AI Governance & Risk

Wishlist Share

Lifetime course access

About Course

Govern how your organization uses AI: inventory AI systems, assess their risks and map controls to frameworks like the NIST AI RMF and ISO/IEC 42001.

What you’ll do

  • Build an inventory of AI systems and uses
  • Assess AI risks such as data leakage, bias and misuse
  • Map controls to the NIST AI RMF and ISO/IEC 42001
  • Write an AI use policy leadership can adopt
  • Brief a board on AI risk in one page

An elective on the vCISO Pathway, aligned with the DoD 8140 work role AI Risk & Ethics Specialist (733).

Taught by practitioners who do this work every day.

What you earn

  • A Cover6 certificate showing 20 CPE hours, your completion date and a certificate ID anyone can check at cover6solutions.com/verify. CPE hours may be submitted to your certifying body (CompTIA, ISC2, ISACA and others) according to its rules. Each body decides what it accepts.
  • A portfolio piece: an AI governance package (inventory, risk and impact assessment, AI use policy, control map and one-page board brief) scored by the AI grader against a published rubric.
  • Electives add CPE and portfolio work; they don’t grant a level.

Where it leads

CISO Prep, the next rung on the vCISO Pathway.

Show More

Course Content

Welcome & Orientation
<p>Start here. You'll meet Odapeeka State University, the people you work for, and the AI systems you'll govern for the rest of the course.</p>

  • Lesson 0.1 — What this course is
  • Lesson 0.2 — Odapeeka State and how the labs work
  • Lab 0 — Read the charge memo

Why AI Governance Now
<p><strong>Maps to:</strong> NIST AI RMF 1.0 GOVERN 1, GOVERN 2 · ISO/IEC 42001:2023 clauses 4–5 · DCWF 733 (educate AI actors; communicate AI risk to stakeholders) · DCWF 753 (promote awareness of AI benefits and limits)</p> <p>AI didn't arrive as one project with a sponsor and a budget. It arrived inside products you already own, through tools employees signed up for on their own, and in systems a team built quietly because it worked. This topic explains why that calls for governance and who owns what.</p>

AI System Inventory & Classification
<p><strong>Maps to:</strong> NIST AI RMF GOVERN 1.6, MAP 1, MAP 2 · ISO/IEC 42001:2023 clause 4, Annex A.4 · NIST CSF 2.0 ID.AM · NIST SP 800-53 Rev. 5 CM-8, PM-5 · DCWF 753 (identify viable AI projects)</p> <p>You can't govern what you haven't found. This topic teaches you to find AI, including the AI nobody told you about, record it in a usable inventory, and tier it so your effort goes where the risk is.</p>

NIST AI RMF 1.0 and the Generative AI Profile
<p><strong>Maps to:</strong> NIST AI RMF 1.0 (NIST AI 100-1) GOVERN, MAP, MEASURE, MANAGE · NIST AI 600-1 · DCWF 733 (AI risk assessments; risk management plans)</p> <p>The NIST AI Risk Management Framework is the working method for the rest of this course. This topic teaches its structure, its four functions and its generative AI companion, then has you use it to measure where Odapeeka stands.</p>

How AI Systems Fail and Get Attacked
<p><strong>Maps to:</strong> NIST AI 600-1 (information security, data privacy, confabulation, harmful bias, intellectual property, value chain) · NIST AI RMF MEASURE 2.7, MEASURE 2.11, MAP 4 · OWASP Top 10 for LLM Applications (2025) · MITRE ATLAS · DCWF 733 (AI architecture security reviews; gap identification)</p> <p>Governance decisions are only as good as your understanding of what can go wrong. This topic is the security and failure view: how data leaks, how models get manipulated, and how they fail even when nobody attacks them.</p>

ISO/IEC 42001, the EU AI Act and the Rules That Already Apply
<p><strong>Maps to:</strong> ISO/IEC 42001:2023 clauses 4–10, Annex A · EU AI Act (Regulation (EU) 2024/1689) risk tiers · NIST AI RMF GOVERN 1.1, MAP 1.1 · DCWF 733 (measure compliance with ethical principles and requirements)</p> <p>The AI RMF tells you how to manage AI risk. This topic covers the two other things auditors and counsel will ask about: a management system you can be certified against, and the laws that set hard requirements. We teach them as inputs to risk decisions. Legal determinations stay with counsel.</p>

