33 docs tagged with "Artifact"

The AI system being governed: purpose, limitations, versions, interfaces and links to system/model cards.

Organisational and technical boundaries of the ISMS or AIMS, including systems, activities, sites, suppliers and exclusions.

Statement of which controls apply, are excluded, or are treated—the Statement of Applicability.

Review of organizational policy and conformance.

Planned internal audit of the AIMS: scope, cadence, auditor independence, schedule and follow-up.

Capabilities are the features or elements of useful behaviour provided by a sensitive activity.

What is communicated about the management system, to whom, when, through which channel, and with what evidence.

Evidence that a role has the required skill, qualification and training, with expiry.

Technology-specific, threat-informed security controls for protecting information systems.

A nonconformity and the containment, root cause, action, owner, due date, effectiveness test and closure that follow.

A data resource used by an AI system, with ownership, purpose, sensitivity, rights, provenance and quality.

Prevention or remediation based on assessment findings.

The results of evaluating a control's assessment requirements.

Allocated responsibilities between the organisation and a supplier, provider or customer for an AI system or service.

An asset, system, facility, service or process the ISMS governs, with classification and ownership.

High-level guidance on cybersecurity measures from industry groups and standards bodies.

Assessment of consequences of an AI system on individuals, groups and society, feeding risk treatment.

A security or AI event the management system must classify, decide on, communicate and learn from.

A measurable management-system objective with target, measure, owner, period and result.

A recorded review of the management system by top management: inputs, decisions and resulting actions.

Internal and external issues, objectives and jurisdictions that frame the ISMS or AIMS.

People and organisations that govern, are interested in, or are affected by a governed activity, and the role they hold.

Risk-informed guidance tailored to your organization's specific needs and risk appetite.

Foundational values that guide governance, design, and operational decisions.

A required report about the AIMS or an AI system: trigger, recipient, content, deadline, owner and evidence.

Organizational risk categories, severity levels, and risk appetite definitions.

A versioned assessment of risk: criteria, method, likelihood, consequence, residual and review trigger.

Actions that might introduce risk—the hinge between definition and measurement.

A requirement an interested party places on the management system, with provenance into guidance, control, risk and policy.

Assurance over a supplier contributing AI systems, services or resources: obligations, attestations, versions, risk and evidence.

A specifically-scoped opportunity for a negative impact to the organization.

A tool, platform or compute dependency used to develop, operate or evaluate an AI system.

Attack vectors and techniques used to compromise information systems.