AAISM: Advanced in AI Security Management

A comprehensive inventory of AI systems and the business units that use them provides a complete, current view of where AI is deployed across the organization. This supports oversight of usage, ownership, risk, and governance.

An inventory of models in use provides the essential visibility needed to govern AI across the organization. It establishes what AI capabilities exist, where they are used, and which systems require risk assessment, ownership, controls, and monitoring.

Risk documentation records and communicates how AI risks are governed and managed, creating evidence for transparency, accountability, and compliance oversight by external stakeholders. NIST notes that systematic documentation strengthens AI risk management and increases transparency and accountability.

The percentage of AI projects that comply with established requirements directly indicates whether AI risk-management controls and governance processes are being followed. Counts of systems, models, or training requests measure scale or activity, not the effectiveness of risk management.

An AI incident response program needs an accountable cross-functional team with AI expertise before it can design, operate, and maintain incident reporting, recovery, containment, and eradication processes.