# AI Governance & TRiSM Program

> Scoped per engagement · AI Security · https://cisomarketplace.services/services/ai-governance-trism-program

Stand up AI governance (TRiSM): inventory AI systems, classify risk, map to EU AI Act / NIST AI RMF / ISO 42001, and operate ongoing AI risk, trust, and security management with human oversight.

## In scope

- AI system inventory & risk classification
- EU AI Act / NIST AI RMF / ISO 42001 mapping
- AI policy & oversight framework
- Model risk & bias governance
- Ongoing AI risk management

## Deliverables

- AI governance framework
- AI Act/RMF/42001 gap analysis
- AI risk register
- Oversight & policy pack

## Tiers

### Essential: scoped

Inventory and risk classification of up to 10 AI systems and a gap analysis against 1 framework chosen from EU AI Act, NIST AI RMF and ISO 42001. Delivers the inventory, risk tiers and gap list.

Limits: ai systems 10, frameworks 1

Includes:
- Up to 10 AI systems inventoried
- Risk classification per system
- Gap analysis against 1 framework
- Prioritized gap list

Excludes:
- AI policy and oversight framework
- AI risk register
- Model risk and bias governance
- Ongoing risk management

### Advanced: scoped

AI governance framework for up to 25 AI systems: inventory and classification, mapping to EU AI Act, NIST AI RMF and ISO 42001 (3 frameworks), AI policy and oversight pack, model risk and bias governance, and an AI risk register.

Limits: ai systems 25, frameworks 3

Includes:
- Up to 25 AI systems
- Mapping to 3 frameworks
- AI policy and oversight pack
- Model risk and bias governance procedures
- AI risk register

Excludes:
- Operating the program after handover
- Oversight board facilitation
- Technical model testing or red teaming

### Enterprise: scoped

Continuous AI TRiSM program with oversight board

Limits: frameworks 3, sessions 4

Excludes:
- Technical model testing or red teaming
- Legal advice or regulatory filings
- Certification audit fees

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=ai-governance-trism-program