The whole CRAGE course
Every domain, section and lesson on one map. Click a section to see its lessons, then click a lesson to open it.
Drawing the map…
Drag or scroll to move around. Pinch, or hold Ctrl and scroll, to zoom.
Text outline of this map
0.1AI in Plain Words
- AI in one sentence
- How a model learns
- Training versus using a model
- What a large language model is
- Predictive AI versus generative AI
- Why AI gets things wrong
- How people trick or attack AI
- AI agents: AI that takes actions
- Why AI needs rules: the car analogy
- Who makes the rules
- The five CRAGE areas as one story
- Key words cheat sheet
1.1AI Fundamentals and Technology Ecosystem
1.2AI Ethics, Principles, and Responsible AI
- Ethical considerations of AI
- Ethical challenges in AI systems
- International AI ethics guidelines
- DoD AI ethical principles
- Responsible AI across the lifecycle
- Problem definition and data stages
- Design, development and testing stages
- Deployment, monitoring and maintenance
- Documentation, improvement and retirement
- Sustainability, inclusion and social impact
2.1AI Strategic Planning and Organizational Alignment
2.2AI Governance and Frameworks
- ADG pillars and operating model
- AI Governance Council and decision rights
- NIST AI RMF core functions
- NIST AI RMF profiles and trustworthy AI
- ISO/IEC 42001 AI management system
- ISO/IEC AI standards family
- AI development governance
- AI deployment governance
- Governing AI operations and monitoring
- Governing model maintenance and updates
2.3AI Compliance, Legal Frameworks, and Regulatory Requirements
- Global AI regulatory landscape
- EU AI Act risk tiers
- EU AI Act timeline after the AI Omnibus
- General-purpose AI model obligations
- EU AI Act roles and value-chain duties
- AI liability and individual rights
- High-risk provider and deployer duties
- Industry-specific AI compliance
- AI compliance management and monitoring
- AI legal risk management
3.1AI Risk Assessment and Threat Management
- AI RMF MAP: framing AI risk
- AI RMF MEASURE: testing AI risk
- ISO/IEC 23894 AI risk process
- AI impact assessments and FRIA
- Risk tolerance, scoring and treatment
- OWASP Top 10 for LLMs 2026
- OWASP Top 10 for Agentic Apps 2026
- MITRE ATLAS adversary matrix
- Poisoning, injection and model theft
- AI risk monitoring and reporting
3.2Third-Party AI Risk Management and Supply Chain Security
4.1AI Lifecycle and Asset Management
4.2AI Security Architecture and Design Controls
- Secure-by-design AI architecture
- ADG surfaces as security boundaries
- Version control for code, models, prompts
- Access control and encryption for AI
- Securing AI APIs and network paths
- Hardening models against adversarial ML
- Guardrails and the safety layer
- Agent, tool and MCP security
- AI vulnerability management and red teaming
- AI runtime monitoring and detection
4.3Privacy, Trust, Safety, and Ethical Controls
- Privacy by design for AI systems
- Differential privacy and federated learning
- Anonymization vs pseudonymization
- Trustworthiness trade-offs in practice
- Safety controls and human oversight
- Transparency duties to AI users
- Explainability for affected people
- Ethics review and AI audits
- Continuous trust monitoring
5.1Incident Response and Business Continuity Planning
- AI Incident Response Framework
- AI-Specific Incident Types
- EU AI Act Article 73 Incident Reporting
- Running an AI Incident Response
- Incident Communication and Stakeholders
- Post-Incident Review and Lessons Learned
- Business Continuity for AI Systems
- Disaster Recovery: Rollback, RTO and RPO
- Testing, Training and Plan Exercises
5.2AI Assurance, Testing, Auditing, and Validation
6.1NIST AI RMF 1.0 (NIST AI 100-1)
- What the AI RMF is and who it is for
- How the AI RMF frames risk and harm
- Four challenges in managing AI risk
- AI actors, the lifecycle and TEVV
- The seven trustworthy AI characteristics
- Valid, reliable, safe, secure, resilient
- Transparent, explainable, private, fair
- How the Core fits together
- GOVERN 1 to 6 in plain words
- MAP 1 to 5 in plain words
- MEASURE 1 to 4 in plain words
- MANAGE 1 to 4 in plain words
- Use-case, temporal and cross-sector profiles
- The AI RMF Playbook
- Generative AI Profile (NIST AI 600-1)
- AI RMF 1.0 status and revision
- AI RMF versus ISO/IEC 42001
- AI RMF, ADG and the CRAGE domains
- Applying the AI RMF to agent sprawl
- AI RMF exam traps