arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-ai-impact-template.md

@@ -0,0 +1,212 @@
+# AI Impact Assessment (OMB M-24-10 + M-25-21)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-ai-impact`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-ai-impact` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: AI use case, rights-impacting / safety-impacting determination per OMB M-24-10, M-24-10 §5 risk-management practices status, M-25-21 acquisition controls (if procured), and CAIO sign-off status.]
+
+---
+
+## 1. AI Use Case Description
+
+| Field | Value |
+|-------|-------|
+| **Use Case Name** | [Name] |
+| **Agency / Bureau** | [Agency] |
+| **Federal AI Use Case Inventory ID** | [If listed on federal.ai.gov — entry ID; otherwise PENDING] |
+| **Purpose** | [What problem the AI solves] |
+| **Decision Context** | [What decision is informed or made by the AI] |
+| **Data Inputs** | [Data types, sources, sensitivity, PII?] |
+| **Outputs** | [What the AI produces and how it is used downstream] |
+| **Automation Level** | [Decision-support / Decision-making with human review / Decision-making automated] |
+| **AI Capability Type** | [Predictive / Classification / Generative / Decision-Support] |
+| **Population Affected** | [Federal employees / public / regulated cohort] |
+| **Build / Buy / GenAI Wrapper** | [In-house / Vendor-built / Off-the-shelf with custom prompts] |
+| **Cross-ref AI RMF** | [ARC-{P}-AIRMF-v*] |
+| **Cross-ref PIA (if PII)** | [ARC-{P}-PIA-v*] |
+| **CAIO** | [Name + role] |
+| **Use-Case Owner** | [Name + role] |
+| **Assessment Date** | [YYYY-MM-DD] |
+
+---
+
+## 2. Rights-Impacting / Safety-Impacting Determination
+
+Per OMB M-24-10 Appendix I, certain categories of AI use are *presumed* to be rights-impacting or safety-impacting. Determine applicability for this use case.
+
+### 2.1 Safety-Impacting Determination (M-24-10 Appendix I §1)
+
+| Presumed Safety-Impacting Category | Applies? | Rationale |
+|-------------------------------------|---------|-----------|
+| Controls safety-critical functions of dams, emergency services, electrical grids, fire safety, financial systems, water supply | [Yes / No] | [Rationale] |
+| Maintains civilian working conditions or worker safety in regulated environments | [Yes / No] | [Rationale] |
+| Conducts biometric identification (real-time or post-hoc) in public spaces | [Yes / No] | [Rationale] |
+| Detects fraud in benefits programmes resulting in benefit denial | [Yes / No] | [Rationale] |
+| Conducts medical diagnostics or treatment decisions | [Yes / No] | [Rationale] |
+| Controls physical movement of robots in workspaces accessible to humans | [Yes / No] | [Rationale] |
+| Controls industrial / manufacturing emissions or hazardous materials | [Yes / No] | [Rationale] |
+| Controls life-safety functions in transport (autonomous vehicles, aviation, rail) | [Yes / No] | [Rationale] |
+| Conducts safety-related law-enforcement functions | [Yes / No] | [Rationale] |
+
+**Safety-Impacting Determination**: **[Yes / No]**
+
+[Narrative: if any of the above rows is Yes, the system is presumed safety-impacting. CAIO concurrence is required to override the presumption.]
+
+### 2.2 Rights-Impacting Determination (M-24-10 Appendix I §2)
+
+| Presumed Rights-Impacting Category | Applies? | Rationale |
+|-------------------------------------|---------|-----------|
+| Determines eligibility, access, or denial of federal benefits or services | [Yes / No] | [Rationale] |
+| Generates risk assessments used in criminal or civil legal proceedings | [Yes / No] | [Rationale] |
+| Detects fraud in benefits programmes (where outcome affects individuals) | [Yes / No] | [Rationale] |
+| Monitors / detects student academic conduct or wellness | [Yes / No] | [Rationale] |
+| Monitors employees in ways that affect employment outcomes | [Yes / No] | [Rationale] |
+| Makes housing / loan / employment / insurance access decisions | [Yes / No] | [Rationale] |
+| Conducts biometric identification or surveillance of public spaces | [Yes / No] | [Rationale] |
+| Detects emotion, sentiment, or affect in regulated decision-making | [Yes / No] | [Rationale] |
+| Translates / generates content used in legal, medical, or benefits proceedings | [Yes / No] | [Rationale] |
+| Detects or generates content used in censorship / content-moderation by the federal government | [Yes / No] | [Rationale] |
+| Conducts immigration / asylum / refugee decision-making | [Yes / No] | [Rationale] |
+| Determines firearm-purchase / background-check eligibility | [Yes / No] | [Rationale] |
+| Conducts predictive policing | [Yes / No] | [Rationale] |
+| Determines child welfare interventions | [Yes / No] | [Rationale] |
+
+**Rights-Impacting Determination**: **[Yes / No]**
+
+### 2.3 CAIO Concurrence
+
+[If the determination contests a presumed category — i.e., you assert "No" against a presumed Yes — the agency CAIO must concur per M-24-10 §5. Document the CAIO's rationale and signature in the Approvals section.]
