SBA · SBA-31 · record R3187

Predictive AIOps

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2025-12-12 (day precision)Source: 12/12/2025 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Information Technology
Operational functions: Forecasting and prediction Derived by keyword rules; see methodology

Problem the AI is intended to solve

IT operations teams are overwhelmed with massive volumes of alerts and events from diverse monitoring tools, creating alert fatigue and slowing incident response. Manual correlation of events, log analysis, and root cause identification is time-consuming and error-prone. Reactive problem-solving leads to prolonged outages, high Mean Time to Resolution (MTTR), and degraded service availability. Traditional static thresholds fail to adapt to dynamic IT environments.

Expected benefits

Reduces alert noise by up to 90% through intelligent event correlation and anomaly detection. Decreases Mean Time to Resolution (MTTR) by 30-50% via automated root cause analysis and remediation workflows. Enables proactive incident prevention through predictive analytics that identify potential issues before they cause outages. Provides self-healing capabilities with automated remediation reducing manual intervention. Improves service availability and operational efficiency. Shifts IT operations from reactive firefighting to proactive problem prevention. Centralizes insights and actions on single platform, breaking down data silos.

System outputs

AI-powered IT Operations Management (ITOM) platform that applies machine learning, predictive analytics, and automation to IT infrastructure monitoring and incident management. Automatically analyzes events, logs, metrics, and telemetry data to detect anomalies, predict service disruptions, identify root causes, and trigger automated remediation. Provides intelligent event correlation to reduce alert noise, adaptive thresholds for dynamic environments, and self-healing capabilities. Input: IT infrastructure events, logs, metrics, performance data from monitoring tools. Output: anomaly detection alerts, predictive insights, root cause analysis, automated remediation workflows, incident tickets, and performance dashboards.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): ServiceNow IT Operations Management (ITOM)
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): ServiceNow, Inc.
Vendors (standardized): ServiceNow

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Yes
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: Commercial vendor-managed training data with IT infrastructure telemetry and historical incident data
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in placeSource: a) Yes

AI impact assessmentReported in placeSource: a) Yes

Independent reviewReported in placeSource: a) Yes – by another appropriate agency office or reviewer not directly involved in the AI’s development

Ongoing monitoringReported in placeSource: a) Yes, sufficient monitoring protocols have been established

Operator trainingReported in placeSource: a) Yes, sufficient and periodic training has been established

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationOther or ambiguous answerSource: Conducted pilot deployment with IT operations and NOC teams, collected feedback on anomaly detection accuracy and alert quality, monitored MTTR improvements and false positive rates, established feedback loops through incident post-mortems and operations reviews, incorporated IT staff input on automated remediation workflows, and continuously refined ML models based on operational experience and infrastructure changes.Flag: free-text answer

Potential impacts and how they were identified

Potential impacts include IT service availability, incident response timing, automated remediation actions affecting IT infrastructure, and alert prioritization decisions. Impacts identified through vendor documentation, pilot testing with IT operations teams, analysis of automated remediation scenarios, and consultation with infrastructure teams. Mitigation includes human oversight of automated remediation, adaptive thresholds that adjust to environment changes, defined escalation protocols for critical incidents, continuous monitoring of ML model accuracy, and fail-safe mechanisms requiring human approval for high-risk actions.