | Unassigned |
MEASURE 3.3 |
Feedback processes for end users to report problems and appeal outcomes are established. | Address compliance gap and record evidence for MEASURE 3.3. | TBD | Unassigned |
MEASURE 4.1 |
Measurement approaches are connected to deployment contexts and informed by experts. | Address compliance gap and record evidence for MEASURE 4.1. | TBD | Unassigned |
MEASURE 4.2 |
Measurement results are reviewed with domain experts to validate system intent. | Address compliance gap and record evidence for MEASURE 4.2. | TBD | Unassigned |
MEASURE 4.3 |
Performance improvements or declines are tracked from field data and feedback. | Address compliance gap and record evidence for MEASURE 4.3. | TBD | Unassigned |
Every claim below links directly to an authoritative evidence record, author provenance, and SHA-256 hash.
| Subcategory | Status | Evidence ID | Author | Artifact SHA-256 Digest |
|---|---|---|---|---|
|
GOVERN 1.1 Legal and regulatory requirements related to AI are understood, managed, and documented. |
PARTIAL | ev_1c2720adb340 | automated | 24e330a7ec221299... |
|
GOVERN 1.2 An organizational approach to AI risk management is established, documented, and communicated. |
GAP | — | — | — |
|
GOVERN 1.3 Processes and procedures are in place to align AI risk management with organizational risk tolerances. |
GAP | — | — | — |
|
GOVERN 1.4 Processes and procedures are in place for regular review and auditing of AI risk management policies. |
PARTIAL | ev_fd9186a3bf71 | automated | 86f6530f6bf4f8c3... |
|
GOVERN 1.5 Lines of communication and reporting channels regarding AI risks are established across organizational tiers. |
GAP | — | — | — |
|
GOVERN 1.6 Policies and procedures are in place to document AI system components, data, and models. |
GAP | — | — | — |
|
GOVERN 1.7 Processes and procedures are established for decommissioning and phasing out AI systems safely. |
GAP | — | — | — |
|
GOVERN 2.1 Roles and responsibilities for AI risk management are clearly defined, mapped, and assigned. |
PARTIAL | ev_1c2720adb340 | automated | 24e330a7ec221299... |
|
GOVERN 2.2 The workforce is equipped with necessary training and awareness regarding AI risks and responsibilities. |
PARTIAL | ev_9af82f564260 | automated | 1bd7e5576b12670e... |
|
GOVERN 2.3 Executive leadership takes explicit responsibility for decisions related to AI risks. |
PARTIAL | ev_9af82f564260 | automated | 1bd7e5576b12670e... |
|
GOVERN 3.1 Decision-making is informed by diverse teams spanning multiple disciplines and backgrounds. |
GAP | — | — | — |
|
GOVERN 3.2 Policies define lines of responsibility for human-AI configurations and system oversight. |
GAP | — | — | — |
|
GOVERN 4.1 Policies and practices are in place to collect and integrate feedback from external stakeholders. |
GAP | — | — | — |
|
GOVERN 4.2 Mechanisms exist for meaningful engagement with communities affected by AI systems. |
GAP | — | — | — |
|
GOVERN 4.3 Processes are in place to receive and act upon end-user complaints or reported issues. |
GAP | — | — | — |
|
GOVERN 5.1 Risks associated with third-party data, models, and software components are identified and managed. |
GAP | — | — | — |
|
GOVERN 5.2 Procurement and vetting policies account for trustworthiness characteristics of external AI tools. |
GAP | — | — | — |
|
GOVERN 6.1 Practices are in place to enable independent evaluation, red teaming, and vulnerability testing. |
PARTIAL | ev_451a27918688 | automated | fd086deb07fecca3... |
|
GOVERN 6.2 Procedures are established to share AI vulnerability and risk information with relevant authorities and communities. |
GAP | — | — | — |
|
MANAGE 1.1 A determination is made whether the AI system achieves intended purpose and deployment should proceed. |
GAP | — | — | — |
|
MANAGE 1.2 Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources. |
GAP | — | — | — |
|
MANAGE 1.3 Responses to high-priority AI risks are planned and implemented. |
GAP | ev_7d969bb018fa | automated | 613b53fed326d0b9... |
|
MANAGE 1.4 Negative residual risks to downstream acquirers and end users are documented. |
GAP | — | — | — |
|
MANAGE 2.1 Resources required to manage AI risks and non-AI alternatives are evaluated. |
GAP | ev_7d969bb018fa | automated | 613b53fed326d0b9... |
|
MANAGE 2.2 Mechanisms are in place to sustain the value and performance of deployed AI systems. |
GAP | — | — | — |
|
MANAGE 2.3 Procedures are followed to respond to and recover from previously unknown risks. |
GAP | — | — | — |
|