+
+**Determination Contested?**: [Yes — CAIO concurrence required / No]
+
+---
+
+## 3. Minimum Risk-Management Practices Checklist
+
+Per OMB M-24-10 §5 + Appendix II. Required for any AI determined rights-impacting or safety-impacting.
+
+| # | Practice | Status | Evidence | Action |
+|---|----------|--------|----------|--------|
+| 1 | Complete AI Impact Assessment (this artefact) | [Implemented / Planned / Not Applicable] | [Self-reference] | [N/A] |
+| 2 | Test the AI for performance in a real-world context | [Implemented / Planned / Not Applicable] | [Test report ref] | [Action] |
+| 3 | Independently evaluate the AI | [Implemented / Planned / Not Applicable] | [Evaluator + report ref] | [Action] |
+| 4 | Conduct ongoing monitoring | [Implemented / Planned / Not Applicable] | [Monitoring plan ref] | [Action] |
+| 5 | Regularly evaluate risks from the AI's use | [Implemented / Planned / Not Applicable] | [Reassessment cadence] | [Action] |
+| 6 | Mitigate emerging risks to rights and safety | [Implemented / Planned / Not Applicable] | [Mitigation register] | [Action] |
+| 7 | Ensure adequate human training and assessment for AI use | [Implemented / Planned / Not Applicable] | [Training records] | [Action] |
+| 8 | Provide additional human oversight, intervention, and accountability as part of decisions or actions that could result in a significant impact on rights or safety | [Implemented / Planned / Not Applicable] | [Oversight design] | [Action] |
+| 9 | Provide public notice and plain-language documentation through the agency's AI use-case inventory | [Implemented / Planned / Not Applicable] | [federal.ai.gov entry] | [Action] |
+| 10 | Notify negatively affected individuals — provide a means to opt-out where practicable and a means to access human consideration and remedy | [Implemented / Planned / Not Applicable] | [Notice text + opt-out mechanism] | [Action] |
+| 11 | Maintain options to opt-out from the AI-enabled decision in favour of a human alternative (where practicable) | [Implemented / Planned / Not Applicable] | [Opt-out design] | [Action] |
+| 12 | Provide consultation and feedback opportunities for the public and affected communities | [Implemented / Planned / Not Applicable] | [Consultation record] | [Action] |
+| 13 | Maintain consistency with broader privacy and civil-rights laws (Privacy Act, ADA, Title VI, etc.) | [Implemented / Planned / Not Applicable] | [Legal review] | [Action] |
+| 14 | Conduct an equity assessment for disparate impact on protected populations | [Implemented / Planned / Not Applicable] | [Equity assessment ref] | [Action] |
+
+---
+
+## 4. M-25-21 Acquisition Controls
+
+[Applies when the AI system is procured rather than built in-house. Document contract clauses, evaluation criteria, and vendor obligations per OMB M-25-21.]
+
+**AI Procured?**: [Yes / No]
+
+| Acquisition Control | Status | Notes |
+|---------------------|--------|-------|
+| Solicitation includes plain-language description of intended use | [Met / Gap] | [Notes] |
+| Evaluation criteria assess vendor AI-risk-management maturity | [Met / Gap] | [Notes] |
+| Contract clause: vendor disclosure of training data sources | [Met / Gap] | [Notes] |
+| Contract clause: vendor disclosure of model architecture and any base models | [Met / Gap] | [Notes] |
+| Contract clause: vendor model documentation (model card / system card) | [Met / Gap] | [Notes] |
+| Contract clause: agency audit rights over vendor AI lifecycle | [Met / Gap] | [Notes] |
+| Contract clause: data rights — agency retains rights to its data + derivatives | [Met / Gap] | [Notes] |
+| Contract clause: IP — clear ownership of agency-generated content, prompts, embeddings, fine-tuned weights | [Met / Gap] | [Notes] |
+| Contract clause: vendor commitment to update / patch / decommission cadence | [Met / Gap] | [Notes] |
+| Contract clause: vendor incident-disclosure obligations (AI incidents, safety failures) | [Met / Gap] | [Notes] |
+| Contract clause: prohibition on training vendor models with agency data without explicit permission | [Met / Gap] | [Notes] |
+| Contract clause: vendor must support agency M-24-10 minimum practices | [Met / Gap] | [Notes] |
+| Vendor management plan in place | [Met / Gap] | [Notes] |
