Week 7 self-check | AI GRCA Practice Lab

WEEK 7 · NIST AI RMF · NIST MAP

Why does higher autonomy typically require more attention in MAP?

Autonomy only matters for hardware robotsIt doesn't — autonomy has no bearing on riskGreater independent action increases the consequence of an error occurring without a human catching itHigher autonomy always means lower risk

WEEK 7 · NIST AI RMF · NIST MAP

What does MAP's 'context' work primarily protect against?

Model training costsMarketing miscommunication onlyNothing — it's a formalityBuilding controls and tests for the wrong problem because the system's real use and risk weren't properly understood first

WEEK 7 · NIST AI RMF · NIST MAP

Which best reflects the relationship between MAP and MEASURE?

MAP replaces the need for MEASUREThey are unrelated and sequential-only with no feedbackMAP identifies what to test for; MEASURE then tests against that mapped context and riskMEASURE happens before MAP in every case

WEEK 7 · NIST AI RMF · NIST MAP

What is the primary purpose of the MAP function?

Establishing context: intended use, affected people, misuse and risk scenariosBoard reportingSetting risk appetite policyWriting release evidence

WEEK 7 · NIST AI RMF · NIST MAP

What's the risk of skipping 'assumptions and constraints' documentation in MAP?

No risk — assumptions rarely matterKey unverified beliefs (e.g. about data quality or supplier practices) could quietly undermine the whole risk assessmentAssumptions are always self-evidently trueThis step is purely administrative

WEEK 7 · NIST AI RMF · NIST MAP

'External dependencies' in MAP is broader than 'supplier dependencies' because it also includes:

Other environmental factors like data sources, infrastructure or partner systems the AI system relies onOnly competitor productsOnly regulatory bodiesNothing broader — they are identical

WEEK 7 · NIST AI RMF · NIST MAP

Why should 'assumptions and constraints' be explicitly documented in MAP?

Assumptions are the same as confirmed factsConstraints only matter for budget planningThey don't need documenting since they're obviousUndocumented assumptions can silently become false without anyone noticing, undermining the risk picture

WEEK 7 · NIST AI RMF · NIST MAP

'Deployment environment' in MAP includes:

Only the programming language usedThe operational, physical and organisational setting in which the system is actually usedOnly the vendor's headquarters locationOnly the marketing channel