What is an AI management system (AIMS)? ISO 42001, published in December 2023, is the first international standard that sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). An ISO 42001 AIMS is not a software product or a single tool. It is a governance structure that connects AI decisions …
What is fourth-party risk? Fourth-party risk extends third-party exposure one step further down the supply chain. A third party is a vendor your organization contracts with directly, while a fourth party is a company that vendor relies on to deliver its service, such as a cloud host, payment processor, or outsourced support desk. Because organizations …
What is Federal Contract Information? FCI originates from contracts, task orders and similar agreements between federal agencies and their contractors or subcontractors. It covers the deliverables, reports and data that a contractor creates or receives while performing work for the government, including technical documents, project plans and correspondence with the contracting agency. The term is …
What Is Vendor Onboarding? The vendor onboarding process involves several steps to ensure new suppliers meet an organization’s requirements before gaining access to its systems or data. Beyond collecting contracts and payment details, it includes assessing the vendor’s security posture, evaluating potential risks, confirming compliance with relevant regulations and establishing appropriate access controls. While vendor …
What is Authorization to Operate (ATO)? An Authorization to Operate, commonly called an ATO, is used within the U.S. federal government to confirm that the risks associated with operating an information system have been reviewed and accepted. The authorization applies within a defined environment and may include specific terms and conditions for how the system …
What Is a Risk Management Policy? A risk management policy establishes a consistent approach to managing risk across an organization. It defines how risks should be identified and assessed, who is responsible for managing them, and how appropriate risk mitigation measures and controls should be implemented. This helps ensure potential threats are addressed proactively rather …
What Is a Self-Assessment Questionnaire? A self-assessment questionnaire helps an organization compare its current controls, processes, and security practices against the requirements of a specific compliance framework. It provides a structured way to understand where the organization meets requirements and where additional work may be needed. The SAQ should be aligned with the framework the …
What Is a Conformity Assessment? Under the EU AI Act, conformity assessments are particularly relevant to high-risk AI systems, with Article 43 setting out the assessment routes for systems covered by Annex III. Responsibility for an AI conformity assessment generally falls on the AI system provider, although other parties may take on these obligations if …
What Is an AI Impact Assessment (AIIA)? An AI Impact Assessment (AIIA) helps organizations examine the wider consequences of developing, deploying, or using an AI system. It looks beyond whether the technology performs as intended to consider issues such as bias, discrimination, fairness, explainability, human oversight, and unintended consequences, helping teams determine what safeguards may …
What Is AI Risk Management? AI risk management applies established risk management principles to challenges specific to artificial intelligence, such as bias, model drift, security threats, privacy concerns, and misuse. It sits within a broader AI governance framework, which establishes the policies, responsibilities, and oversight for responsible AI, while AI risk management focuses on identifying …
What Is Cyber Resilience? Cyber resilience brings cybersecurity, incident response, and business continuity together to help organizations remain operational when disruption occurs. Rather than assuming every cyberattack can be prevented, it recognizes that some incidents will get through and focuses on minimizing their impact and restoring critical systems quickly. A cyber resilience strategy combines preventive …
What is AI TRiSM? AI TRiSM provides organizations with a structured approach to identifying and managing the risks that emerge as AI systems move from development into real-world use. The AI TRiSM meaning centers on bringing trust, risk, security, and governance together rather than managing each area separately. Introduced by Gartner in 2022, the AI …