+
+---
+
+## 5. Public Disclosure Obligations
+
+| Element | Status | Notes |
+|---------|--------|-------|
+| Entry in agency AI Use Case Inventory (federal.ai.gov) | [Posted / Pending / N/A] | [URL / target date] |
+| Plain-language description on agency website | [Posted / Pending / N/A] | [URL / target date] |
+| Notice to affected individuals at point of contact | [Implemented / Planned] | [Notice text reference] |
+| Opt-out mechanism communicated | [Implemented / Planned / Not practicable — narrative required] | [Mechanism] |
+| Appeals / human-review mechanism communicated | [Implemented / Planned] | [Mechanism] |
+
+**Federal AI Use Case Inventory Entry** (draft):
+
+| Field | Value |
+|-------|-------|
+| Use case title | [Title] |
+| Agency | [Agency] |
+| Bureau | [Bureau] |
+| Mission area | [Mission area] |
+| Stage | [Initiated / Acquisition and/or Development / Implementation and Assessment / Operation and Maintenance / Decommissioned] |
+| Plain-language summary | [Two-sentence summary of what the AI does and for whom] |
+| Rights-impacting | [Yes / No] |
+| Safety-impacting | [Yes / No] |
+| Date last updated | [YYYY-MM-DD] |
+
+---
+
+## 6. Agency CAIO Sign-Off
+
+| Sign-Off Item | CAIO Statement |
+|---------------|----------------|
+| Determination of rights-/safety-impacting concurred | [Concur / Concur with conditions / Do not concur] |
+| Minimum risk-management practices reviewed | [Reviewed and approved / Conditional / Returned for revision] |
+| Acquisition controls (where applicable) reviewed | [Reviewed and approved / Conditional / N/A] |
+| Public disclosure plan reviewed | [Reviewed and approved / Conditional] |
+
+**CAIO Signature**: [Name + signature + date]
+
+---
+
+## 7. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| OMB M-24-10 | Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence | <https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf> |
+| OMB M-25-21 | Acquisition of Artificial Intelligence in the Federal Government | <https://www.whitehouse.gov/omb/> |
+| NIST AI 600-1 | AI RMF: Generative AI Profile | <https://doi.org/10.6028/NIST.AI.600-1> |
+| federal.ai.gov | Federal AI Use Case Inventory | <https://ai.gov/ai-use-cases/> |
+
+---
+
+## 8. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| AI Use-Case Owner | [Name] | [Signature] | [YYYY-MM-DD] |
+| Chief AI Officer (CAIO) | [Name] | [Signature] | [YYYY-MM-DD] |
+| Senior Agency Official for Privacy (SAOP) | [Name] | [Signature] | [YYYY-MM-DD] |
+| Agency General Counsel (or designee) | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-ai-impact` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-ai-rmf-template.md

@@ -0,0 +1,232 @@
+# NIST AI Risk Management Framework Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-ai-rmf`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-ai-rmf` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: AI system, intended use, AI RMF 1.0 four-function maturity, GenAI applicability, top three residual risks, and recommended treatment.]
+
+---
+
+## 1. AI System Description
+
+| Field | Value |
+|-------|-------|
+| **System Name** | [Name] |
+| **Intended Use** | [Specific purpose, decision context, automation level] |
+| **AI Capability Type** | [Predictive / Classification / Generative / Decision-Support / Autonomous] |
+| **GenAI in Use?** | [Yes — see Section 6 / No] |
+| **Training Data Sources** | [Public / proprietary / mixed; data classification] |
+| **Model Architecture** | [E.g., gradient-boosted trees / transformer 7B / RAG over agency corpus] |
+| **Foundation Model (if any)** | [Vendor + version, e.g., Claude Opus 4 / GPT-4o / Llama 3.1 70B] |
+| **Deployment Context** | [Internal / customer-facing / inter-agency] |
+| **Population Affected** | [Federal employees / public / regulated cohort] |
+| **Decisions Affecting Individuals** | [Yes — describe / No / Decision-support only] |
+| **Human-in-the-Loop Posture** | [Always / Threshold-triggered / None] |
+| **Cross-ref AI Impact Assessment** | [ARC-{P}-AIIA-v*] |
+| **Assessment Date** | [YYYY-MM-DD] |
+| **Chief AI Officer (CAIO)** | [Name + role] |
+
+---
+
+## 2. Govern Function
+
+Cultivate a culture of risk management. AI RMF 1.0 Govern function sub-categories.
