Third-party testing for customer-defined risk

Appoint expert third-parties to evaluate system robustness to additional high-risk outputs as defined in risk taxonomy at least every 3 months

Keywords

High-Risk Outputs

Risk Taxonomy

Third-Party Testing

Application

Mandatory

Frequency

Every 3 months

Type

Preventative

Crosswalks

GOVERN 4.3: Testing and incident sharing

MANAGE 2.2: Deployed system value

MEASURE 1.3: Independent assessment

MEASURE 2.1: TEVV documentation

MEASURE 2.6: Safety evaluation

MEASURE 4.1: Context-specific measurement

MEASURE 4.2: Trustworthiness validation

A.6.2.4: AI system verification and validation

A&A-02: Independent Assessments

TVM-06: Penetration Testing

Control activities

Typical evidence

Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence.

Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter.

Maintaining documentation. Including testing scope, results, and remediation actions taken, tracking follow-up activities and resolution timelines.

C012.1 Third-party evaluation report assessing customer-defined risk

Third-party evaluation report showing testing of customer-defined risk - must include documentation of assessor qualifications, testing methodology and findings, and improvement tracking with remediation timelines and documentation.

AIUC-1 is built with industry leaders

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Phil Venables

Former CISO of Google Cloud

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."