Cyber Authorization Memo Generation

Overview

Development stage

In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.

High-impact designation

High-impactSource: a) High-impact

Impact justification

Not reported

Start date

Not reported

Withheld from public reporting

Not reported

Mission

Topic area

Cybersecurity

Operational functions

Cyber threat detection Derived by keyword rules; see methodology

Problem the AI is intended to solve

VA cybersecurity staff are challenged with managing and staying updated with an extensive array of documentation related to policies, processes, directives, and frameworks (which are essential for maintaining compliance and ensuring the security and privacy of VA information systems). The VA Risk Management Framework (RMF) program continues to rely on human decision-making for risk-based decisions. This human-centric approach requires extensive involvement from various roles and generation/consumption of large amounts of artifacts and staffing resources.

Expected benefits

This tool will significantly reduce the time required for memo generation, saving hours of work for each memo signed. By implementing AI in these use cases, EHRM aims to streamline processes, improve efficiency, and reduce the workload on both cyber personnel and administrative staff.

System outputs

Compliance checklist results with policy references and recommendations. Automated authorization documentation.

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

Not reported

Custom-developed code

Not reported

Public source code

Not reported

Sourcing

How it was built

Not reported

Vendor (as reported)

Not reported

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Not reported

Privacy Impact Assessment

Not reported

Authorization to Operate

Not reported

Demographic features

Not reported

Training and evaluation data

Not reported

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported