Human Failure Vector
Human Failure Vector
1) Executive Summary
One paragraph on what happened, why it matters, and the decisive controls you propose.
2) Timeline (Key Decision Points)
- T-00: Event detected → {signal}
- T+10m: Escalation path → {who/what failed}
- T+1h: Containment → {control}
- T+24h: Assurance → {evidence}
3) Lessons Learned → Controls Mapping
| Gap | Control (NIST 800-53) | Action Owner | Evidence | Due |
|---|---|---|---|---|
| Vendor voice authentication trust | SR-3, SA-9, IA-2(12) | Third-Party Risk | Updated contract clause + attestation | 30d |
| Unvetted AI channels | RA-3, PL-8, AU-6 | Governance | AI Risk Clause enforced | 14d |
4) Governance Artifacts
- AI Risk Clause (link)
- Contractor Onboarding SOP (link)
5) Metrics & Evidence
- Success criteria: {e.g., no voice-only resets, audit log coverage ≥ 95%}
- Dashboards/logs: {where to verify}
6) Appendix
- Scope, assumptions, related incidents