Exam blueprint
CASF™ Exam Blueprint — Identity-Verified AI Safety Certification
CASF™ Foundations exam blueprint: identity-verified sitting, public verification page, and a workplace AI Safety Policy capstone. Built on NIST AI RMF, ISO/IEC 42001, the EU AI Act, and OWASP Top 10 for LLMs. Sitting facts come from the live exam config (60 questions, 70% pass, 60 minutes, 2 attempts) — not a marketing spreadsheet.
Exam facts
| Fact | CASF™ Foundations |
|---|---|
| Questions | 60 questions |
| Pass mark | 70% to pass |
| Session length | 60 minutes |
| Attempts | 2 attempts |
| Identity verification | Yes — before the clock |
| Results | Instant |
| Certificate validity | 2 years |
| Price | $199 Foundations |
| Free Module 0 first | Yes — 90 minutes, no login for the videos |
How identity verification works
Step 1
Paid modules first
M1–M5 quizzes must be passed. Watching videos does not unlock the exam or issue a certificate.
Step 2
Identity check before the clock
We create the identity check on the server. A signed webhook is the source of truth. We do not store ID photos. The check must be approved, and it must write a legal name, before the sitting can start.
Step 3
Recorded sitting
A first-party review session records webcam and screen. The exam clock starts only after the identity check is approved and that recording is on. This is not a live human proctor.
Step 4
Name on the badge
A pass issues a two-year certificate in the approved legal name from the identity check. Instant results. The old ID is superseded on renewal.
Step 5
Public verification
Anyone can confirm the credential at /verify/{id}. Every certificate includes that URL and a QR code.
Public registry: /verify/{id} plus a QR on every certificate.
Blueprint
| Module | What you must be able to do | Built on |
|---|---|---|
| M0 Why AI Safety Is Not Security | Tell safety failures from security attacks and name who gets hurt by each. | NIST AI RMF (framing), OWASP Top 10 for LLMs (threat side) |
| M1 How AI Can Fail You | Spot the real-world failure modes of workplace AI and start an incident risk register. | NIST AI RMF Map + Measure |
| M2 Truth & Bias | Control hallucination and biased outputs; write the Truth & Bias section of a policy. | NIST AI RMF Measure; EU AI Act transparency duties |
| M3 Privacy & Confidentiality | Set allowed-tools and data rules: what never goes into a prompt. | ISO/IEC 42001 (data and operational controls); OWASP LLM sensitive-information disclosure |
| M4 Accountability & Law | Assign ownership and meet deployer duties. | EU AI Act (including Article 4 AI literacy and deployer obligations); NIST AI RMF Govern |
| M5 Ship It: Final Policy | Produce a complete, signable AI Safety Policy for a real organisation. | NIST AI RMF Govern + Manage; ISO/IEC 42001 management-system alignment |
The capstone
Your certificate is backed by an artifact: a complete AI Safety Policy for your organisation, built section by section across M2–M5 — approved tools and data rules, truth and bias controls, privacy rules, accountability and law, incident escalation, and a review cadence.
You write the policy in the classroom. Public verify records that the capstone was completed. The policy text is not human-graded and is not published on the verify page.