Assign decision authority and third-party accountability: Which missing control most directly reflects NIST

GOVERN establishes authority, accountability, roles, escalation, resources, and third-party controls across the other functions.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Document another mitigation response, residual-risk decision, and monitoring plan.

   MANAGE documents treatment and residual risk, but that documentation does not itself establish who has decision authority or third-party accountability.
2. Run another benchmark test for the vendor’s system.

   Benchmarking is primarily a MEASURE activity, and the stem states that testing is complete; it does not assign authority or accountability.
3. Revisit the procurement context.

   MAP is already complete, so revisiting context does not directly address the stated missing organizational authority and accountability control.
4. Assign decision authority and third-party accountability. ✓

   GOVERN assigns roles, decision authority, escalation, resources, and accountability for third parties across the other risk-management functions.

How to remember it

GOVERN establishes authority, accountability, roles, escalation, resources, and third-party controls across the other functions.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Obtain use-case assurance: What additional conclusion is required for this specific use case? →
• Map purpose, users, affected workers, and foreseeable uses: Which control is most direct? →
• Test subgroups and record uncertainty: Which control is most direct? →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →