-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathassessment-schema.yaml
More file actions
247 lines (227 loc) · 9.65 KB
/
Copy pathassessment-schema.yaml
File metadata and controls
247 lines (227 loc) · 9.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
# A-GRC Assessment Schema
# Version: 1.0
# Description: Schema for a structured EU AI Act readiness assessment
# for high-risk AI systems in financial services.
# Usage: Complete one assessment file per AI system under review.
# This schema is designed for integration with GRC tooling
# (e.g. ServiceNow GRC module) via API or CI/CD pipeline.
assessment:
metadata:
schema_version: "1.0"
framework: "A-GRC: AI Governance & Risk Controller"
created_by: "" # Assessor name / team
created_date: "" # ISO 8601 format: YYYY-MM-DD
last_updated: "" # ISO 8601 format: YYYY-MM-DD
review_cycle: "annual" # annual | semi-annual | triggered
status: "draft" # draft | in-review | approved | archived
system:
name: "" # Name of the AI system
version: "" # Version identifier
owner:
business_line: "" # e.g. Retail Banking — Fraud Operations
product_owner: "" # Named individual
second_line_owner: "" # Named individual in risk / compliance
deployment_context: "" # e.g. Real-time transaction fraud scoring
geography: # Jurisdictions where system is deployed
- ""
eu_ai_act_classification:
risk_tier: "" # prohibited | high-risk | limited-risk | minimal-risk | gpai
annex_reference: "" # e.g. Annex III, Category 5(b)
classification_date: ""
classification_owner: ""
classification_rationale: ""
supply_chain:
providers:
- name: ""
layer: 0 # 1=direct vendor, 2=sub-processor, 3=foundation model, 4=data vendor
eu_ai_act_role: "" # provider | deployer | distributor | gpai-provider | out-of-scope
contract_reviewed: false
audit_rights: false
model_card_available: false
data_card_available: false
last_assessed: ""
trust_gaps:
- gap_id: ""
description: ""
severity: "" # critical | high | medium | low
owner: ""
remediation_due: ""
status: "" # open | in-progress | closed
controls:
domains:
data_governance:
description: "Controls over training data quality, bias, and provenance"
controls:
- control_id: "DG-01"
title: "Training data documentation"
requirement: "Training data sources documented with provenance, collection method, and known limitations"
eu_ai_act_reference: "Article 10(2)"
nist_ai_rmf_reference: "MAP 2.1"
iso_42001_reference: "Clause 8.4"
status: "" # not-assessed | compliant | partially-compliant | non-compliant | not-applicable
evidence: ""
findings: ""
owner: ""
- control_id: "DG-02"
title: "Training data bias assessment"
requirement: "Training data assessed for demographic bias; results documented before model training"
eu_ai_act_reference: "Article 10(5)"
nist_ai_rmf_reference: "MAP 5.1"
iso_42001_reference: "Clause 8.4"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "DG-03"
title: "Data quality management"
requirement: "Data quality controls in place for input data at inference time; anomalies trigger alerts"
eu_ai_act_reference: "Article 10(3)"
nist_ai_rmf_reference: "MEASURE 2.5"
iso_42001_reference: "Clause 8.4"
status: ""
evidence: ""
findings: ""
owner: ""
model_governance:
description: "Controls over model development, testing, versioning, and change management"
controls:
- control_id: "MG-01"
title: "Model card / technical documentation"
requirement: "Technical documentation completed per Article 11 and Annex IV before deployment"
eu_ai_act_reference: "Article 11, Annex IV"
nist_ai_rmf_reference: "GOVERN 1.2"
iso_42001_reference: "Clause 7.5"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "MG-02"
title: "Pre-deployment accuracy and robustness testing"
requirement: "Model tested for accuracy, robustness, and cybersecurity resilience before deployment"
eu_ai_act_reference: "Article 15"
nist_ai_rmf_reference: "MEASURE 2.2"
