Worked Assessment Report Example

Scope of Assessment

This assessment evaluates Athena Logistics' implementation of the NIST AI Risk Management Framework across all four core functions (GOVERN, MAP, MEASURE, MANAGE) for their SupplyGuard v4.1 system. SupplyGuard is an anomaly detection engine used to identify supply chain disruptions across 14 distribution centers serving federal logistics contracts.

Evidence Sources

1. Cryptographic witness evidence (SWT3): 20 SWT3 witness anchors covering 16 procedures, assessed via the audit portal over a 78-day assessment window. Each anchor was independently verified using SHA-256 fingerprint recomputation.
2. Document review: AI governance charter (v3.0, dated 2026-05-01), risk register, model validation reports, incident response plan, and AI system inventory.
3. Interviews: 3 sessions with the Chief Risk Officer, AI Engineering Lead, and Head of Supply Chain Operations. Interview notes on file (ref: PRA-INT-0312-01 through 03).

Overall Risk Posture

MANAGED WITH IDENTIFIED GAPS. 3 of 4 RMF functions are substantially addressed. One gap identified in MANAGE (incident reporting not yet operational). One area for improvement in MEASURE (adversarial testing scope).

Assessment Framework

This assessment was conducted per PRA internal procedure PRA-QMS-P-008 "AI Risk Management Assessment Using Cryptographic Evidence" (Rev 1.0, effective 2026-06-01), aligned with NIST AI RMF (AI 100-1) and NIST AI RMF Playbook guidance.

SWT3 Evidence Verification Method

SWT3 witness anchors were verified using a two-step process:

1. Portal verification: All 20 anchors were checked via the public verifier at sovereign.tenova.io/verify. Each returned VALID.
2. Independent recomputation (5 anchors): Five anchors (one per RMF function plus one cross-cutting) were selected for manual SHA-256 fingerprint recomputation using OpenSSL 3.x. All five matched.

Interoperability Verification

The SWT3 fingerprint formula is implemented in 7 independent SDK implementations and verified against a shared test vector suite. Independent recomputation used OpenSSL 3.x, confirming vendor-independent reproducibility.

Temporal Scope

The assessment window was defined as 2026-07-15 through 2026-10-01 (78 days). Of the 16 procedures assessed, 14 had continuous anchor coverage. Two procedures (AI-REDTEAM.1 and AI-INCIDENT.1) had absent coverage, documented in the MEASURE and MANAGE findings below.

Evidence Sufficiency Determination

SWT3 anchors were accepted as sufficient evidence for automated monitoring and operational control objectives. Governance structure, organizational culture, and stakeholder engagement objectives were assessed through document review and interviews. Where both sources covered the same objective, both were considered.

Risk Posture: MANAGED WITH IDENTIFIED GAPS

SupplyGuard v4.1 demonstrates substantial alignment with the NIST AI Risk Management Framework across GOVERN, MAP, and MEASURE functions. One gap (GAP-001) was identified in the MANAGE function regarding incident reporting. One area for improvement was noted regarding adversarial testing frequency.

The assessment body recommends:

1. Address GAP-001 within 60 days (target: 2026-12-05)
2. Submit completed incident response plan and tabletop exercise results for review
3. Follow-up assessment of MANAGE 4.1 (January 2027)

The use of SWT3 cryptographic witness evidence provided continuous assurance over the 78-day window for 14 of 16 procedures assessed, offering stronger temporal coverage than periodic manual evaluations.

SWT3 witness anchors cited in this report follow the format:

Any anchor can be independently verified at sovereign.tenova.io/verify with no account or authentication. The SHA-256 fingerprint formula is published in the SWT3 Protocol Specification and can be recomputed using any standard cryptographic library.