An application of Cyber Strategy Translation
AI creates a new executive translation problem.
Technical capability, AI risk, regulatory obligations, security concerns and AI impact assessments increasingly reach executives from different parts of the organisation. Leadership still has to determine what matters, what the business consequence is, who owns it and what decision is required.
The executive translation discipline
Cyber Strategy Translation provides a structured way to turn AI governance and risk evidence into business consequence and executive decisions.
CST applies the same Five-Layer Framework to translate AI governance, risk and impact evidence into business exposure, business consequence, governance relevance, response options and explicit executive decisions. The outcome is a clear judgement, an accountable owner and an agreed basis for action.
This is an extension of CST’s management discipline. Specialist AI assessments and management systems provide the evidence; CST connects that evidence to the outcomes and choices leadership owns.
One discipline across technology risk
Cyber Security, AI Governance and Risk, and OT and SCADA each bring specialist evidence. CST provides a common route from that evidence to executive judgement.
The domains retain their specialist assessment methods. The Five-Layer Framework gives leadership a consistent way to compare consequences, consider options and assign accountability.
Explore the Five-Layer Framework →Evidence foundations
ISO/IEC 42001 is the principal AI management system foundation. Supporting frameworks provide relevant risk and impact evidence according to the organisation’s context and AI use.
Principal foundation
Requirements for establishing, implementing, maintaining and continually improving an AI management system. Its governance arrangements and management evidence give CST a foundation for examining ownership, oversight and executive choices.
AI management systems — ISO →Guidance on AI risk management. Risk assessments and treatment options help CST explain business exposure and the choices available to leadership.
AI risk management — ISO →Guidance on AI system impact assessment, including potential effects on individuals, groups and society. CST connects those impacts to organisational consequence and governance relevance.
AI system impact assessment — ISO →A voluntary framework for managing AI risks and trustworthiness. Evidence from Govern, Map, Measure and Manage activities can support CST’s assessment of consequences and response options.
AI Risk Management Framework — NIST →Other relevant security, sector and AI frameworks can contribute evidence where the use case requires them. CST sits above these evidence sources as the translation and executive decision discipline; it complements their assessment and management roles.
The decision in practice
Consider an AI customer-service system. Evidence about inaccurate outputs, sensitive data, supplier dependence and human oversight must become a decision about customer trust, service continuity and acceptable use.
Speak with Sarah Gooding about applying CST to your organisation’s AI governance and risk.
