Risk Management Framework

But

I will say that compared to, for example, NIST AI risk management framework, this is way, way more detailed than that.

The NIST AI RMF is super.

I mean, ISO 40 2001 is super high level.

And he's saying like, we have an industry where vendors sell things that they don't even know if they work, let alone the people buying them don't necessarily know if they work.

And as you're pointing out, you know, I've done a lot of work in like the federal government and defense and so on in my career with like NIST, RMF and all these frameworks and controls.

And we don't know what the hell actually works or what...

You know, like, I mean, I'm obviously like saying why it bothers you, but I'm curious, like, why does that bother you so much? And why do you think it's something we haven't addressed? Is it because there's no incentives for the vendors to get to that because they can sell this? There's like an information asymmetry at play.

Here are some testimonials.

I did NIST AI RMF with this and help this organization, you know, put together a compliance for the EU AI Act and so forth.

So nonprofits, that's another one.

Last thing for trying to build experience outside of getting hired, look for the large global professional organizations like IAPP and ISACA.

All right, very good.

Let's see.

All right, so we've got a question here from Michelle about, so it looks like about the NIST AI RMF templates that we're creating.

So within the collective, this would have been, I think in September, we stood up a NIST AI risk management framework working group.

There is no need to reinvent the wheel either.

Credible frameworks already exist, such as ISO IEC 42001 and the NIST AI Risk Management Framework.

European AI legislation will also help set the direction for what we can expect to see across the region.

The problem is that a framework sitting in a PDF does not protect anyone.

I'll tell you what that is.

But so for people that don't know, every federal IT system has to go through something called the NIST risk management framework, RMF, right, to get an ATO or authority to operate, right? And that's the government's green light.

It says, all right, you're certified, you're secure.

It means everybody So you could run this, we trust it, and now end users can actually use it, right? It's the final gate before you can really release it to your users.

I mean, you're exactly right.

We, we sell it to the CIO and CISO shop, you know, Fifer, anything Fifer core and AI related, you got to start with the CIO and the CISO, but so that's where we, we want to sell to them specifically for Fifer audit.

That is a, that is a CISO function, you know, the risk management framework, ATOs, anything that, that they can do to shrink their timeframes and, you know, get more value out of their, out of their projects.

One other thing we realized with these RMF projects is all of our consultants are underwater.

But going back to that, it's also governance, right? Governance becomes a big key.

So whether you've adopted ISO 42001 or NIST RMF as like your framework, you still need the platform that is actually able to enforce that downstream.

So those grad rails that we were talking about, you know, what, how are you doing those? Do those align back to your organizational policies? How are you helping the governance board get out of the way? Because AI is going to move faster than they can.

And ultimately, you need to take your governance posture and move it into a high level of maturity, which ultimately becomes self-evolving.

But at the end of the day, it's technology.

And from a risk management standpoint, banks should have a well-defined risk management framework that helps mitigate the risks around technology risk.

really is generally where you should start in terms of evaluating AI from a risk standpoint and from an opportunity standpoint.

So what's behind your question to me is, is there a need to create a new structure For most institutions, no.

So we're increasingly seeing institutions benefit from AI when it comes to things like BSA monitoring.

fraud detection, even being used for aspects of underwriting.

So there are a lot of different ways to use AI effectively in an institution, again, just knowing that you've got the risk management framework around it.

So just kind of expanding on that topic, what do you both think are the minimum governance requirements or foundational controls that financial institutions should have around AI?