01 / Scope before scoring

System record

Capture the deployment boundary, capabilities, actors, data, dependencies, and decision owner.

System name

Accountable owner

Deployment status

Primary domain

Intended purpose and users

Actions and permissions

Models, tools, vendors, and dependencies

Data handled

Affected parties

Success and prohibited outcomes

02 / Use-case risk

Risk triage

Assess consequences and exposure. The computed tier is a planning signal, not a regulatory classification.

Tier —

Potential severity

Autonomy

Scale / frequency

Reversibility

Human dependency

Uncertainty

Risk narrative and affected groups

Required judgment: applicable laws and frameworks depend on jurisdiction, role, sector, use, system function, and current facts. Have counsel determine applicability; do not infer it from this tier.

03 / Control ownership

Governance controls

Record implementation maturity and evidence. “Implemented” should always point to a verifiable artifact or observable behavior.

04 / Test before trust

Evaluation registry

Define measurable tests, thresholds, populations, owners, cadence, and response before results arrive.

Evaluation name

Type

Owner

Method, population, and test set

Pass / fail threshold

Cadence / triggers

05 / Failure readiness

Incidents, oversight, and change control

Make detection, authority, escalation, remedy, evidence preservation, and restart criteria explicit.

Detection signals

Immediate containment

Escalation and decision authority

Notification, remedy, and preservation

Human oversight design

Change and release gates

Restart / acceptance criteria

06 / Decision evidence

Governance evidence packet

Trace system purpose, risk, controls, tests, response readiness, open gaps, and decision authority in one portable record.

—Planning tier

0/8Controls implemented

0Evaluations

0%Record complete