Módulo 6: Industry Standards and Frameworks

Proyecto: Standards Mapping

Siguiente →

Descripción

Cerramos M6 produciendo un Standards Mapping document que conecta tu sistema con los controles de NIST AI RMF (principalmente), ISO 42001 (mapping conceptual), e IEEE 7000 (referenced). Este documento se vuelve parte del Responsible AI Framework (M7) y del Ethics Audit (M8).

Al terminar este proyecto vas a tener:

  • Standards Mapping completo con NIST AI RMF + ISO 42001 references
  • Gap analysis de qué controles cumplís vs cuáles faltan
  • Prioritized action plan para cerrar gaps
  • Reusable template para futuros sistemas

Template del documento

# Standards Mapping — [Sistema Name]
**Version**: 1.0 | **Date**: 2026-MM-DD | **Reviewer**: [Name]

## Executive Summary
[2-3 sentences sobre coverage actual]

## Section 1: NIST AI RMF Mapping

### Govern function

| Sub-category | Status | Evidence | Owner | Notes |
|--------------|--------|----------|-------|-------|
| Govern 1.1: AI risk management plan | ✅ | Link to AI Use Policy | Tech Lead | Updated quarterly |
| Govern 1.2: Roles and accountability | ✅ | Accountability matrix | Tech Lead | |
| Govern 1.3: Diverse perspectives | ⚠️ | DEI hiring guidelines | HR | Small team, ongoing |
| Govern 1.4: Stakeholder engagement | ✅ | Feedback collection process | Product Lead | |
| Govern 1.5: Continual improvement | ✅ | Quarterly retros | Tech Lead | |
| Govern 1.6: Sustainability | ⚠️ | Implicit, not documented | Tech Lead | Action item |
| Govern 2.1: External engagement | ❌ | Not formalized | TBD | Plan for Q3 |

### Map function

| Sub-category | Status | Evidence | Owner |
|--------------|--------|----------|-------|
| Map 1.1: Context documented | ✅ | M8-02 system overview | Tech Lead |
| Map 1.2: AI lifecycle phase | ✅ | Production | Tech Lead |
| Map 1.3: Categorization | ✅ | M8 documentation | Tech Lead |
| Map 2.1: Capabilities documented | ✅ | M8-03 RAG design | ML Engineer |
| Map 2.2: Limitations documented | ✅ | M8-03 known limitations | ML Engineer |
| Map 3.1: Impact assessment | ✅ | DPIA document | Tech Lead |
| Map 4.1: Risks identified | ✅ | M6-03 Risk Register | Tech Lead |
| Map 5.1: Continuous identification | ⚠️ | Ad-hoc updates | Tech Lead | Schedule monthly |

### Measure function

| Sub-category | Status | Evidence | Owner |
|--------------|--------|----------|-------|
| Measure 1.1: Risks measured | ✅ | M6-04 metrics pipeline | ML Engineer |
| Measure 2.1: Mitigation effectiveness | ⚠️ | Some baselines | ML Engineer | Need pre/post |
| Measure 3.1: Tracking | ✅ | Datadog dashboard | DevOps |
| Measure 4.1: Trustworthy characteristics | ✅ | M6-04 metrics | ML Engineer |

### Manage function

| Sub-category | Status | Evidence | Owner |
|--------------|--------|----------|-------|
| Manage 1.1: Risks prioritized | ✅ | Risk Register | Tech Lead |
| Manage 2.1: Risk response strategies | ✅ | Per-risk strategy documented | Tech Lead |
| Manage 3.1: Continuous monitoring | ✅ | Monitoring dashboards | DevOps |
| Manage 4.1: Communication | ⚠️ | Internal good, external needs work | Tech Lead | Quarterly reports |

## Section 2: ISO 42001 Mapping (Selected Clauses + Annex A)

### Management System Clauses

| Clause | Description | Status | Evidence |
|--------|-------------|--------|----------|
| 4.1 | Organization context | ✅ | M8-02 |
| 4.2 | Stakeholders | ✅ | M6-03 stakeholder analysis |
| 5.1 | Leadership commitment | ⚠️ | Verbal, not formalized |
| 5.2 | AI policy | ✅ | AI Use Policy v1.0 |
| 5.3 | Roles | ✅ | Accountability matrix |
| 6.1 | Risk planning | ✅ | M6-05 Risk Register |
| 6.2 | AI objectives | ✅ | Defined with metrics |
| 7.5 | Documented information | ✅ | This document + others |
| 8.1 | Operational planning | ✅ | Sprint planning |
| 8.2 | Risk assessment | ✅ | NIST Map |
| 8.3 | Risk treatment | ✅ | NIST Manage |
| 9.1 | Monitoring | ✅ | NIST Measure |
| 9.2 | Internal audit | ❌ | Not formalized; ad-hoc |
| 9.3 | Management review | ⚠️ | Quarterly, informal |
| 10.1 | Continual improvement | ✅ | Retros + lessons learned |
| 10.2 | Corrective action | ⚠️ | Post-mortems but not formal CAPA |

