← Frameworks / NIST AI RMF 1.0 / Control Mappings

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1

Voluntary guidance for managing the risks that AI systems pose to individuals, organisations and society. Organised around four functions, Govern, Map, Measure and Manage, with 72 subcategories. It asks for outcomes such as documented intended purposes and limits, testing, evaluation, verification and validation (TEVV), measurement of trustworthiness characteristics, and communication of incidents and errors.

Controls: 100

Total Mappings: 239

Publisher: NIST Version: 1.0

NIST AI RMF 1.0 → SP 800-53 SP 800-53 → NIST AI RMF 1.0 Coverage Analysis

AC (2) AT (4) AU (2) CA (5) CM (5) CP (4) IR (4) MA (2) MP (1) PL (6) PM (22) PS (1) PT (5) RA (6) SA (11) SC (1) SI (12) SR (7)

AC Access Control

Control	Name	NIST AI RMF 1.0 References
AC-04	Information Flow Enforcement	MAP 3.5
AC-05	Separation of Duties	GOVERN 3.2

AT Awareness and Training

Control	Name	NIST AI RMF 1.0 References
AT-02	Literacy Training and Awareness	GOVERN 2.2GOVERN 4.1
AT-03	Role-based Training	GOVERN 2.2MAP 3.4
AT-04	Training Records	MAP 3.4
AT-06	Training Feedback	MAP 3.4

AU Audit and Accountability

Control	Name	NIST AI RMF 1.0 References
AU-02	Event Logging	MEASURE 2.8
AU-06	Audit Record Review, Analysis, and Reporting	MEASURE 2.4

CA Security Assessment and Authorization

Control	Name	NIST AI RMF 1.0 References
CA-02	Control Assessments	MAP 2.3MEASURE 1.2MEASURE 1.3MEASURE 2.1MEASURE 2.3MEASURE 2.7MEASURE 4.1MEASURE 4.2
CA-05	Plan of Action and Milestones	MANAGE 1.2MANAGE 1.3MANAGE 1.4
CA-06	Authorization	GOVERN 2.3MEASURE 2.6MANAGE 1.1MANAGE 1.3MANAGE 1.4
CA-07	Continuous Monitoring	GOVERN 1.5MEASURE 1.1MEASURE 1.2MEASURE 1.3MEASURE 2.4MEASURE 3.1MEASURE 4.1MEASURE 4.2MEASURE 4.3MANAGE 4.1
CA-08	Penetration Testing	GOVERN 4.3MEASURE 1.3MEASURE 2.7

CM Configuration Management

Control	Name	NIST AI RMF 1.0 References
CM-03	Configuration Change Control	GOVERN 5.2MANAGE 4.1
CM-04	Impact Analyses	GOVERN 4.2
CM-07	Least Functionality	MAP 3.3
CM-08	System Component Inventory	GOVERN 1.6
CM-10	Software Usage Restrictions	GOVERN 1.1GOVERN 6.1MAP 4.1

CP Contingency Planning

Control	Name	NIST AI RMF 1.0 References
CP-02	Contingency Plan	GOVERN 6.2
CP-04	Contingency Plan Testing	MEASURE 2.7
CP-10	System Recovery and Reconstitution	MANAGE 2.3MANAGE 4.1MANAGE 4.3
CP-12	Safe Mode	MEASURE 2.6MANAGE 2.4

IR Incident Response

Control	Name	NIST AI RMF 1.0 References
IR-04	Incident Handling	GOVERN 4.3GOVERN 6.2MANAGE 2.3MANAGE 2.4MANAGE 4.1MANAGE 4.2MANAGE 4.3
IR-05	Incident Monitoring	MANAGE 4.3
IR-06	Incident Reporting	GOVERN 4.3MANAGE 4.3
IR-08	Incident Response Plan	MANAGE 2.3MANAGE 4.3

MA Maintenance

Control	Name	NIST AI RMF 1.0 References
MA-02	Controlled Maintenance	MANAGE 2.2
MA-06	Timely Maintenance	MANAGE 2.2

MP Media Protection

Control	Name	NIST AI RMF 1.0 References
MP-06	Media Sanitization	GOVERN 1.7

PL Planning

Control	Name	NIST AI RMF 1.0 References
PL-02	System Security and Privacy Plans	GOVERN 2.1MAP 1.1MAP 1.3MAP 1.4MAP 2.1MAP 3.3MAP 4.2MEASURE 2.10
PL-04	Rules of Behavior	GOVERN 3.2MAP 2.2
PL-07	Concept of Operations	MAP 1.1MAP 1.4MAP 2.1MAP 3.3
PL-08	Security and Privacy Architectures	MAP 1.6
PL-10	Baseline Selection	GOVERN 1.3
PL-11	Baseline Tailoring	GOVERN 1.3