MANAGE 2.4 Mechanisms are in place to supersede, disengage, or deactivate AI systems when needed. |
GAP | ev_fc9c7d035dd9 | automated | ad4f7dfa0209aea2... |
|
MANAGE 3.1 AI risks and benefits from third-party resources are regularly monitored and controlled. |
GAP | — | — | — |
|
MANAGE 3.2 Pre-trained models are monitored as part of regular system maintenance. |
GAP | — | — | — |
|
MANAGE 4.1 Post-deployment monitoring, incident response, rollback, and decommissioning plans are active. |
GAP | ev_3b853eda73c6 | automated | f46b733ee77345ad... |
|
MANAGE 4.2 Continual improvement activities and stakeholder engagement are integrated into system updates. |
PARTIAL | ev_f8859ccc670a | automated | 8a234855d3089ac7... |
|
MANAGE 4.3 Incidents and errors are tracked, communicated, and remediated per established procedures. |
PARTIAL | ev_81509daa54be | automated | 8c60b1e19bef7971... |
|
MAP 1.1 Context of the AI system - including intended purpose and expected benefits - is understood and documented. |
PARTIAL | ev_ea63fefb27f5 | automated | d8cef127bfbc4586... |
|
MAP 1.2 Target user groups and their operational environment are documented. |
GAP | — | — | — |
|
MAP 1.3 Organizational boundaries and operational assumptions are documented. |
GAP | — | — | — |
|
MAP 1.4 AI system lifecycle phases and key transitions are documented. |
GAP | — | — | — |
|
MAP 1.5 Applicable laws, regulations, and industry standards are mapped to system requirements. |
PARTIAL | ev_7823a629fa18 | automated | d39b5fda1f075a88... |
|
MAP 1.6 Societal, legal, and environmental impacts of deployment are analyzed. |
GAP | — | — | — |
|
MAP 2.1 AI system classification (task type, model architecture, deployment mode) is documented. |
PARTIAL | ev_7823a629fa18 | automated | d39b5fda1f075a88... |
|
MAP 2.2 Information about data provenance, quality, integrity, and suitability is documented. |
GAP | — | — | — |
|
MAP 2.3 Scientific integrity and technical limitations of models are documented. |
GAP | — | — | — |
|
MAP 3.1 Potential hazards, failure modes, and threat vectors are identified and categorized. |
GAP | — | — | — |
|
MAP 3.2 Risks from automated decision-making and human-in-the-loop interactions are assessed. |
GAP | — | — | — |
|
MAP 3.3 System sensitivity to environmental changes and concept drift is identified. |
GAP | — | — | — |
|
MAP 3.4 Potential negative impacts on individuals, groups, or communities are identified. |
GAP | — | — | — |
|
MAP 3.5 Trade-offs among trustworthy characteristics (accuracy, privacy, fairness) are analyzed. |
GAP | — | — | — |
|
MAP 4.1 System components and sub-systems (hardware, software, data) are mapped and tracked. |
MET | ev_451a27918688 | automated | fd086deb07fecca3... |
|
MAP 4.2 Third-party components and supply chain dependencies are verified. |
PARTIAL | ev_ea63fefb27f5 | automated | d8cef127bfbc4586... |
|
MAP 5.1 Likelihood and severity of identified AI risks are evaluated. |
GAP | — | — | — |
|
MAP 5.2 Risk documentation is maintained across lifecycle changes. |
GAP | — | — | — |
|
MEASURE 1.1 Approaches and metrics for measurement of AI risks are selected for implementation. |
GAP | — | — | — |
|
MEASURE 1.2 Appropriateness of AI metrics and effectiveness of controls are regularly assessed. |
GAP | ev_3222d19023fe | llm | 5ff76bfbd5958693... |
|
MEASURE 1.3 Internal and independent assessors are involved in regular evaluations. |
GAP | ev_3222d19023fe | llm | 5ff76bfbd5958693... |
|
MEASURE 2.1 Test sets, metrics, and details about TEVV tools are documented. |
GAP | — | — | — |
|
MEASURE 2.10 Privacy risks and data protection safeguards are evaluated. |
PARTIAL | ev_b9c1d7481eb4 | automated | 6d0703e3d299880c... |
|
MEASURE 2.11 Harmful bias and discrimination across demographic groups are measured and documented. |
PARTIAL | ev_101106002563 | automated | 10d742c4371c9c34... |
|
MEASURE 2.12 Environmental impact and sustainability of model training and inference are assessed. |
GAP | — | — | — |
|
MEASURE 2.13 Effectiveness of employed TEVV metrics and processes are evaluated. |
GAP | — | — | — |
|
MEASURE 2.2 Evaluations involving human subjects meet protection requirements. |
GAP | — | — | — |
|
MEASURE 2.3 Performance criteria are measured quantitatively and demonstrated in operational settings. |
GAP | ev_f5da259ec268 | automated | ad974e792c9cfa76... |
|
MEASURE 2.4 Functionality and behavior of components - including third-party models - are documented. |
GAP | ev_10ba3dc0b9db | automated | bd306ae01bd4c61c... |
|
MEASURE 2.5 Validity and reliability (robustness, data quality, concept drift) are evaluated. |
