{"id":"GRD-011","section":"Runtime Guardrails","requirement":"Maintain acceptable detection quality","acceptance":"Report the false-alert proportion: reviewed flagged events judged benign divided by all reviewed flagged events, over a defined window. Document the sample size and composition; under 5% where that target is adopted. Separately report the missed-detection rate using a labeled test corpus: cases expected to be flagged but not flagged divided by all cases expected to be flagged. Include results by data class.","tier":"AT0–AT4","whyItMatters":"False positives decide whether employees and the SOC tolerate a control. A noisy one gets switched off.","verificationMethod":"LT + D","verificationTest":"Review a representative sample of flagged pilot events and calculate the false-alert proportion. Separately run a labeled test corpus and calculate the missed-detection rate by data class. Record the numerator, denominator and test scope for each metric. If a denominator is zero, report the rate as not measurable.","formerly":"DAT-008","alsoIn":[],"sort":21,"adoptionContext":"Detection quality should be tested across the listed employee AI contexts because supported surfaces, payloads and user behavior can change error rates.","mappings":[{"frameworks":["csf"],"explanation":"Documented false-positive and false-negative results help identify improvements from evaluations and tests. These outcomes concern identifying improvements, not implementing every finding.","kind":"framework","references":{"csf":["ID.IM-01","ID.IM-02"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Measured error results, a stated corpus and the test-set composition provide performance, verification and reliability evidence. Deployment relevance and generalization limits still need evaluation; the adopted target is not universal proof of validity.","kind":"framework","references":{"rmf":["MEASURE 2.3","MEASURE 2.5"],"iso":["A.6.2.4","Cl. 9.1"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Defined-window detector results evaluate control effectiveness and support acceptance testing. The buyer still needs measurement owners, cadence and analysis; the optional under-5% target is a buyer choice, not a framework threshold.\nISO/IEC 27001: Cl. 9.1: Metrics must evaluate information-security performance or control effectiveness; generic business metrics do not qualify.","kind":"framework","references":{"soc2":["CC4.1","CC7.2"],"iso27001":["Cl. 9.1","A.8.29"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-011","frameworkRefs":{"ISO27001":["Cl. 9.1","A.8.29"],"ISO42001":["A.6.2.4","Cl. 9.1"],"NIST-CSF":["ID.IM-01","ID.IM-02"],"NIST-AI-RMF":["MEASURE 2.3","MEASURE 2.5"],"SOC2":["CC4.1","CC7.2"]}}