Active

Performance Metrics

The organization shall define and track performance metrics for AI systems that provide insight into model accuracy, reliability, and effectiveness. Metrics shall include accuracy measures, precision, recall, F1 scores, and other relevant metrics appropriate for the AI system type, with metrics meaningful, actionable, and aligned with system objectives.

Requirement ID
AIG-006-R001
Parent Control
AIG-006
Domain Code
AIG

Requirement Details & Guidance

AIG-006-R001 · AIG-006
Why This Requirement Exists

This requirement exists to define and track meaningful AI performance metrics aligned with system objectives, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.

Implementation Guidance

Establish and document the process to define and track meaningful AI performance metrics aligned with system objectives. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.

Practical Application & Audit Readiness

AIG-006-R001 · Field Guidance

Business Examples

    Common Audit Findings

      Common Mistakes

        Best Practices & Ownership

        AIG-006 · Recommended Approach

        Recommended Practices

          Typical Owner

          Cross-Mapped Regulatory Frameworks

          Harmonized Control Mappings
          FRAMEWORK CODE FRAMEWORK NAME & DETAILS FAMILY / CATEGORY VERSION ACTION
          ISO27001 ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation
          ISO
          Standard
          		 v2022 View →
          SEBI-CSCRF SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.1 DE.CM: Security Continuous Monitoring; 1.4 GV.OV: Oversight
          India
          Regulation
          		 vLatest View →
          COBIT2019 COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan.
          COBIT
          Governance Framework
          		 v2019 View →
          NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
          NIST
          Framework
          		 v2 View →
          NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-6 – MEASURES OF PERFORMANCE
          NIST
          Control Catalog
          		 vRev. 5 View →
          SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. PI1.1 – Processing Integrity – The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services.
          AICPA
          Audit Framework
          		 vLatest View →

          Parent Domain Context

          Governance Domain Baseline
          Domain Name:
          AI Governance & Model Security (AIG)
          Purpose:
          To ensure the trustworthy, secure, and ethical development and deployment of AI.
          Scope:
          Enterprise
          View

          Parent Control Context

          Control Baseline
          Control Name:
          AI Performance Monitoring & Continuous Improvement (AIG-006)
          Summary:
          Establishes AI performance monitoring including performance metrics, drift detection, model validation, accuracy monitoring, reliability monitoring, business value assessment, performance reporting, model optimization, review, and continuous improvement.
          Business Description:
          Establish and maintain processes to monitor AI model performance, effectiveness, drift, reliability, business value, operational health, and continuous improvement throughout the AI lifecycle.
          View