Choosing and maintaining measurement: selecting metrics for the most significant mapped risks, reviewing metric and control effectiveness, and involving independent assessors.
Selecting approaches and metrics to measure the AI risks enumerated in MAP, starting with the most significant, and documenting the risks or trustworthiness characteristics that will not or cannot be measured.
Regularly assessing and updating the appropriateness of AI metrics and the effectiveness of existing controls, including reports of errors and potential impacts on affected communities.
Involving internal experts who were not front-line developers, independent assessors, or both in regular assessments, and consulting domain experts, users, external AI actors and affected communities as risk tolerance requires.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.