This requirement exists to assess AI contribution to business objectives, outcomes, cost-effectiveness, and return on investment, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.
Establish and document the process to assess AI contribution to business objectives, outcomes, cost-effectiveness, and return on investment. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RM – Risk Management Strategy | GV.RM-03 – Cybersecurity risk management activities and outcomes are included in enterprise risk management processes ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-6 – MEASURES OF PERFORMANCE |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. PI1.1 – Processing Integrity – The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services. |
AICPA
Audit Framework
|
vLatest | View → |