{"id":"VAL-006","section":"AI Usage, Spend & Value","requirement":"Measure employee self-remediation","acceptance":"Record whether a warned user cancels, edits, redirects or proceeds, and calculate a remediation rate where privacy allows.","tier":"AT0–AT4","whyItMatters":"Self-remediation shows whether coaching changes behavior or just records it.","verificationMethod":"POV","verificationTest":"Share of coached pilot interventions where the employee edits or cancels, and the trend over the pilot.","formerly":null,"alsoIn":[],"sort":50,"adoptionContext":"Shadow, embedded-assistant and integrated-platform interactions are primary contexts for observing whether employees cancel, edit or proceed after a warning.","mappings":[{"frameworks":["csf","iso"],"explanation":"Post-warning cancel, edit, redirect and proceed behavior provides evidence for evaluating AI/security awareness interventions and identifying improvements. A remediation rate does not prove competence, safe final content or an effective overall program; meaningful denominators and privacy-appropriate collection are needed.","kind":"framework","references":{"csf":["ID.IM-01","PR.AT-01"],"iso":["Cl. 7.3","Cl. 9.1"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Cancel, edit, redirect and proceed telemetry can inform context-sensitive evaluation of measurements. It complements rather than replaces consultation with end users and domain experts.","kind":"framework","references":{"rmf":["MEASURE 4.1"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Responses to a security warning and the remediation rate provide evidence for evaluating that intervention. Define the denominator and sampling window and use privacy-appropriate collection; a click or edit does not prove safe final content or an effective overall program.","kind":"framework","references":{"soc2":["CC4.1"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Responses to a security warning and a defined remediation rate evaluate a specific security intervention. The training link applies when the metric evaluates a delivered awareness intervention. Define the objective, denominator, sampling window, responsibility, cadence and evaluation; a click or edit does not prove safe content, competence or understanding of ISMS duties.","kind":"framework","references":{"iso27001":["Cl. 9.1","A.6.3"]},"relation":null,"conditions":[]}],"area":"AI Usage, Spend & Value","areaSlug":"VAL","url":"/r/VAL-006","frameworkRefs":{"ISO27001":["Cl. 9.1","A.6.3"],"ISO42001":["Cl. 7.3","Cl. 9.1"],"NIST-CSF":["ID.IM-01","PR.AT-01"],"NIST-AI-RMF":["MEASURE 4.1"],"SOC2":["CC4.1"]}}