+
+| Sub-category | Maturity | Evidence | Action |
+|--------------|----------|----------|--------|
+| Govern 1.1 — Legal and regulatory requirements involving AI are understood, managed, and documented | [Not in Place / Partially / Mostly / Fully] | [Evidence] | [Action] |
+| Govern 1.2 — Characteristics of trustworthy AI are integrated into organisational policies, processes, and procedures | [Maturity] | [Evidence] | [Action] |
+| Govern 1.3 — Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the AI system's risk | [Maturity] | [Evidence] | [Action] |
+| Govern 1.4 — The risk management process and its outcomes are established through transparent policies, procedures, and other controls | [Maturity] | [Evidence] | [Action] |
+| Govern 1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned | [Maturity] | [Evidence] | [Action] |
+| Govern 1.6 — Mechanisms are in place to inventory AI systems and are resourced according to organisational risk priorities | [Maturity] | [Evidence] | [Action] |
+| Govern 1.7 — Processes and procedures are in place for decommissioning and phasing out AI systems safely | [Maturity] | [Evidence] | [Action] |
+| Govern 2.1 — Roles, responsibilities, and lines of communication related to mapping, measuring, and managing AI risks are documented | [Maturity] | [Evidence] | [Action] |
+| Govern 2.2 — The organisation's personnel and partners receive AI risk-management training | [Maturity] | [Evidence] | [Action] |
+| Govern 2.3 — Executive leadership of the organisation takes responsibility for decisions about risks associated with AI system development and deployment | [Maturity] | [Evidence] | [Action] |
+| Govern 3.1 — Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team | [Maturity] | [Evidence] | [Action] |
+| Govern 3.2 — Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight | [Maturity] | [Evidence] | [Action] |
+| Govern 4.1 — Organisational policies and practices foster a critical thinking and safety-first mindset | [Maturity] | [Evidence] | [Action] |
+| Govern 4.2 — Organisational teams document the risks and potential impacts of AI technology they design, develop, deploy, evaluate, and use | [Maturity] | [Evidence] | [Action] |
+| Govern 4.3 — Organisational practices are in place to enable AI testing, identification of incidents, and information sharing | [Maturity] | [Evidence] | [Action] |
+| Govern 5.1 — Organisational policies and practices are in place to collect, consider, prioritise, and integrate feedback from those external to the team that developed or deployed the AI system | [Maturity] | [Evidence] | [Action] |
+| Govern 5.2 — Mechanisms are established to enable AI actors to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation | [Maturity] | [Evidence] | [Action] |
+| Govern 6.1 — Policies and procedures are in place that address AI risks associated with third-party entities | [Maturity] | [Evidence] | [Action] |
+| Govern 6.2 — Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk | [Maturity] | [Evidence] | [Action] |
+
+---
+
+## 3. Map Function
+
+Establish context and identify risks. AI RMF 1.0 Map function sub-categories.
+
+| Sub-category | Maturity | Evidence | Action |
+|--------------|----------|----------|--------|
+| Map 1.1 — Intended purposes, potentially beneficial uses, context-specific laws, norms, and expectations, and prospective settings in which the AI system will be deployed are understood and documented | [Maturity] | [Evidence] | [Action] |
+| Map 1.2 — Inter-disciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise | [Maturity] | [Evidence] | [Action] |
+| Map 1.3 — The organisation's mission and relevant goals for the AI technology are understood and documented | [Maturity] | [Evidence] | [Action] |
+| Map 1.4 — The business value or context of business use has been clearly defined or, in the case of assessing existing AI systems, re-evaluated | [Maturity] | [Evidence] | [Action] |
+| Map 1.5 — Organisational risk tolerances are determined and documented | [Maturity] | [Evidence] | [Action] |
+| Map 1.6 — System requirements are documented; AI actor expectations of stakeholders are determined | [Maturity] | [Evidence] | [Action] |
+| Map 2.1 — The specific tasks and methods used to implement the tasks that the AI system will support are defined | [Maturity] | [Evidence] | [Action] |
+| Map 2.2 — Information about the AI system's knowledge limits and how system output may be utilised and overseen by humans is documented | [Maturity] | [Evidence] | [Action] |
+| Map 2.3 — Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection, system trustworthiness, and construct validation | [Maturity] | [Evidence] | [Action] |
+| Map 3.1 — Potential benefits of intended AI system functionality and performance are examined and documented | [Maturity] | [Evidence] | [Action] |
+| Map 3.2 — Potential costs, including non-monetary costs, that result from expected or realised AI errors or system functionality and trustworthiness — as connected to organisational risk tolerance — are examined and documented | [Maturity] | [Evidence] | [Action] |
+| Map 3.3 — Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization | [Maturity] | [Evidence] | [Action] |
+| Map 3.4 — Processes for operator and practitioner proficiency with AI system performance and trustworthiness — and relevant technical standards and certifications — are defined, assessed, and documented | [Maturity] | [Evidence] | [Action] |
+| Map 3.5 — Processes for human oversight, in accordance with organisational policies from Govern, are defined, assessed, and documented | [Maturity] | [Evidence] | [Action] |
+| Map 4.1 — Approaches for mapping AI technology and legal risks of its components — including the use of third-party data or software — are in place, followed, and documented | [Maturity] | [Evidence] | [Action] |
+| Map 4.2 — Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented | [Maturity] | [Evidence] | [Action] |
+| Map 5.1 — Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented | [Maturity] | [Evidence] | [Action] |
+| Map 5.2 — Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented | [Maturity] | [Evidence] | [Action] |
+
+---
+
+## 4. Measure Function
+
+Use quantitative, qualitative, or mixed-method tools to analyse, assess, and monitor AI risks.
