Treat Each Risk in Proportion, and Prove the Treatment Works
Have we actually reduced the risks we said we would — and checked?
Enhanced: 1Advanced: 12 controls
Who it applies to
Enter for every AI system whose letter is E or A (this area has no Baseline controls). Go as deep as your system letter, and implement in your mode.
Why it exists
For each risk that matters, decide the treatment in proportion to the risk, and then prove the treatment actually works — because a mitigation assumed to work and never tested is a risk you have relabelled as safe. Treatment does not mean eliminate; it means reduce to within the appetite the organisation set, by the proportionate means, and confirm the reduction is real. For the highest-stakes risks, confirmation includes deliberately trying to break the mitigation.
What to actually do
Match the treatment to the risk, and accept what remains, by name. Reduce each priority risk by proportionate means, and where risk remains after treatment, have it explicitly accepted by someone with the authority to accept it — connecting to the residual-risk acceptance at the Governance go-live gate. Unowned residual risk is risk no one is watching.
Test that the mitigations hold — attack them where the stakes justify it. Validate that treatments work as intended, and for the highest-stakes risks, commission the adversarial exercises from the Governance security program to try to defeat them. A mitigation that has never been tested against a determined attempt to break it is a hope, not a control.
Controls
Enhanced1 controls
Control 227
Treat each priority risk proportionately, with residual risk explicitly accepted.
EnhancedPreventiveall rolesper system
What it is
Accepted by an authority to accept it; connected to the go-live gate.
How to implement it · Minimum content
Risk identifier and its assessed rating
Treatment chosen in proportion to the rating: reduce, avoid, transfer or accept
Measures: the controls applied, owner and due date
Residual rating after treatment, compared with the risk appetite
Acceptance: name and role of the person with authority to accept, date and any conditions
Reference to the go-live decision for the system
How to start
Define who may accept which level of residual risk (e.g. system owner for low, management for high), then record the treatment of the highest-rated risks.
Evidence
The treatment decisions and the signed residual-risk acceptances referenced in go-live records.
Mode: light / standard / full
light
The owner-manager accepts all residual risk by signing the risk spreadsheet.
standard
Owners accept low and medium; management accepts high at the go-live gate.
full
An authority matrix routes acceptance to owners, committee or executive by rating.
Advanced1 controls
Control 228
Validate treatments, and adversarially test them for high-stakes risks.
AdvancedDetectiveall rolesper system
What it is
Mitigations proven, not assumed; the highest-stakes ones attacked.
How to implement it · Steps
Define a pass criterion per treatment (e.g. the input filter stops at least 95% of a test set of injection prompts)
Validate before go-live and after each change, keeping test cases and results
For high-stakes risks, commission an adversarial exercise to try to defeat the mitigation
Record findings; revise any mitigation that failed and re-test it
Repeat the adversarial test at least annually per high-stakes system and on major change
How to start
Take the three highest-rated risks and write for each a test that would show whether its mitigation actually works.
Evidence
Validation and adversarial-test results, with the revisions made where mitigations failed.
Mode: light / standard / full
light
Annual adversarial test per high-demand system with published test batteries or an external tester.
standard
The security lead validates on change and contracts an external test yearly.
full
A recurring red-team programme across the estate, with validation automated.
Evidence
The treatment decisions and residual-risk acceptances; the validation and adversarial-test results; evidence of mitigations revised where they failed.