SBA · SBA-35 · record R3191

AI Incident Summarization

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2025-12-12 (day precision)Source: 12/12/2025 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Service Delivery
Operational functions: Summarization Derived by keyword rules; see methodology

Problem the AI is intended to solve

Security analysts spend 15–30 minutes manually reading hundreds of work notes, logs, and audit trails to understand the status and history of each security incident, slowing response and shift handoffs.

Expected benefits

One-click incident summarization reduces analyst documentation time by 15–30 minutes per incident, improves shift handoff quality, and enables faster incident response through structured summaries.

System outputs

Concise AI-generated summaries of security incidents broken into three components: Issue identification, Contextual Details of the event, and Actions Taken by responders.

Technology

AI classification: Generative AISource: Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).
System name(s): ServiceNow Security Incident Response (SIR)
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): ServiceNow, Inc.
Vendors (standardized): ServiceNow

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Yes
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: ServiceNow platform incident records including work notes, activity logs, and audit trails. Commercial vendor-managed AI models.
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in progressSource: b) In-progress

AI impact assessmentReported in progressSource: b) In-progress

Independent reviewReported in progressSource: d) In-progress

Ongoing monitoringReported in progressSource: b) Development of monitoring protocols is in-progress

Operator trainingReported in progressSource: b) Establishment of sufficient and periodic training is in-progress

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationReported in progressSource: Planning includes direct usability testing with SOC analysts during pilot phase, establishment of feedback mechanisms through security operations channels, and iterative refinement based on analyst accuracy assessments.Flag: free-text answer

Potential impacts and how they were identified

Impact assessment in progress. Primary risks include potential for AI to mischaracterize incident details or omit critical context. Mitigated by requiring human analyst review of all AI-generated summaries before use. Identified through vendor documentation review and internal security operations assessment.