+
+| Sub-category | Maturity | Evidence | Action |
+|--------------|----------|----------|--------|
+| Measure 1.1 — Approaches and metrics for measurement of AI risks enumerated during the Map function are selected for implementation starting with the most significant AI risks | [Maturity] | [Evidence] | [Action] |
+| Measure 1.2 — Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts | [Maturity] | [Evidence] | [Action] |
+| Measure 1.3 — Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates | [Maturity] | [Evidence] | [Action] |
+| Measure 2.1 — Test sets, metrics, and details about the tools used during TEVV are documented | [Maturity] | [Evidence] | [Action] |
+| Measure 2.2 — Evaluations involving human subjects meet applicable requirements and are representative of the relevant population | [Maturity] | [Evidence] | [Action] |
+| Measure 2.3 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s) | [Maturity] | [Evidence] | [Action] |
+| Measure 2.4 — The functionality and behaviour of the AI system and its components — as identified in the Map function — are monitored when in production | [Maturity] | [Evidence] | [Action] |
+| Measure 2.5 — The AI system to be deployed is demonstrated to be valid and reliable | [Maturity] | [Evidence] | [Action] |
+| Measure 2.6 — The AI system is evaluated regularly for safety risks | [Maturity] | [Evidence] | [Action] |
+| Measure 2.7 — AI system security and resilience are evaluated and documented | [Maturity] | [Evidence] | [Action] |
+| Measure 2.8 — Risks associated with transparency and accountability are examined and documented | [Maturity] | [Evidence] | [Action] |
+| Measure 2.9 — The AI model is explained, validated, and documented; AI system output is interpreted within its context and to inform responsible use and governance | [Maturity] | [Evidence] | [Action] |
+| Measure 2.10 — Privacy risk of the AI system is examined and documented | [Maturity] | [Evidence] | [Action] |
+| Measure 2.11 — Fairness and bias — as identified in the Map function — are evaluated and documented | [Maturity] | [Evidence] | [Action] |
+| Measure 2.12 — Environmental impact and sustainability of AI model training and management activities are assessed and documented | [Maturity] | [Evidence] | [Action] |
+| Measure 2.13 — Effectiveness of the employed TEVV metrics and processes in the Measure function are evaluated and documented | [Maturity] | [Evidence] | [Action] |
+| Measure 3.1 — Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts | [Maturity] | [Evidence] | [Action] |
+| Measure 3.2 — Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available | [Maturity] | [Evidence] | [Action] |
+| Measure 3.3 — Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics | [Maturity] | [Evidence] | [Action] |
+| Measure 4.1 — Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users | [Maturity] | [Evidence] | [Action] |
+| Measure 4.2 — Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors | [Maturity] | [Evidence] | [Action] |
+| Measure 4.3 — Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented | [Maturity] | [Evidence] | [Action] |
+
+---
+
+## 5. Manage Function
+
+Allocate risk resources to mapped and measured risks on a regular basis.
+
+| Sub-category | Maturity | Evidence | Action |
+|--------------|----------|----------|--------|
+| Manage 1.1 — A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed | [Maturity] | [Evidence] | [Action] |
+| Manage 1.2 — Treatment of documented AI risks is prioritised based on impact, likelihood, and available resources or methods | [Maturity] | [Evidence] | [Action] |
+| Manage 1.3 — Responses to the AI risks deemed high priority — as identified by the Map function — including response, recovery, and communication plans are planned and documented | [Maturity] | [Evidence] | [Action] |
+| Manage 1.4 — Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented | [Maturity] | [Evidence] | [Action] |
+| Manage 2.1 — Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods — to reduce the magnitude or likelihood of potential impacts | [Maturity] | [Evidence] | [Action] |
+| Manage 2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems | [Maturity] | [Evidence] | [Action] |
+| Manage 2.3 — Procedures are followed to respond to and recover from a previously unknown risk when it is identified | [Maturity] | [Evidence] | [Action] |
+| Manage 2.4 — Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use | [Maturity] | [Evidence] | [Action] |
+| Manage 3.1 — AI risks and benefits from third-party resources are regularly monitored and risk controls are applied and documented | [Maturity] | [Evidence] | [Action] |
+| Manage 3.2 — Pre-trained models that are used for development are monitored as part of AI system regular monitoring and maintenance | [Maturity] | [Evidence] | [Action] |
+| Manage 4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management | [Maturity] | [Evidence] | [Action] |
+| Manage 4.2 — Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors | [Maturity] | [Evidence] | [Action] |
+| Manage 4.3 — Incidents and errors are communicated to relevant AI actors, including affected communities; processes for tracking, responding to, and recovering from incidents and errors are followed and documented | [Maturity] | [Evidence] | [Action] |
+
+---
+
+## 6. Generative AI Profile (NIST AI 600-1)
+
+[If GenAI is in use, complete this section. If not, mark "Not Applicable" and explain.]
