2_use_case_name: IT Security Monitoring
3_agency: Pension Benefit Guaranty Corporation
3_abr: PBGC
4_bureau: Office of Information Technology (OIT) 
8_topic_area: Mission-Enabling
10_commercial_ai: Identifying unusual patterns in system logs from a single incident report using AI.
11_purpose_benefits: Analyzing large data sets of end user activity to detect anamolies and potential security events  
12_outputs: Enhanced detection and reporting of potential IT Security events.
16_dev_stage: Implementation and Assessment
17_impact_type: Neither
18_date_initiated: 9/1/2022
19_date_acq_dev_began: 9/1/2022
20_date_implemented: 9/1/2023
21_date_retired: N/A 
22_dev_method: Developed with both contracting and in-house resources.
24_hisp_support: No
26_public_service: Safeguarding the confidentiality, integrity, and availability of systems and data 
27_public_info: No
28_iqa_compliance: N/A 
29_contains_pii: No
30_saop_review: No
31_data_catalog: No
33_agency_data: Raw data events to clear and concise anomalies and threats for review and resolution. 
34_data_docs: Documentation is missing or not available: No documentation exists regarding maintenance, composition, quality, or intended use of the training and evaluation data.
37_custom_code: No
38_code_access: No – agency does not have access to source code.
40_has_ato: Yes
41_system_name: Embedded within PBGC's IT Infrastructure General Support System
42_dev_tools_wait: 6-12 months
43_infra_provisioned: Yes
45_compute_request: No
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: No documentation is available: No documentation detailing model performance metrics, model architecture, features and intended use of the models have been created or are currently accessible to other data science teams within the agency.
51_extension_request: No – Agency did not request an extension for this use case.
52_impact_assessment: No
53_real_world_testing: Performance evaluation in operational environment: The AI use case has been tested in an operational environment before being fully implemented as a solution, or has been tested in simulated or controlled environment using operational or synthetic data.
54_key_risks: Risks are associated with noncompliance with NIST 800-53 Rev 5 requirements.  Security control assessments performed to ensure operational itent and desired outcomes.  
55_independent_eval: Planned or in-progress
56_monitor_postdeploy: No monitoring protocols have been established: Necessary infrastructure needed to perform monitoring of AI systems in production is not available and/or a plan to monitor models has not yet been established.
57_autonomous_impact: No - Some individual decisions or actions require direct human oversight.
59_ai_notice: Email
61_adverse_impact: No
63_stakeholder_consult: None of the above
65_appeal_process: Yes
66_no_appeal_reason: Security analysts will manually assess logged end user activities to confirm anamoly detection.  
67_opt_out: No – This AI use case is not subject to the opt-out requirement because the AI functionality is solely used for the prevention, detection, and investigation of fraud or cybersecurity incidents, or the conduct of a criminal investigation.