# VAL-006: Measure employee self-remediation


- Area: AI Usage, Spend & Value

- Verification: Proof of value
- OWASP adoption tier: AT0–AT4

- URL: /r/VAL-006

**Acceptance criteria:** Record whether a warned user cancels, edits, redirects or proceeds, and calculate a remediation rate where privacy allows.

**Why it matters:** Self-remediation shows whether coaching changes behavior or just records it.

**How to verify:** Share of coached pilot interventions where the employee edits or cancels, and the trend over the pilot.

**OWASP adoption context:** Shadow, embedded-assistant and integrated-platform interactions are primary contexts for observing whether employees cancel, edit or proceed after a warning.

**Mappings:**
- NIST CSF 2.0: ID.IM-01, PR.AT-01; ISO 42001: Cl. 7.3, Cl. 9.1 — Post-warning cancel, edit, redirect and proceed behavior provides evidence for evaluating AI/security awareness interventions and identifying improvements. A remediation rate does not prove competence, safe final content or an effective overall program; meaningful denominators and privacy-appropriate collection are needed.
- NIST AI RMF: MEASURE 4.1 — Cancel, edit, redirect and proceed telemetry can inform context-sensitive evaluation of measurements. It complements rather than replaces consultation with end users and domain experts.
- SOC 2: CC4.1 — Responses to a security warning and the remediation rate provide evidence for evaluating that intervention. Define the denominator and sampling window and use privacy-appropriate collection; a click or edit does not prove safe final content or an effective overall program.
- ISO 27001: Cl. 9.1, A.6.3 — Responses to a security warning and a defined remediation rate evaluate a specific security intervention. The training link applies when the metric evaluates a delivered awareness intervention. Define the objective, denominator, sampling window, responsibility, cadence and evaluation; a click or edit does not prove safe content, competence or understanding of ISMS duties.