### Annex A Controls (sample)

| Control | Status | Notes |
|---------|--------|-------|
| AI policy | ✅ | |
| AI risk assessment | ✅ | NIST Map function |
| Bias and fairness controls | ✅ | M2 bias audit toolkit |
| Privacy and data protection | ✅ | M3 + M5 GDPR checklist |
| Transparency and explainability | ✅ | Citations + decision explanations |
| Human oversight | ✅ | Human-in-the-loop for high-impact |
| AI lifecycle management | ⚠️ | Could be more formalized |
| Information security | ✅ | M20 of original path |
| Reliability and resilience | ✅ | M21 system design + M5 reliability |

## Section 3: IEEE Standards Referenced

| Standard | Applicable | Status |
|----------|-----------|--------|
| IEEE 7000 (Ethical design) | Yes | ✅ Process followed |
| IEEE 7001 (Transparency) | Yes | ✅ Level 3 |
| IEEE 7002 (Privacy) | Yes | ✅ Aligned via GDPR work |
| IEEE 7003 (Bias) | Yes | ✅ M2 deliverable |
| IEEE 7010 (Well-being) | Marginal | ⚠️ Implicit |

## Section 4: Gap Analysis

### Critical Gaps (Address before next quarter)
1. **9.2 Internal audit (ISO)**: No formal audit cycle. Plan to implement Q3.
2. **Govern 2.1 NIST (External engagement)**: Not formalized.

### High Priority Gaps (Address within 2 quarters)
1. **Measure 2.1 (Effectiveness)**: Need pre/post measurements for mitigations
2. **Manage 4.1 (External communication)**: Quarterly reports to clients
3. **5.1 ISO (Leadership commitment)**: Formalize with CEO signature

### Medium Priority Gaps
1. Map 5.1: monthly risk identification scheduling
2. 10.2 ISO: formal CAPA process

### Low Priority / Accept
1. Govern 1.6 sustainability: implicit, document if requested
2. IEEE 7010 well-being: marginal applicability

## Section 5: Action Plan

| Action | Priority | Owner | Target | Status |
|--------|----------|-------|--------|--------|
| Implement formal internal audit (annual) | Critical | Tech Lead + DPO | 2026-Q3 | Planning |
| External engagement process (industry, regulators) | Critical | Tech Lead | 2026-Q3 | Started |
| Pre/post measurement of mitigations | High | ML Engineer | 2026-Q3 | Active |
| Quarterly external reports | High | Tech Lead | 2026-Q2 | Active |
| CEO formal commitment letter | High | CEO | 2026-Q2 | Pending |
| Monthly risk identification review | Medium | Tech Lead | Ongoing | Active |
| CAPA process formalization | Medium | Tech Lead | 2026-Q4 | Planning |

## Section 6: Review Schedule

- **Monthly**: review risk identification, update register
- **Quarterly**: review NIST mappings, update controls
- **Semi-annually**: review ISO mapping, update controls
- **Annually**: full re-mapping document, audit external

---

Cómo trabajar el proyecto

Sugiero (~3 horas):

  1. Set up template (15 min)
  2. NIST Govern mapping (30 min)
  3. NIST Map mapping (20 min)
  4. NIST Measure mapping (20 min)
  5. NIST Manage mapping (20 min)
  6. ISO 42001 mapping (30 min)
  7. IEEE references (10 min)
  8. Gap analysis + Action plan (30 min)

Criterios de evaluación

Tu mapping es production-ready si:

  • Cada sub-category de NIST AI RMF tiene status (✅/⚠️/❌) y evidence
  • ISO 42001 mapping cubre Clauses 4-10 mínimo
  • IEEE standards relevantes referenciados
  • Gap analysis distingue critical/high/medium/low
  • Action plan con owners y target dates
  • Review schedule definido

Conexión con módulos siguientes

Este mapping es input directo para:

  • M7 (Responsible AI Framework): el ethics checklist se construye sobre estos controles
  • M8 (Ethics Audit): la auditoría aplica este mapping para verificar compliance ongoing

Trabajo aquí ahorra trabajo en M7-M8.

Evidencia de éxito al terminar M6

Vas a saber que terminaste bien si:

  • ✅ Mapping completo con NIST AI RMF (4 functions)
  • ✅ ISO 42001 mapping de clauses + sample Annex A
  • ✅ Gap analysis con priorities
  • ✅ Action plan con owners
  • ✅ Identificás que muchos controles ya cumplís via path

Módulo 6 completado

Aprendiste:

  • ✅ NIST AI RMF — el más práctico framework
  • ✅ Las 4 funciones (Govern, Map, Measure, Manage) en detalle
  • ✅ IEEE 7000 series como complement conceptual
  • ✅ ISO 42001 como certifiable management system
  • ✅ Mapping práctico de tu sistema a estos standards

Standards no son burocracia — son frameworks que organizan tu work y hacen credible tu governance.

Siguiente módulo

Módulo 7 — Building a Responsible AI Framework. Phase 3 final stretch: consolidás TODO en un Responsible AI Framework reutilizable que aplicás a cada proyecto futuro.

Recursos

  1. NIST AI RMF Crosswalks — mappings to other standards.
  2. ISO 42001 Annex A controls.
  3. AI Verify Project — testing toolkit.
  4. NIST AI RMF Playbook — detailed implementation guidance.
← AnteriorISO 42001: AI Management SystemSiguiente →Introducción al Responsible AI Framework