AI Risk & Impact Assessment
<p><strong>Maps to:</strong> NIST AI RMF MAP 1–5, MEASURE 1–3, MANAGE 1 · ISO/IEC 42001:2023 clause 6.1 (risk assessment, treatment, impact assessment), Annex A.5 · NIST SP 800-30 Rev. 1 (risk assessment method) · DCWF 733 (AI risk assessments; risk management plans)</p> <p>This is the core skill of the course. You'll assess AdmitRank end to end: context, risks, impacts, evidence, treatment and a go/no-go recommendation, then get a named leader to own the result.</p>

The AI Use Policy
<p><strong>Maps to:</strong> NIST AI RMF GOVERN 1, GOVERN 2.2 · ISO/IEC 42001:2023 clause 5.2, Annex A.2, A.9 · NIST CSF 2.0 GV.PO, PR.AT · NIST SP 800-53 Rev. 5 PL-4, AT-2 · DCWF 753 (promote awareness of AI benefits and limits)</p> <p>A policy is the cheapest control you have and the one people read least. This topic shows you how to write an AI use policy that answers the questions people actually have, then has you fix a bad draft.</p>

Mapping AI Risk to the Security Program You Already Run
<p><strong>Maps to:</strong> NIST CSF 2.0 (GV, ID, PR, DE, RS) · NIST SP 800-53 Rev. 5 · ISO/IEC 42001:2023 Annex A · NIST AI RMF MANAGE 1.3 · DCWF 733 (gap identification; risk management plans)</p> <p>You don't need a second security program for AI. You need to find where AI risk lands in the one you have, extend the controls that almost fit, and add the few that don't exist yet. This topic shows you how, and your control map becomes a capstone component.</p>

Third-Party AI Due Diligence
<p><strong>Maps to:</strong> NIST AI RMF GOVERN 6, MAP 4, MANAGE 3 · ISO/IEC 42001:2023 Annex A.10 · NIST CSF 2.0 GV.SC · NIST SP 800-53 Rev. 5 SA-4, SA-9, SR-6 · DCWF 733 (assessments across acquisition and deployment)</p> <p>Most of Odapeeka's AI is bought, not built. This topic extends your vendor risk process to AI: the questions to ask, the answers that should worry you, and the contract terms that turn promises into obligations.</p>

Monitoring AI and Handling AI Incidents
<p><strong>Maps to:</strong> NIST AI RMF MEASURE 2.4, MEASURE 3, MANAGE 2.4, MANAGE 4 · ISO/IEC 42001:2023 clause 9, Annex A.6, A.8 · NIST CSF 2.0 DE.CM, RS.MA, RS.CO · NIST SP 800-53 Rev. 5 CA-7, SI-4, IR-4, IR-8 · DCWF 733 (communicate AI risk results to stakeholders)</p> <p>An assessment describes a system on the day you assessed it. AI systems keep changing after that: the data drifts, the vendor swaps the model, people find new ways to misuse it. This topic covers watching AI in production and responding when it goes wrong.</p>

Reporting AI Risk to Leadership and the Board
<p><strong>Maps to:</strong> NIST AI RMF GOVERN 2.3, GOVERN 4.2, MANAGE 4.3 · ISO/IEC 42001:2023 clauses 5.1, 9.3 (management review) · NIST CSF 2.0 GV.OV (oversight) · DCWF 733 (communicate AI risk results to stakeholders)</p> <p>Everything you've built ends up in front of people who have ten minutes and no appetite for jargon. This topic is about giving a board what it needs to oversee AI risk, on one page.</p>

Capstone: The Odapeeka AI Governance Package (graded)
<p>It's early November at Odapeeka State. The Board meets on December 10. Your labs gave you working drafts. Now you assemble the real package, and it includes a system you haven't assessed yet.</p>

Final Check & Your Next Step

Student Ratings & Reviews

No Review Yet
No Review Yet
Shopping Cart
Scroll to Top