+
+**GenAI Applicability**: [Yes / No]
+
+If yes, score the 12 GenAI-specific risk categories from NIST AI 600-1:
+
+| GenAI Risk | Maturity | Evidence | Action |
+|-----------|----------|----------|--------|
+| Confabulation (hallucination of false content) | [Maturity] | [Evidence] | [Action] |
+| Dangerous, Violent, or Hateful Content | [Maturity] | [Evidence] | [Action] |
+| Data Privacy (training-data memorisation; inference-time leakage) | [Maturity] | [Evidence] | [Action] |
+| Environmental Impact (training + inference energy / water / carbon) | [Maturity] | [Evidence] | [Action] |
+| Harmful Bias or Homogenization | [Maturity] | [Evidence] | [Action] |
+| Human-AI Configuration (over-reliance, automation bias) | [Maturity] | [Evidence] | [Action] |
+| Information Integrity (mis/disinformation amplification) | [Maturity] | [Evidence] | [Action] |
+| Information Security (prompt injection, model extraction, adversarial inputs) | [Maturity] | [Evidence] | [Action] |
+| Intellectual Property (training-data copyright; output IP) | [Maturity] | [Evidence] | [Action] |
+| Obscene, Degrading, and/or Abusive Content | [Maturity] | [Evidence] | [Action] |
+| Toxicity, Bias, and Homogenization in outputs | [Maturity] | [Evidence] | [Action] |
+| Value Chain and Component Integration (third-party model risks) | [Maturity] | [Evidence] | [Action] |
+
+---
+
+## 7. Residual Risk Register
+
+| Risk ID | Description | Likelihood | Impact | Treatment | Owner |
+|---------|-------------|-----------|--------|-----------|-------|
+| AIR-001 | [Risk description] | [Low / Med / High] | [Low / Med / High] | [Accept / Mitigate / Transfer / Avoid] | [Role] |
+
+---
+
+## 8. Control-to-RMF-Function Crosswalk
+
+Map NIST SP 800-53 controls to AI RMF functions.
+
+| 800-53 Control | AI RMF Function | Sub-category | Notes |
+|----------------|-----------------|--------------|-------|
+| RA-3 | Map | Map 5.1 | [Risk assessment of AI system harms] |
+| RA-5 | Measure | Measure 2.7 | [Vulnerability monitoring] |
+| SI-4 | Manage | Manage 4.1 | [System monitoring during operation] |
+| CA-7 | Manage | Manage 4.1 | [Continuous monitoring] |
+| PT-1 | Govern | Govern 1.1 | [PII processing policy] |
+| AT-2 | Govern | Govern 2.2 | [AI awareness training] |
+| SR-3 | Govern | Govern 6.1 | [Third-party AI supply chain] |
+| SA-11 | Measure | Measure 2.5 | [Developer testing] |
+| IR-4 | Manage | Manage 4.3 | [AI incident handling] |
+
+---
+
+## 9. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| NIST AI RMF 1.0 | Artificial Intelligence Risk Management Framework 1.0 | <https://doi.org/10.6028/NIST.AI.100-1> |
+| AI RMF Playbook | Playbook for the AI RMF | <https://airc.nist.gov/AI_RMF_Knowledge_Base/Playbook> |
+| NIST AI 600-1 | AI RMF: Generative AI Profile | <https://doi.org/10.6028/NIST.AI.600-1> |
+| OMB M-24-10 | Advancing Governance, Innovation, and Risk Management for Agency Use of AI | <https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf> |
+
+---
+
+## 10. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| Chief AI Officer (CAIO) | [Name] | [Signature] | [YYYY-MM-DD] |
+| AI Use-Case Owner | [Name] | [Signature] | [YYYY-MM-DD] |
+| CISO | [Name] | [Signature] | [YYYY-MM-DD] |
+| Senior Agency Official for Privacy (SAOP) | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-ai-rmf` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-fedramp-readiness-template.md

@@ -0,0 +1,209 @@
+# FedRAMP Readiness Assessment Report (3PAO)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-fedramp-readiness`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-fedramp-readiness` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: CSO under assessment, baseline targeted, the 3PAO firm conducting the assessment, the overall readiness recommendation (FedRAMP-Ready / Not Ready / Conditional), and the top three gaps by severity.]
+
+---
+
+## 1. Capability Statement
+
+| Field | Value |
+|-------|-------|
+| **Cloud Service Offering (CSO)** | [CSO name] |
+| **CSP** | [CSP organisation] |
+| **Service Model** | [IaaS / PaaS / SaaS] |
+| **Baseline Targeted** | [Moderate / High] |
+| **Authorisation Path** | [Agency / JAB / Tailored] |
+| **3PAO Firm** | [3PAO name + A2LA accreditation #] |
+| **Assessment Period** | [YYYY-MM-DD to YYYY-MM-DD] |
+| **Sponsoring Agency** (if Agency path) | [Agency] |
+| **Target ATO Date** | [YYYY-MM-DD] |
+
+### What the CSO Provides
+
+[Two-paragraph description of the service, customer use cases, and key capabilities relevant to federal customers.]
