AI has shifted from being a promising technology to a foundational capability shaping enterprise decisions, products, and services. With that shift comes an urgent need for assurance models that protect both the integrity of AI systems and the trust of the stakeholders who rely on them.

With the recent publication of the OWASP AI Maturity Assessment (AIMA) I was asked how this aligns with the Integrated Assurance Maturity Model (IAMM). Together, they offer a practical pathway for organizations to both secure AI at the technical level and embed AI into enterprise-wide assurance and resilience strategies.

The Role of OWASP AIMA

The OWASP AI Maturity Assessment (AIMA) extends OWASP’s long-standing tradition of providing open-source security frameworks into the realm of artificial intelligence. AIMA defines eight domains, from Responsible AI and Governance to Data Management, Privacy, Design, Implementation, Verification, and Operations. Each domain includes maturity levels across two streams:

  • Create & Promote: Establishing policies, frameworks, and practices.

  • Measure & Improve: Applying metrics, automation, and monitoring for continuous assurance.

This makes AIMA highly valuable for AI/ML engineers, product teams, and security practitioners who need detailed, technical guidance on how to reduce risks such as adversarial attacks, data poisoning, or bias in training datasets. AIMA translates ethical principles and regulatory demands into concrete engineering practices and worksheets, bridging the gap between principles and implementation.

The Role of IAMM

The Integrated Assurance Maturity Model (IAMM) takes a broader perspective. Built as part of the Integrated Assurance® approach, IAMM provides a strategic maturity framework for boards, executives, CISOs, and assurance leaders. Where AIMA focuses on the security and governance of AI systems themselves, IAMM ensures that AI risk is fully integrated into enterprise assurance structures.

IAMM defines six domains:

  1. Governance & Strategy

  2. Architecture & Engineering

  3. IT & Operations

  4. Risk, Compliance & Audit

  5. Metrics & Reporting

  6. Culture & Collaboration

Each domain is measured across five maturity levels, from Fragmented to Institutionalized, creating a roadmap for embedding AI assurance into the trust infrastructure of the enterprise. IAMM ensures that AI risks are not siloed within engineering but are aligned with business outcomes, risk appetite, and resilience objectives.

Where the Models Intersect

Though they operate at different levels, IAMM and AIMA are not competitive frameworks; they are complementary layers of assurance.

  • Control vs. Integration: AIMA provides control-level depth for AI security and governance, while IAMM ensures those controls are integrated into enterprise-wide assurance and resilience frameworks.

  • Stakeholder Alignment: AIMA speaks directly to technical teams (engineers, developers, auditors), while IAMM translates AI risk into the language of executives and boards.

  • Lifecycle vs. Resilience: AIMA is organized around the AI lifecycle (design, build, deploy, operate) whereas IAMM is organized around enterprise assurance functions (governance, architecture, operations, metrics, culture).

  • Standards Alignment: AIMA anchors itself in AI-specific regulations like the EU AI Act and NIST AI RMF, while IAMM maps AI risks against enterprise frameworks such as SABSA, COBIT, NIST CSF, ISO 27001, and ITIL.

How They Work Together in Practice

An organization implementing both frameworks might use them in tandem like this:

  • At the engineering level, AIMA worksheets guide data scientists and ML engineers through bias audits, transparency tests, and secure deployment practices.

  • At the governance level, IAMM ensures these AIMA-driven practices are measured, reported, and aligned with corporate strategy, regulatory compliance, and resilience objectives.

  • During audits or board reviews, IAMM provides the enterprise maturity scorecard, while AIMA provides the technical evidence of control effectiveness.

  • For continuous improvement, IAMM tracks AI risk trends over time, while AIMA ensures that engineering teams are closing gaps with practical, measurable actions.

Building a Unified AI Assurance Strategy

By themselves, both models are powerful. But when combined, they create a multi-layered assurance strategy:

  • AIMA ensures AI systems are built and operated securely, ethically, and transparently.

  • IAMM ensures AI assurance is embedded into organizational resilience, governance, and trust strategies.

This integration allows organizations to address regulators, auditors, customers, and boards with confidence. They can demonstrate not only that technical controls are in place but also that AI assurance is part of the enterprise’s DNA.

Conclusion

OWASP AIMA and IAMM are not competing approaches but complementary layers of AI assurance. AIMA delivers the technical depth needed to secure and govern AI systems across their lifecycle, while IAMM provides the enterprise-wide integration that aligns AI risk with governance, compliance, and resilience. Together, they create a unified framework that ensures organizations can both operate AI responsibly in practice and embed AI assurance into long-term trust strategies.