SBA · SBA-21 · record R3180

Security Team Productivity Enhancement

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2026-01-01 (day precision)Source: 01/01/2026 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Cybersecurity
Operational functions: Software development assistance Derived by keyword rules; see methodology

Problem the AI is intended to solve

Manual processing and analysis is resource-intensive and may lack the speed and consistency needed for effective operations.

Expected benefits

Faster content creation, improved consistency, reduced staff time on routine writing tasks, and enhanced quality of generated content.

System outputs

Microsoft Security Copilot helps security professionals detect, investigate, and respond to cyber threats faster and more accurately.

Technology

AI classification: Generative AISource: Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).
System name(s): Every Microsoft product
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): MS Security Copilot
Vendors (standardized): Microsoft

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Yes
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: Not applicable - System does not involve individual-level decision-making
Training and evaluation data: Commercial vendor-managed training data. Specific training data sources are proprietary to the vendor.
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in placeSource: a) Yes

AI impact assessmentReported in placeSource: a) Yes

Independent reviewReported in placeSource: a) Yes – by another appropriate agency office or reviewer not directly involved in the AI’s development

Ongoing monitoringReported in placeSource: a) Yes, sufficient monitoring protocols have been established

Operator trainingReported in placeSource: a) Yes, sufficient and periodic training has been established

Fail-safeNot applicableSource: b) Not applicable

Appeal processNot applicableSource: b) Not applicable

User and public consultationReported in placeSource: Direct usability testing with end users, regular feedback sessions with operators, and incorporation of user suggestions into system updates. Ongoing consultation with program stakeholders and subject matter experts.Flag: free-text answer

Potential impacts and how they were identified

Potential impacts include consistency of information provided to stakeholders. Impacts identified through user testing and accuracy reviews. Mitigation includes human oversight and feedback mechanisms.