Cross-reference
MITRE AI Maturity Model
20 items: 20 met directly by a control at Level 3, 0 partly, 0 deliberately out of scope.
| Ref | Item (our description) | Controls | Note |
|---|---|---|---|
| P1.1 | Responsible, Governable and Contestable: responsible use is governed and enforced, people are accountable, and AI outcomes can be challenged | RSK-04 direct, GOV-08 direct, RSK-08 direct, GOV-05 direct, RSK-05 partial, GOV-02 partial, STR-02 direct, GOV-01 partial, RSK-07 partial | The obligations register (RSK-04) identifies the regulatory and organisational rules that apply; compliance checks and exceptions (GOV-08) enforce them; named owners for each use (GOV-05) and the accountable executive (GOV-02) carry accountability; RSK-08 gives affected people a route to challenge an outcome with authority to change it; RSK-05 applies the ethical principles through a review route that can stop a use. STR-02 names the kinds of decision that must always be taken by a person, alongside ruled-out areas, with prohibited uses (GOV-01) and per-use human oversight (RSK-07) in support. |
| P1.2 | Transparency: what an AI system produced, and why, can be traced, explained and justified to users and to the people affected | RSK-08 direct, DAT-06 direct, TEC-05 direct, TEC-02 direct, GOV-09 partial, GOV-10 partial, RSK-07 partial, DAT-08 partial, OPM-06 partial | RSK-08 gives affected people notice and a meaningful explanation; DAT-06 keeps inputs, outputs and supported decisions retrievable; TEC-05 versions models, prompts and data together and documents how each version works and its limits, which makes outputs traceable; DAT-08 links training data to models. TEC-02 reference patterns build in explainability and traceability of outputs from the start, and mark AI-generated content. GOV-09 publishes records of use, GOV-10 covers disclosure of AI-generated content, and OPM-06 brings user research into design. Still beyond Level 3: involving affected people (not only users) through the life of a use. |
| P1.3 | Human-Centric, Fair and Equitable: AI respects rights, diversity and well-being, with deliberate steps against unfair bias and discrimination | RSK-06 direct, RSK-03 direct, MON-02 partial, RSK-05 partial, DAT-05 partial, DAT-03 partial, GOV-04 partial | RSK-06 sets an organisation-wide approach to defining groups at risk, fairness measures, testing and mitigation; RSK-03 assesses equality, rights, safety and wider societal effects before go-live. Adopted principles (RSK-05), fairness in data use (DAT-05), representative data (DAT-03) and a diverse oversight forum (GOV-04) support it. Monitoring fairness in live use, which MITRE puts at its Managed level, is in our baseline through MON-02 Level 3; acting on fairness breaches is RSK-06 Level 4. |
| P2.1 | AI Strategic Plan: an approved direction for AI with leadership, policy and funding behind it | STR-01 direct, STR-03 direct, GOV-02 direct, GOV-01 partial, STR-06 partial, STR-04 partial, STR-08 partial, CUL-02 partial, STR-07 partial | STR-01 is the approved ambition tied to organisational objectives, STR-03 the funding approach and GOV-02 the accountable leadership role. The AI policy (GOV-01), roadmap (STR-06), value case (STR-04), review cycle (STR-08), communication plan (CUL-02) and staff input to strategy (STR-07) supply the rest. Tracking outcomes against objectives sits at our Level 4 (MON-03, MON-08). |
| P2.2 | Partnerships: working relationships with industry, academia, government and research bodies that bring in other perspectives and build responsible capability | OPM-08 direct, STR-07 partial, STR-05 partial | OPM-08 requires a stated approach to collaboration, taking part in peer groups or partnerships, and sharing within agreed rules on data and intellectual property; its Level 3 also requires partnership agreements to state the adopted ethical principles and the data and intellectual property terms, and the approach to say which kinds of partner are sought and why, which covers responsible use in partnerships and a deliberate choice of partners. STR-07 lets partners shape the strategy and STR-05 tracks peer practice. |
| P2.3 | Governance: structures, processes, policies and audits that keep AI in line with the organisation's ethics, regulations and policies | GOV-04 direct, GOV-02 direct, GOV-08 direct, MON-05 direct, GOV-01 partial, GOV-07 partial, RSK-05 partial, RSK-04 partial, GOV-09 partial, MON-08 partial | The oversight forum with recorded decisions (GOV-04), the accountable executive (GOV-02), compliance checks (GOV-08) and independent assurance reviews (MON-05, the audit element) evidence the substance. Policy (GOV-01), integration with existing governance (GOV-07), the ethics review route (RSK-05, comparable to an expert review board), regulator contact (RSK-04), published records (GOV-09) and board reporting (MON-08) support it. Publishing governance results on fairness, privacy and security is beyond our Level 3; GOV-09 publishes records of each use, not governance performance. |
| P3.1 | Culture: shared norms and values that make the organisation ready to accept the change AI brings and to take measured risks | CUL-01 direct, CUL-05 direct, CUL-04 direct, CUL-02 partial, CUL-06 partial, POR-06 partial, PPL-01 partial | CUL-01 manages adoption as planned change with sponsors and resource; CUL-05 (no-blame review of what did not work) and POR-06 (safe experimentation) build tolerance of risk; CUL-04 makes it safe to raise concerns. Communication (CUL-02), champions (CUL-06) and literacy (PPL-01) carry responsible use norms to staff. The CUL-01 change plan starts from an assessment of the current culture and what has to change; measuring progress sits at CUL-01 Level 4. |
| P3.2 | Organizational Structure: AI structures, roles and working procedures are defined, documented and used | OPM-01 direct, GOV-05 direct, GOV-03 partial, GOV-02 partial, PPL-03 partial, GOV-04 partial | OPM-01 sets central and local responsibilities with named teams, resourcing and interfaces; GOV-05 names the owners for each use. Decision rights (GOV-03), the accountable executive (GOV-02), specialist roles (PPL-03) and the forum's terms of reference (GOV-04) complete the documented structure. |
| P3.3 | Workforce Development: training, recruitment and planning for the effect of AI on careers, to build and reshape the AI workforce | PPL-04 direct, PPL-05 direct, PPL-06 direct, PPL-07 direct, PPL-03 partial, PPL-01 partial, PPL-02 partial | Skills assessment (PPL-04), role-based learning (PPL-05), workforce planning including reskilling and redeployment (PPL-06) and recruitment and retention (PPL-07) evidence the substance, with careers (PPL-03), literacy (PPL-01) and leadership learning (PPL-02). PPL-07 also covers the diversity of AI teams, alongside the diverse oversight forum (GOV-04) and research participants (OPM-06). |
| P4.1 | AI Innovation: research, engineering practice and design principles for how people and AI work together, used to bring AI into operations | OPM-06 direct, POR-06 partial, POR-04 partial, RSK-07 partial, STR-05 partial, POR-01 partial | OPM-06 delivery standards, applied to all AI delivery, include AI-specific engineering practice and the design of how people and AI share work, with subject matter experts in design and evaluation, alongside multidisciplinary teams and user-centred methods. Safe experimentation (POR-06), stage gates (POR-04), oversight designed for each use (RSK-07), horizon scanning (STR-05) and idea intake (POR-01) bring AI into operations. |
| P4.2 | Test and Evaluation: AI-specific testing standards verify and validate that each solution meets its requirements | TEC-06 direct, RSK-06 direct, SEC-06 partial, MON-01 partial, SEC-02 partial, MON-05 partial, SEC-04 partial | TEC-06 sets acceptance criteria in advance, representative and independent test data, robustness and harmful output testing, and sign-off before every release; SEC-06 adds security testing against the threat model and checks that personal or sensitive information is not disclosed; RSK-06 adds bias testing before release. MON-01 supplies the measures, SEC-02 the threats to test against, MON-05 independent review. Auditing test results is MITRE's Managed level and our MON-05. |
| P4.3 | AI Platforms: a defined set of architecture, standards, infrastructure and tools to build, integrate and run AI | TEC-01 direct, TEC-02 direct, TEC-03 partial, TEC-04 partial, POR-06 partial, SEC-01 partial, TEC-07 partial | TEC-01 maintains approved tools and platforms with conditions of use, including the environments and toolchains used to build, test and run AI where it is built in house, each with an owner and support; TEC-02 the reference architecture. Hosting requirements (TEC-03), supported integration (TEC-04), approved experimentation environments (POR-06), security logging (SEC-01) and refresh planning (TEC-07, which MITRE places at its Managed level) support it. |
| P5.1 | Architecture: how the organisation takes in, stores, organises and maintains its data, with common definitions, in a way that serves AI | DAT-01 direct, DAT-04 partial, TEC-02 partial | DAT-01 Level 3 requires the data strategy to be backed by an approved data architecture covering how data used by AI is taken in, stored, organised and maintained, with shared definitions. The catalogue records meaning, coverage and limits (DAT-04), and the AI reference architecture shows how AI fits the estate (TEC-02). |
| P5.2 | Security and Privacy: privacy and data security are built in and upheld by the people who design, use and oversee AI | DAT-05 direct, SEC-04 direct, DAT-07 direct, RSK-03 partial, SEC-01 partial, SEC-02 partial, TEC-03 partial, RSK-04 partial | Lawful basis, purpose and fairness with notice to the people concerned (DAT-05), leakage rules backed by technical measures (SEC-04) and least-privilege access and sharing agreements (DAT-07) evidence the substance; privacy impact (RSK-03), the security baseline and monitoring (SEC-01), threat modelling (SEC-02) and data location (TEC-03) support it. DAT-05 also handles individual rights requests, including where personal data has been used to train a model, with the obligations register (RSK-04) in support. |
| P5.3 | AI Data Governance: managing data for AI so it is available, usable and sound, compliant, and guarded against bias | DAT-02 direct, DAT-03 direct, DAT-08 partial, RSK-06 partial, DAT-05 partial, GOV-07 partial, SEC-03 partial, MON-05 partial | Owners and stewards with defined responsibilities (DAT-02) and quality requirements, including representativeness, assessed before use and at intervals (DAT-03) evidence the substance. Provenance, including preparation, labelling and synthetic data (DAT-08), bias management (RSK-06), lawful use (DAT-05), the data governance step in existing governance (GOV-07), supply-chain security for external data (SEC-03) and independent review (MON-05) support it. Data audits as a distinct activity are not required by name; DAT-03 reassessment and MON-05 review stand in for them. |
| P5.4 | Accessibility: an agreed framework and legal agreements for sharing data securely inside and outside the organisation | DAT-07 direct, DAT-04 partial, DAT-01 partial, DAT-02 partial | DAT-07 requires sharing with other systems and organisations to follow documented agreements, approved by the data owner. The catalogue (DAT-04), data strategy actions (DAT-01) and owners who approve use (DAT-02) cover making data available. Our controls lean towards limiting access; the enabling side (freeing data from single applications and breaking down silos) rests on DAT-01 and DAT-04. |
| P6.1 | Usage and Adoption: uses of AI are identified, documented and built into ways of working so they deliver strategic outcomes | POR-03 direct, POR-05 direct, CUL-07 direct, POR-02 partial, RSK-03 partial, TEC-04 partial, TEC-05 partial, STR-04 partial, MON-03 partial | The pipeline register (POR-03) and proportionate business cases (POR-05) document each use; CUL-07 supports teams through process change and tracks adoption. Prioritisation (POR-02), the assessment of who is affected (RSK-03), integration with core systems (TEC-04), documentation of how each version works (TEC-05) and the value case (STR-04) support it. Measuring each use against outcome indicators is MITRE's Managed level and our MON-03 and MON-01. |
| P6.2 | Solution Monitoring: tools and processes watch deployed AI for changes in performance, fairness, security and trust, and act on problems | MON-02 direct, SEC-01 partial, MON-04 partial, OPM-07 partial, MON-06 partial, RSK-06 partial | MON-02 monitors every live use for accuracy, drift, misuse and unexpected behaviour against thresholds with named responders, and also against the fairness measures set under RSK-06 and for personal or sensitive data appearing in outputs, which covers the unfair outcomes and leakage of personal data that MITRE's Defined level names. SEC-01 puts every live use within security monitoring; MON-04 and OPM-07 handle what is found; MON-06 gathers feedback; RSK-06 Level 4 acts on fairness breaches. |
| P6.3 | Robust and Reliable: AI is specified, designed and tested through its whole life to work as intended, avoid failure and meet quality requirements | TEC-06 direct, TEC-05 partial, MON-02 partial, OPM-09 partial, MON-01 partial, OPM-07 partial | TEC-06 tests robustness against agreed criteria, defines and enforces intended operating conditions, and reviews the testing approach against live performance. TEC-05 documents intended purpose and allows rollback; MON-02 watches live behaviour against operating conditions; OPM-09 provides tested fallbacks; MON-01 sets the quality measures; OPM-07 manages change in live use. |
| P6.4 | User Trust: diligent processes and measures help people place the right amount of trust in AI, and correct over- or under-reliance | MON-01 direct, CUL-08 partial, MON-06 partial, RSK-03 partial, PPL-08 partial, TEC-05 partial, RSK-07 partial, RSK-08 partial | MON-01 Level 3 requires the measures for each use to include reliance (how often outputs are accepted, checked or overridden) compared with measured accuracy, with a named owner, so over- and under-reliance show up. Correction draws on guidance on each tool's limits (PPL-08), trained reviewers (RSK-07), version documentation of limitations (TEC-05) and explanations for affected people (RSK-08); organisation-level trust (CUL-08), feedback per use (MON-06) and over-reliance in the impact assessment for public-facing assistants (RSK-03) support it. Monitoring trust measures across all uses is MITRE's Managed level. |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.