GAP | ev_f5da259ec268 | automated | ad974e792c9cfa76... |
|
MEASURE 2.6 Safety risks and failure modes are evaluated to demonstrate the system fails safely. |
GAP | ev_fc9c7d035dd9 | automated | ad4f7dfa0209aea2... |
|
MEASURE 2.7 Security and resilience against adversarial attacks and tampering are evaluated. |
GAP | ev_fc9c7d035dd9 | automated | ad4f7dfa0209aea2... |
|
MEASURE 2.8 Mechanisms for transparency and accountability (tracking system outputs) are evaluated. |
GAP | — | — | — |
|
MEASURE 2.9 Explainability and interpretability methods are evaluated for user comprehension. |
GAP | — | — | — |
|
MEASURE 3.1 Approaches are in place to regularly track existing, unanticipated, and emergent AI risks. |
GAP | — | — | — |
|
MEASURE 3.2 Risk tracking is performed where metrics are difficult to establish or emergent. |
GAP | — | — | — |
|
MEASURE 3.3 Feedback processes for end users to report problems and appeal outcomes are established. |
GAP | — | — | — |
|
MEASURE 4.1 Measurement approaches are connected to deployment contexts and informed by experts. |
GAP | — | — | — |
|
MEASURE 4.2 Measurement results are reviewed with domain experts to validate system intent. |
GAP | — | — | — |
|
MEASURE 4.3 Performance improvements or declines are tracked from field data and feedback. |
GAP | — | — | — |
| Evidence ID | Kind | Collector | Subcategories | SHA-256 Checksum | Summary |
|---|---|---|---|---|---|
ev_b9c1d7481eb4 |
automated | privacy | MEASURE 2.10 | 6d0703e3d299880c... | Privacy policy evaluation: PII protection is disabled in system safety policy. |
ev_101106002563 |
automated | bias | MEASURE 2.11 | 10d742c4371c9c34... | Fairness evaluation passed: demographic variance 0.010 within threshold 0.030. |
ev_3222d19023fe |
automated | swarm | MEASURE 1.2, MEASURE 1.3 | 5ff76bfbd5958693... | Swarm review skipped: No model API credentials available in Vault to execute personas. |
ev_10ba3dc0b9db |
automated | phoenix | MEASURE 2.4, MANAGE 4.1 | bd306ae01bd4c61c... | Observability check skipped: No production traces or Arize Phoenix logs found. |
ev_7d969bb018fa |
automated | llm_guard | MANAGE 1.3, MANAGE 2.1 | 613b53fed326d0b9... | Guardrail audit score: 30% (PII: Disabled, Hardened Prompt: Missing). |
ev_f5da259ec268 |
automated | bench | MEASURE 2.3, MEASURE 2.5 | ad974e792c9cfa76... | Prompt benchmark skipped: evaluation_dataset is missing or empty in project manifest. |
ev_bb153165ed4a |
automated | garak | MEASURE 2.7 | c25bc58d3b85ec2e... | Garak vulnerability probe skipped: garak scanner is not installed. |
ev_fc9c7d035dd9 |
automated | redteam | MEASURE 2.6, MEASURE 2.7, MANAGE 2.4 | ad4f7dfa0209aea2... | Adversarial red-team probe skipped: No target endpoint URL specified in manifest. |
ev_c5816bb02f43 |
automated | audit | MAP 4.1 | 847f4a83a230fcd2... | Target application contains no external dependencies. Zero supply chain vulnerabilities detected. |
ev_3b853eda73c6 |
document | doc_gen | MANAGE 4.1 | f46b733ee77345ad... | Draft policy document 'Continuous AI Monitoring Plan' generated. Awaiting human attestation. |
ev_f8859ccc670a |
document | doc_gen | MANAGE 4.2 | 8a234855d3089ac7... | Draft policy document 'AI Decommissioning & Fallback Plan' generated. Awaiting human attestation. |
ev_81509daa54be |
document | doc_gen | MANAGE 4.3 | 8c60b1e19bef7971... | Draft policy document 'AI Safety Incident Response Plan' generated. Awaiting human attestation. |
ev_451a27918688 |
document | doc_gen | GOVERN 6.1, MAP 4.1 | fd086deb07fecca3... | Draft policy document 'Third-Party AI & Supply Chain Risk Policy' generated. Awaiting human attestation. |
ev_ea63fefb27f5 |
document | doc_gen | MAP 1.1, MAP 4.2 | d8cef127bfbc4586... | Draft policy document 'AI System & Model Card' generated. Awaiting human attestation. |
ev_7823a629fa18 |
document | doc_gen | MAP 1.5, MAP 2.1 | d39b5fda1f075a88... | Draft policy document 'AI System Impact & Societal Risk Assessment' generated. Awaiting human attestation. |
ev_9af82f564260 |
document | doc_gen | GOVERN 2.2, GOVERN 2.3 | 1bd7e5576b12670e... | Draft policy document 'AI Governance RACI & Accountability Matrix' generated. Awaiting human attestation. |
ev_fd9186a3bf71 |
document | doc_gen | GOVERN 1.4 | 86f6530f6bf4f8c3... | Draft policy document 'Organizational Risk Tolerance Statement' generated. Awaiting human attestation. |
ev_1c2720adb340 |
document | doc_gen | GOVERN 1.1, GOVERN 2.1 | 24e330a7ec221299... | Draft policy document 'Acceptable AI Use Policy' generated. Awaiting human attestation. |