Artificial Intelligence Risk Management Plan

Purpose & Scope

This plan establishes how the organization identifies, assesses, treats, and monitors risk introduced by artificial intelligence — with emphasis on generative AI (GenAI) assistants, copilots, and embedded model features — within and adjacent to the CMMC Level 2 assessment boundary.

Scope covers all commercial and self-hosted AI services, browser extensions, IDE copilots, meeting transcription, and any model-backed feature reachable from endpoints, networks, or cloud tenants that store, process, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI).

• In scope: GenAI chat assistants, code copilots, transcription/summarization, RAG over internal repositories, AI features bundled into approved SaaS.
• Out of scope: deterministic automation with no model inference, and AI use on fully segregated non-CUI networks with no data path to the enclave.
• Authoritative control set: NIST SP 800-171 Rev. 2 (110 controls) as assessed under CMMC 2.0 Level 2; risk process aligned to NIST SP 800-30 and the NIST AI Risk Management Framework (AI RMF 1.0).

Governance & Roles

AI risk is owned by named individuals, not by committee consensus. The following assignments satisfy 3.12.x (Security Assessment) accountability expectations.

• Senior Accountable Official — accepts residual AI risk in writing; approves any exception permitting CUI in a model service.
• ISSM — maintains this plan, the AI tool inventory, and the AI risk register; briefs risk posture quarterly.
• AI Review Board (ISSM, IT lead, contracts/export control, legal) — adjudicates new AI tool requests within 10 business days.
• System Owners — validate that approved AI tools remain inside documented boundaries and CUI flows.
• All Personnel — complete AI acceptable-use training before access; report suspected CUI disclosure to a model within 1 hour.

AI Asset Inventory & Data Flow

No AI tool may be used until inventoried. The inventory is a controlled artifact reviewed monthly and is a required input to the System Security Plan (SSP).

• Recorded per tool: vendor, hosting region, model provider and subprocessors, authentication method, data retention and training-use terms, FedRAMP status, CUI authorization (Yes/No), business owner.
• Data flow diagrams must show every path where prompts, files, code, or telemetry leave the enclave boundary.
• Tools processing CUI must be FedRAMP Moderate (or equivalent) with a DFARS 252.204-7012 flowdown and cloud-incident-reporting commitment; commercial consumer tiers are prohibited for CUI.
• Unapproved AI endpoints are blocked at the egress proxy and via endpoint application control; discovery scans run weekly.

Risk Assessment Methodology

Risks are scored using NIST SP 800-30 likelihood × impact on a 5×5 matrix. Impact considers CUI confidentiality first, then mission integrity and availability.

• Likelihood: 1 Rare, 2 Unlikely, 3 Possible, 4 Likely, 5 Almost Certain.
• Impact: 1 Negligible, 3 Moderate (limited internal harm), 5 Severe (CUI spillage, contract loss, DoD reporting obligation).
• Risk score = L × I. Treatment thresholds: 1–6 Low (accept/monitor), 8–12 Moderate (mitigate within 90 days), 15–25 High (mitigate within 30 days or prohibit the use case).
• Assessments are re-run on new tool onboarding, model or terms-of-service change, incident, and at minimum annually.
• Unmitigated Moderate/High risks become POA&M items with milestones, owners, and completion dates.

AI Risk Register

Ten inherent risks assessed for a defense contractor operating generative AI adjacent to a CUI enclave. Scores are inherent (pre-treatment); residual scores are tracked in the live register maintained by the ISSM.

Control Implementation for AI

Existing 800-171 controls are extended — not duplicated — to cover model interactions.

• Access Control (3.1): AI tools authorized for CUI are behind SSO with MFA and role-scoped access; no shared or personal accounts; session data confined to the enclave.
• Awareness & Training (3.2): annual AI acceptable-use module covering prompt hygiene, marking, hallucination risk, and reporting; role-based training for developers using copilots.
• Audit & Accountability (3.3): prompt/response logging for CUI-authorized tools, retained per the audit retention standard and reviewed for anomalous data volume.
• Configuration Management (3.4): AI features disabled by default in approved SaaS; enablement follows change control with documented security impact analysis.
• Identification & Authentication (3.5): API keys stored in the secrets manager, rotated at least every 90 days, never embedded in prompts, notebooks, or repositories.
• Incident Response (3.6): AI disclosure scenarios embedded in the IR plan and exercised annually; 72-hour DoD reporting path preserved for CUI incidents.
• Media Protection (3.8): model outputs derived from CUI inherit CUI marking and handling; exports restricted to approved repositories.
• System & Communications Protection (3.13): TLS-enforced egress via proxy allowlist; DLP inspection of prompts for CUI indicators and marking strings.
• System & Information Integrity (3.14): model outputs used in code, engineering, or contract deliverables require documented human review before release.

Acceptable Use Rules for Generative AI

• Never paste CUI, ITAR/EAR technical data, export-controlled drawings, or contract deliverables into a tool not explicitly CUI-authorized in the inventory.
• Treat every prompt as potentially retained and human-reviewed by the vendor unless contract terms prove otherwise.
• AI-generated code must pass SAST, dependency scanning, and license review before merge; a human engineer owns the commit.
• AI output may inform but never solely determine security decisions, personnel actions, or contractual representations.
• Disclose material AI assistance in deliverables where the contract or customer requires it.
• Consumer accounts, personal devices, and unmanaged browser extensions are prohibited for any company work.

Monitoring, Metrics & Continuous Improvement

• Monthly: shadow-AI discovery report, egress allowlist deltas, DLP prompt-block counts.
• Quarterly: risk register review with the AI Review Board; residual risk briefed to the Senior Accountable Official.
• Annually: full reassessment, tabletop exercise including an AI CUI-disclosure scenario, and plan revision.
• Key metrics: % AI tools inventoried, % personnel trained, mean time to detect unapproved AI use, count of DLP prompt blocks, open AI POA&M items past due.

AI Incident Response

• Detect — DLP alert, user report, egress anomaly, or vendor notification.
• Contain — revoke tokens, disable the integration, block the endpoint, preserve prompt/response logs.
• Assess — determine whether CUI was involved; if yes, activate the DFARS 252.204-7012 72-hour reporting path to DIBNet.
• Eradicate & Recover — remove data via vendor deletion request, obtain written confirmation, re-baseline affected accounts.
• Learn — root-cause analysis, register update, control change, and targeted retraining within 30 days.