01 · Readiness
Inventory AI systems and dependencies, classify exposure, assess governance maturity, identify gaps, and prioritize remediation.
Original research · Framework v1.4
AI Governance, Security & Risk Management Framework
An integrated research and assessment methodology for AI readiness, audit and assurance, and control delivery. This public overview describes the approach; detailed assessment workpapers and proprietary mappings are not published here.
IAIGSRM AI Governance, Security & Risk Management FrameworkIntegrated research, assessment and control methodology
ReadinessInventory · Maturity · Gap assessment
Audit & AssuranceTesting · Evidence · Findings
Control DeliveryDesign · Implementation · Monitoring
Shared threat and mitigating-control architecture
Tier 1 · ThreatsThreat models, scenarios and impacts
Tier 2 · Baseline ControlsNIST 800-53 · ISO 27002 · ISO 42001
Tier 3 · Enhanced ControlsHigh-assurance and regulated contexts
Separate AI Red Teaming & Adversarial Testing SolutionCLI test execution · Japan AISI methodological alignment · Evidence and retesting
Red teaming tests the controls and returns evidence to readiness, assurance and delivery workflows.
Three operational applications
02 · Audit & Assurance
Evaluate control design and operation against documented criteria; collect evidence, test controls, record exceptions and communicate residual risk.
03 · Delivery
Translate findings into control design, implementation ownership, validation tests, monitoring and improvement plans.
Three-tier threat and control architecture
| Tier | Purpose |
|---|---|
| Tier 1 | Threat name, type, description, affected assets, likelihood and impact |
| Tier 2 | Baseline mitigating controls and traceable mappings to NIST SP 800-53 Rev. 5, ISO/IEC 27002:2022, and ISO/IEC 42001:2023 (applicable management-system clauses and Annex A controls) |
| Tier 3 | Enhanced controls for sensitive, regulated and high-assurance use cases |
Quantitative readiness model · proposed
Each assessed domain receives a maturity score from 0 to 5: 0 absent, 1 ad hoc, 2 repeatable, 3 defined, 4 measured, 5 continuously improved. An illustrative readiness index is a weighted mean of domain scores divided by five and multiplied by 100. Weights, evidence rules, and thresholds must be documented and validated before use for external assurance.
Illustrative domains: governance and accountability; AI asset inventory; data governance; identity and access; secure engineering; model and agent security; threat modeling; testing and red teaming; monitoring and incident response; third-party and supply-chain risk.
Assessment lifecycle
Scope → Inventory → Threat Model → Map Controls → Evaluate Evidence → Remediate & Deliver → Monitor & Reassess.
Standards alignment
The framework references NIST AI RMF and its Generative AI Profile, ISO/IEC 42001:2023, NIST SP 800-53 Rev. 5, ISO/IEC 27002:2022, OWASP GenAI security guidance and MITRE ATLAS. A conceptual alignment is not a verified one-to-one control mapping. Each future mapping must record the source version, precise requirement, rationale, evidence and reviewer.
Tier 2 mapping specification
Each Tier 2 control record will identify its IAIGSRM control ID, associated Tier 1 threat, control objective, applicable NIST SP 800-53 Rev. 5 and ISO/IEC 27002:2022 references, and applicable ISO/IEC 42001:2023 management-system clauses and Annex A controls. Records will include mapping rationale, applicability, implementation evidence, audit test criteria, source edition, and review status. The organization’s ISO/IEC 42001 Statement of Applicability will inform and document Annex A control inclusion or exclusion. Mappings are research candidates until independently reviewed; no conformity or certification claim is implied.
AI red teaming as an integrated assurance capability
IAIGSRM treats hands-on adversarial testing, including command-line tooling, as a separate technical solution rather than a component of the core governance framework. Authorized testing consumes Tier 1 threat scenarios, evaluates Tier 2 baseline and Tier 3 enhanced safeguards, and returns reproducible evidence, findings and remediation outcomes to the readiness and assurance process.
Governance framework
Defines scope, threats, control objectives, assessment criteria, risk ownership and evidence requirements.
Red teaming solution · future work
Executes authorized adversarial scenarios against in-scope AI systems, evaluates responses and control behavior, and records results for remediation and retesting.
Methodological reference: Japan AISI and Hiroshima AI Process
Future IAIGSRM red teaming guidance and CLI tooling will seek methodological alignment with the Japan AI Safety Institute (AISI) Guide to Red Teaming Methodology on AI Safety, including its practical treatment of AI system evaluation. This is a reference and proposed adaptation, not an assertion of certification, endorsement or exact procedural equivalence.
The G7 Hiroshima AI Process provides related international policy context; it is distinct from Japan AISI's technical guide. Proposed IAIGSRM workflow: define authorization and scope → identify threat scenarios → design test cases and success criteria → execute controlled tests → assess findings → document evidence and remediation → retest. Detailed CLI tool development is out of scope for v1.4.
Publication and access
The public framework is available here. A protected research library for named authorized users is planned for a later release. No restricted documents or access mechanisms are included in v1.4.