# GRD-011: Maintain acceptable detection quality


- Area: Runtime Guardrails

- Verification: Live test + Documentation
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-008
- URL: /r/GRD-011

**Acceptance criteria:** Report the false-alert proportion: reviewed flagged events judged benign divided by all reviewed flagged events, over a defined window. Document the sample size and composition; under 5% where that target is adopted. Separately report the missed-detection rate using a labeled test corpus: cases expected to be flagged but not flagged divided by all cases expected to be flagged. Include results by data class.

**Why it matters:** False positives decide whether employees and the SOC tolerate a control. A noisy one gets switched off.

**How to verify:** Review a representative sample of flagged pilot events and calculate the false-alert proportion. Separately run a labeled test corpus and calculate the missed-detection rate by data class. Record the numerator, denominator and test scope for each metric. If a denominator is zero, report the rate as not measurable.

**OWASP adoption context:** Detection quality should be tested across the listed employee AI contexts because supported surfaces, payloads and user behavior can change error rates.

**Mappings:**
- NIST CSF 2.0: ID.IM-01, ID.IM-02 — Documented false-positive and false-negative results help identify improvements from evaluations and tests. These outcomes concern identifying improvements, not implementing every finding.
- NIST AI RMF: MEASURE 2.3, MEASURE 2.5; ISO 42001: A.6.2.4, Cl. 9.1 — Measured error results, a stated corpus and the test-set composition provide performance, verification and reliability evidence. Deployment relevance and generalization limits still need evaluation; the adopted target is not universal proof of validity.
- SOC 2: CC4.1, CC7.2; ISO 27001: Cl. 9.1, A.8.29 — Defined-window detector results evaluate control effectiveness and support acceptance testing. The buyer still needs measurement owners, cadence and analysis; the optional under-5% target is a buyer choice, not a framework threshold.
ISO/IEC 27001: Cl. 9.1: Metrics must evaluate information-security performance or control effectiveness; generic business metrics do not qualify.