Put in place a defined process for assessing AI risk that: follows the AI policy and objectives; gives consistent, valid and comparable results when repeated; identifies risks that help or hinder the AI objectives; analyses risks by assessing consequences for the organization, individuals and societies (an impact assessment under 6.1.4 can feed this), realistic likelihood where applicable, and risk levels; and evaluates risks by comparing results with the risk criteria and prioritizing them for treatment. Keep documented information about the process.
This control maps to 81 controls across 44 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated
NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
You are reading one control. How much of ISO/IEC 42001:2023 have you already done?
ISO/IEC 42001:2023 6.1.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.