+
+### Customer Responsibility Matrix (Summary)
+
+| Control Family | CSO Provides | Customer Responsibility |
+|----------------|--------------|-------------------------|
+| AC | [What the CSO handles] | [What the customer must configure] |
+| AU | [What the CSO handles] | [What the customer must configure] |
+| CM | [What the CSO handles] | [What the customer must configure] |
+| IR | [What the CSO handles] | [What the customer must configure] |
+| SC | [What the CSO handles] | [What the customer must configure] |
+| SI | [What the CSO handles] | [What the customer must configure] |
+
+[Full CRM is a separate deliverable; this is a summary view for the RAR.]
+
+---
+
+## 2. Authorisation Path Recommendation
+
+| Path | Recommended? | Rationale |
+|------|--------------|-----------|
+| **Agency ATO** | [Yes / No] | [Single sponsoring agency identified; suits CSOs with a primary federal customer.] |
+| **JAB P-ATO** | [Yes / No] | [Multi-agency demand; suits widely-used CSOs.] |
+| **FedRAMP Tailored (Low-Impact SaaS)** | [Yes / No] | [LI-SaaS only; suits collaboration / productivity tools with no PII / no sensitive data.] |
+
+**Recommendation**: [Agency / JAB / Tailored] — [Rationale narrative]
+
+---
+
+## 3. Gap Register
+
+Gaps identified during the readiness assessment that must be remediated before authorisation.
+
+| Control ID | Gap Description | Severity (High / Mod / Low) | Mitigation Plan | Target Completion (POA&M Target) | Owner |
+|-----------|-----------------|------------------------------|-----------------|----------------------------------|-------|
+| [AC-2] | [Account management process not fully automated; manual provisioning steps remain.] | [Moderate] | [Automate provisioning via IdP workflow; remove manual steps.] | [YYYY-MM-DD] | [Platform team] |
+| [AU-6] | [Audit log review cadence not documented for the application tier.] | [Low] | [Document review SOP; SOC ack daily.] | [YYYY-MM-DD] | [SOC] |
+| [SC-7] | [WAF rule set not validated against OWASP top 10.] | [High] | [Engage AppSec; tune WAF; rerun validation.] | [YYYY-MM-DD] | [AppSec] |
+| [SR-3] | [SBOM not yet produced for one third-party dependency.] | [Moderate] | [Engage vendor; produce CycloneDX SBOM.] | [YYYY-MM-DD] | [SecOps] |
+
+---
+
+## 4. Evidence Inventory
+
+| Artefact | Control ID(s) | Evidence Status (Complete / Partial / Missing) | Location / Link |
+|----------|---------------|------------------------------------------------|-----------------|
+| System Security Plan (SSP) | [All] | [Complete] | [ARC-{P}-FRSSP-v*] |
+| FIPS 199 Categorization | [RA-2] | [Complete] | [ARC-{P}-FISMA-v*] |
+| Tailored 800-53 Control Set | [All] | [Complete] | [ARC-{P}-NIST53-v*] |
+| Privacy Impact Assessment | [PT family] | [Complete] | [ARC-{P}-PIA-v*] |
+| Contingency Plan | [CP-2] | [Complete] | [Reference] |
+| Incident Response Plan | [IR-8] | [Complete] | [Reference] |
+| Configuration Management Plan | [CM-9] | [Complete] | [Reference] |
+| ConMon Plan | [CA-7] | [Partial — pending FedRAMP PMO template alignment] | [Reference] |
+| POA&M (initial) | [CA-5] | [Complete] | [Reference] |
+| Vulnerability Scan (authenticated) | [RA-5] | [Complete — last scan YYYY-MM-DD] | [Scan report ref] |
+| Penetration Test Report | [CA-8] | [Complete — last test YYYY-MM-DD] | [Pentest report ref] |
+| Customer Responsibility Matrix (CRM) | [All inherited] | [Complete] | [Reference] |
+| FIPS 140-3 Validation Certs for crypto modules | [SC-13] | [Complete — CMVP cert NNNN] | [CMVP cert link] |
+| SSDF Self-Attestation (EO 14028) | [SR family] | [Complete] | [ARC-{P}-SBOM-v*] |
+
+---
+
+## 5. 3PAO RAR Criteria Checklist
+
+Per the FedRAMP 3PAO Readiness Assessment Report template.
