MN-3.1 AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented
AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented. Third-party data, model, software and hardware dependencies are monitored on an ongoing basis, not a
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Monitoring records showing regular review of those dependencies · SIEM / log platform
- The risk controls applied to each and evidence they are in place · Vendor register / contract repository
governing documentDocuments that govern the control
- The inventory of third-party resources the AI system depends on · Vendor register / contract repository
- The route by which a third-party change reaches the risk owner · Vendor register / contract repository
First move
Common gaps auditors find
- Third parties assessed at onboarding and not monitored afterwards
- Model or API version changes by the provider go unnoticed
- Controls documented in the contract with no operational evidence
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMN-2.4 Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use · MN-3.2 Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance