NIST AI Risk Management Framework and YouAttest

The NIST AI Risk Management Framework (AI RMF) organizes its guidelines and principles around concepts aimed at managing risks associated with the deployment and use of AI systems.  YouAttest meets many of the controls around identity enumerated by the NIST AI RMF.

These concepts of the AI RMF are aligned with overall risk management practices, focusing on areas such as understanding and assessing AI risks, managing those risks, and governing the use of AI in a manner that aligns with ethical, legal, technical, and societal expectations.

The processes used to manage the identification of risks within an organization’s systems, including AI systems, can involve:

• Identifying the data processed by AI systems and understanding its sensitivity,
• Understanding the AI system’s architecture and its interaction with other systems,
• Identifying the external and internal threats to the AI system,
• Determining the criticality of the AI system to the organization’s mission.

YouAttest can help with many aspects of compliance as it relates. This includes:

• Ensuring that only authorized personnel have access to sensitive AI components,
• Managing how these identities are verified and how access permissions are granted and reviewed,
• Using advanced authentication methods to ensure that entities interacting with AI systems are who they claim to be.

Here are some specific examples based on what SSDF (Secure Software Development Framework) states where YouAttest meets the recommended best practices:

• YouAttest can ensure that developers and users with access to development materials (AI data) are quantified and re-certified on a regular basis to meet the criteria that legal and regulatory requirements involving AI are understood, managed, and documented. Also that the characteristics of trustworthy AI are integrated into organizational policies, processes, and procedures. As well, processes and procedures are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.
• YouAttest is the tool that can regularly attest and certify access to data and code. This addresses the need to have the risk management process and its outcomes established through transparent policies, procedures, and other controls based on organizational risk priorities.
• YouAttest can be the mechanism to inventory who has access to tools and data. This provides that mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities, as outlined in the framework.
• YouAttest can provide the documentation (evidence) of who has access to AI code and data to satisfy the directive that roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.
• Though YouAttest can attest to the training that is required to be in compliance as outlined here. The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.
• YouAttest can be crafted to provide an attestation of 3rd party suppliers to ensure they self-certify to proper practices and procedures. This addresses the need to ensure that AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.
• YouAttest can attest that users sign off on the policies regarding the organization’s mission and relevant goals for the AI technology are understood and documented, as stated in the framework.

While there are many other aspects of the framework to address, YouAttest does the heavy lifting in several crucial areas, allowing enterprises to meet the criteria listed above for compliance. 

—

YouAttest is the only cloud-based IGA platform that deploys in minutes via application SSO into your existing IAM platforms.  Contact us to learn how YouAttest can automate your access review process for your AI and other important resources.