+
+| # | Criterion | Status | Notes |
+|---|-----------|--------|-------|
+| 1 | CSO is fully described (architecture, boundary, components) | [Met / Not Met] | [Notes] |
+| 2 | Authorisation boundary diagram approved | [Met / Not Met] | [Notes] |
+| 3 | Data flow diagram approved | [Met / Not Met] | [Notes] |
+| 4 | All controls implemented or have POA&M target dates | [Met / Not Met] | [Notes] |
+| 5 | FedRAMP-Ready CSP dependencies confirmed | [Met / Not Met] | [Notes] |
+| 6 | FIPS 140-3 validated crypto modules used for all crypto | [Met / Not Met] | [Notes] |
+| 7 | Multi-factor authentication implemented (AAL2 minimum) | [Met / Not Met] | [Notes] |
+| 8 | Continuous monitoring strategy documented | [Met / Not Met] | [Notes] |
+| 9 | Initial vulnerability scan completed; results in evidence | [Met / Not Met] | [Notes] |
+| 10 | Initial penetration test completed; report in evidence | [Met / Not Met] | [Notes] |
+| 11 | Initial POA&M populated | [Met / Not Met] | [Notes] |
+| 12 | Incident response capability validated by tabletop exercise | [Met / Not Met] | [Notes] |
+| 13 | All cryptographic key management implemented per SC-12 | [Met / Not Met] | [Notes] |
+| 14 | CRM completed and signed by CSP | [Met / Not Met] | [Notes] |
+| 15 | SSDF / EO 14028 self-attestation submitted to CISA | [Met / Not Met] | [Notes] |
+
+**Overall RAR Recommendation**: [FedRAMP-Ready / Not Ready / Conditional]
+
+---
+
+## 6. Penetration Testing Summary
+
+| Field | Value |
+|-------|-------|
+| **Test Firm** | [Firm name] |
+| **Test Period** | [YYYY-MM-DD to YYYY-MM-DD] |
+| **Scope** | [In-scope assets, applications, APIs] |
+| **Methodology** | [PTES / OWASP WSTG / NIST SP 800-115] |
+| **Critical Findings** | [Count + status] |
+| **High Findings** | [Count + status] |
+| **Medium Findings** | [Count + status] |
+| **Low Findings** | [Count + status] |
+| **Retest Date** | [YYYY-MM-DD] |
+| **Final Status** | [All criticals remediated / N criticals open with mitigation] |
+
+---
+
+## 7. Continuous Monitoring Readiness
+
+| Element | Status | Notes |
+|---------|--------|-------|
+| ConMon Plan documented | [Complete / In progress] | [Reference] |
+| Monthly POA&M ready for FedRAMP PMO submission | [Yes / No] | [Notes] |
+| Authenticated scan cadence proven (≥ 4 weeks history) | [Yes / No] | [Notes] |
+| IR drill (tabletop or functional) completed in last 12 months | [Yes / No] | [Notes] |
+| Annual assessment scope agreed with AO | [Yes / No] | [Notes] |
+
+---
+
+## 8. Remediation Roadmap
+
+```text
+Month 1     |================================|  Address all High gaps
+Month 2     |================================|  Address Moderate gaps
+Month 3     |================================|  3PAO retest of remediated items
+Month 4     |================================|  Submit package to FedRAMP PMO
+Month 5-6   |================================|  ATO process (Agency or JAB review)
+```
+
+[Replace with project-specific timeline. Include milestone gates: gap closure → 3PAO retest → package submission → AO review → ATO issued.]
+
+| Milestone | Target Date | Owner | Status |
+|-----------|-------------|-------|--------|
+| All High gaps closed | [YYYY-MM-DD] | [Owner] | [Open / Done] |
+| All Moderate gaps closed | [YYYY-MM-DD] | [Owner] | [Open / Done] |
+| 3PAO retest complete | [YYYY-MM-DD] | [3PAO] | [Open / Done] |
+| Package submitted to FedRAMP PMO | [YYYY-MM-DD] | [System Owner] | [Open / Done] |
+| ATO issued | [YYYY-MM-DD] | [AO] | [Open / Done] |
+
+---
+
+## 9. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| FedRAMP 3PAO RAR Template | Readiness Assessment Report Template | <https://www.fedramp.gov/documents-templates/> |
+| FedRAMP Agency Authorization Playbook | Agency Authorization Playbook | <https://www.fedramp.gov/agency-authorization/> |
+| FedRAMP JAB Prioritisation Criteria | JAB Prioritisation Criteria | <https://www.fedramp.gov/jab-prioritization/> |
+| FedRAMP Continuous Monitoring Strategy Guide | ConMon Strategy Guide | <https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf> |
+| A2LA 3PAO Directory | Accredited 3PAO Directory | <https://customer.a2la.org/index.cfm?event=directory.search> |
+
+---
+
+## 10. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| 3PAO Lead Assessor | [Name] | [Signature] | [YYYY-MM-DD] |
+| CSP System Owner | [Name] | [Signature] | [YYYY-MM-DD] |
+| CSP CISO | [Name] | [Signature] | [YYYY-MM-DD] |
+| Sponsoring Agency AO (Agency path) | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-fedramp-readiness` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]