# VAL-007: Provide role-based dashboards and reporting, up to board level


- Area: AI Usage, Spend & Value

- Verification: Walkthrough
- OWASP adoption tier: AT0–AT2
- Formerly: GOV-009
- URL: /r/VAL-007

**Acceptance criteria:** Tailor views for Security, IT, GRC, Legal, executives and business units, filter by unit, tool, environment, owner and risk, and summarize adoption, risk, policy, incidents and recommendations with trends and supporting evidence.

**Why it matters:** Each audience, from SOC to board, needs its own view of the same data.

**How to verify:** The same pilot data shown through executive, function and security views.

**OWASP adoption context:** Role-based governance reporting can combine workforce AI evidence from any adoption tier while limiting the detail each audience receives.

**Mappings:**
- ISO 42001: Cl. 9.1, Cl. 9.3; SOC 2: CC2.1, CC2.2, CC4.1; ISO 27001: Cl. 9.1, Cl. 9.3.2 — Evidence-backed risk, policy and incident trends provide information for performance evaluation, oversight and management review. Responsible people must receive, review and act on it; a dashboard is not a completed review, and adoption metrics alone are not security-effectiveness evidence.
- NIST AI RMF: GOVERN 2.1 — Role-tailored reporting helps communicate AI-risk information to people with governance responsibilities across teams. Providing views does not itself assign those responsibilities or establish accountability.
- NIST CSF 2.0: GV.OV-03 — Evidence-backed risk, policy and incident trends provide inputs to cybersecurity performance oversight. Responsible people must review and use the reporting; a dashboard is not a completed review, and adoption alone is not security-effectiveness evidence.