iso_42001_reference: "Clause 8.5"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "MG-03"
title: "Model change management"
requirement: "All model changes (retraining, threshold updates, provider changes) logged as change events"
eu_ai_act_reference: "Article 9(5)"
nist_ai_rmf_reference: "GOVERN 6.1"
iso_42001_reference: "Clause 8.3"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "MG-04"
title: "Post-deployment performance monitoring"
requirement: "Ongoing monitoring of fraud detection rate, false positive rate, and demographic parity"
eu_ai_act_reference: "Article 72"
nist_ai_rmf_reference: "MEASURE 2.7"
iso_42001_reference: "Clause 9.1"
status: ""
evidence: ""
findings: ""
owner: ""
access_control:
description: "Controls over privileged access to model components, APIs, and inference infrastructure"
controls:
- control_id: "AC-01"
title: "Privileged access management — model weights"
requirement: "Access to model weights restricted to authorised personnel; managed via PAM tooling (e.g. CyberArk)"
eu_ai_act_reference: "Article 9(6), Article 15(5)"
nist_ai_rmf_reference: "GOVERN 6.2"
iso_42001_reference: "A.6.1 (Annex A)"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "AC-02"
title: "API key governance"
requirement: "Inference API keys rotated on defined schedule; access logged; unused keys revoked"
eu_ai_act_reference: "Article 15(5)"
nist_ai_rmf_reference: "GOVERN 6.2"
iso_42001_reference: "A.6.1 (Annex A)"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "AC-03"
title: "User access review — AI system components"
requirement: "Periodic UAR conducted for all users with privileged access to model pipeline"
eu_ai_act_reference: "Article 9(6)"
nist_ai_rmf_reference: "GOVERN 6.2"
iso_42001_reference: "A.6.2 (Annex A)"
status: ""
evidence: ""
findings: ""
owner: ""
human_oversight:
description: "Controls ensuring humans can understand, override, and intervene in AI decisions"
controls:
- control_id: "HO-01"
title: "Human override capability"
requirement: "Mechanism exists for a human to override, reverse, or escalate any AI fraud decision"
eu_ai_act_reference: "Article 14(4)"
nist_ai_rmf_reference: "MANAGE 4.1"
iso_42001_reference: "Clause 8.6"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "HO-02"
title: "Explainability for human reviewers"
requirement: "Human reviewers can access an explanation of why a transaction was flagged"
eu_ai_act_reference: "Article 14(2)(c)"
nist_ai_rmf_reference: "MEASURE 2.6"
iso_42001_reference: "Clause 8.6"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "HO-03"
title: "Human oversight training"
requirement: "Staff responsible for reviewing AI fraud decisions trained on system capabilities and limitations"
eu_ai_act_reference: "Article 14(3), Article 26(6)"
nist_ai_rmf_reference: "GOVERN 5.1"
iso_42001_reference: "Clause 7.2"
status: ""
evidence: ""
findings: ""
owner: ""
incident_response:
description: "Controls for detecting, reporting, and remediating AI system incidents"
controls:
- control_id: "IR-01"
title: "Serious incident reporting"
requirement: "Procedure in place to report serious incidents (as defined in Article 3(49)) to national authority"
eu_ai_act_reference: "Article 73"
nist_ai_rmf_reference: "MANAGE 2.4"
iso_42001_reference: "Clause 10.1"
status: ""
evidence: ""
findings: ""
owner: ""
- control_id: "IR-02"
title: "Incident log and root cause analysis"
requirement: "All AI-related incidents logged; root cause analysis completed within defined SLA"
eu_ai_act_reference: "Article 26(5)"
nist_ai_rmf_reference: "MANAGE 3.2"
iso_42001_reference: "Clause 10.1"
status: ""
evidence: ""
findings: ""
owner: ""
summary:
total_controls: 12
assessed: 0
compliant: 0
partially_compliant: 0
non_compliant: 0
not_applicable: 0
open_trust_gaps: 0
overall_readiness: "" # red | amber | green
assessor_conclusion: ""
next_review_date: ""