A Methodology for Assessing Risk to Inform Technology Integration

Abstract

When new technology, such as artificial intelligence (AI), is introduced into an existing workflow it may impact risk by mitigating some vulnerabilities and threats in the workflow while introducing others. We present a versatile methodology for assessing the vulnerabilities and threats that impact overall risk in a workflow to inform technology integration. Our method involves both qualitative and quantitative assessment of risk and includes a formula for generating a risk score to guide technology integration. We describe our methodology and demonstrate its application to a specific workflow (the Derivative Classification review process). This work was funded by the Department of Energy (DOE) Automated Classification Tools for the Identification of Classified Information (ACTICI) program.