Page 375 - CyberSecurityEssentialsEnglish

What Do We Test Before and After Release?

TABLE 8-7: TYPES OF EVALUATION AND THEIR USE

Type of evaluation What it establishes When it is used

Does the output meet the Before release and on a sample
Task quality
acceptance criteria? afterwards.

Is performance stable across cases Before release and during
Reliability
and runs? monitoring.

Can it be manipulated or Before release and after any
Safety and security
misused? material change.

Which data is exposed, and to
Privacy At design and before release.
whom?

Does performance differ across Before release and periodically in
Fairness
groups? production.

Do people understand the limits
Usability During the pilot with real users.
and the signals?

Monitoring in Has behavior drifted since Continuously, with alert

production release? thresholds.

+ For the advanced reader: red teaming
Red teaming is an organized attempt to discover how a system can fail or be misused. It is
not limited to technical security; it may cover misinformation, bias, policy circumvention,
exceeding permissions, and the interaction between the human and the interface. Its
scope should be proportionate to the risk, and its findings must turn into controls that
can be verified.

How Is a Usable Impact Assessment Built?
An impact assessment begins by describing the boundaries of the system. Which part does

the AI provide? Does it generate text, classify, recommend, or execute? Which systems
precede and follow it? Model accuracy may be acceptable while the harm arises from a
wrong business rule, an interface that suggests false confidence, or an integration that
passes an output straight into a decision. The whole sociotechnical system must therefore

be assessed, not the model alone.

We then identify the affected parties, including those who do not use the system directly.
An employee may use a tool while the person affected is a customer, a student, a patient,

or a job applicant. Appropriate representatives of those groups should be involved in testing

374