PM Program Management

Control	Name	NIST AI RMF 1.0 References
PM-01	Information Security Program Plan	GOVERN 1.2
PM-03	Information Security and Privacy Resources	MANAGE 2.1
PM-04	Plan of Action and Milestones Process	MANAGE 1.2MANAGE 1.3
PM-05	System Inventory	GOVERN 1.6
PM-06	Measures of Performance	MEASURE 1.1MEASURE 4.3
PM-09	Risk Management Strategy	GOVERN 1.3GOVERN 1.4GOVERN 1.5MANAGE 1.3
PM-10	Authorization Process	GOVERN 1.4GOVERN 1.5GOVERN 2.1
PM-11	Mission and Business Process Definition	MAP 1.1MAP 1.3MAP 1.4
PM-13	Security and Privacy Workforce	GOVERN 2.2MAP 3.4
PM-14	Testing, Training, and Monitoring	GOVERN 1.5GOVERN 4.3MEASURE 2.13
PM-15	Security and Privacy Groups and Associations	GOVERN 4.3
PM-16	Threat Awareness Program	GOVERN 4.3
PM-18	Privacy Program Plan	GOVERN 1.2
PM-19	Privacy Program Leadership Role	GOVERN 2.3
PM-20	Dissemination of Privacy Program Information	GOVERN 5.1MAP 5.2
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	MEASURE 2.2
PM-26	Complaint Management	GOVERN 5.1GOVERN 5.2MAP 5.2MEASURE 3.3MANAGE 4.1
PM-28	Risk Framing	GOVERN 1.3GOVERN 1.4GOVERN 1.5MAP 1.5MAP 3.2MEASURE 3.2MANAGE 1.2
PM-29	Risk Management Program Leadership Roles	GOVERN 2.1GOVERN 2.3
PM-30	Supply Chain Risk Management Strategy	GOVERN 6.1
PM-31	Continuous Monitoring Strategy	GOVERN 1.5MEASURE 1.1MEASURE 1.2MEASURE 3.1
PM-32	Purposing	MAP 1.4MANAGE 1.1

PS Personnel Security

Control	Name	NIST AI RMF 1.0 References
PS-09	Position Descriptions	GOVERN 2.1

PT Personally Identifiable Information Processing and Transparency

Control	Name	NIST AI RMF 1.0 References
PT-01	Policy and Procedures	GOVERN 1.2
PT-02	Authority to Process Personally Identifiable Information	GOVERN 1.1MAP 1.1
PT-03	Personally Identifiable Information Processing Purposes	MAP 1.1
PT-04	Consent	MEASURE 2.2
PT-08	Computer Matching Requirements	MEASURE 3.3MANAGE 4.1

RA Risk Assessment

Control	Name	NIST AI RMF 1.0 References
RA-01	Policy and Procedures	GOVERN 1.4
RA-02	Security Categorization	GOVERN 1.3MAP 3.3
RA-03	Risk Assessment	GOVERN 1.5GOVERN 4.2MAP 1.1MAP 3.2MAP 4.1MAP 5.1MEASURE 2.6MEASURE 2.10MEASURE 3.1MANAGE 1.4
RA-05	Vulnerability Monitoring and Scanning	MEASURE 2.7MEASURE 3.3MANAGE 3.2
RA-07	Risk Response	MANAGE 1.2MANAGE 1.3MANAGE 2.3
RA-08	Privacy Impact Assessments	GOVERN 4.2MAP 5.1MEASURE 2.10

SA System and Services Acquisition

Control	Name	NIST AI RMF 1.0 References
SA-02	Allocation of Resources	MAP 1.6MANAGE 2.1
SA-03	System Development Life Cycle	GOVERN 1.2GOVERN 1.7GOVERN 2.1GOVERN 4.1
SA-04	Acquisition Process	GOVERN 6.1MAP 1.6MAP 4.2MANAGE 1.1
SA-05	System Documentation	MAP 2.2MEASURE 2.9MANAGE 1.4
SA-08	Security and Privacy Engineering Principles	GOVERN 1.2GOVERN 4.1MAP 1.6MAP 2.2
SA-09	External System Services	GOVERN 3.2GOVERN 6.1MAP 4.1MAP 4.2MANAGE 3.1
SA-11	Developer Testing and Evaluation	GOVERN 4.2GOVERN 4.3MAP 2.3MEASURE 1.3MEASURE 2.1MEASURE 2.3MEASURE 2.5MEASURE 2.7MEASURE 2.13
SA-15	Development Process, Standards, and Tools	MAP 2.3MEASURE 2.1MEASURE 2.13MANAGE 4.2
SA-16	Developer-provided Training	MAP 3.4
SA-17	Developer Security and Privacy Architecture and Design	MAP 4.2
SA-22	Unsupported System Components	GOVERN 1.7MANAGE 2.2

SC System and Communications Protection

Control	Name	NIST AI RMF 1.0 References
SC-24	Fail in Known State	MEASURE 2.6

SI System and Information Integrity

Control	Name	NIST AI RMF 1.0 References
SI-02	Flaw Remediation	MANAGE 4.3
SI-04	System Monitoring	MEASURE 2.4MEASURE 2.6MEASURE 2.13
SI-06	Security and Privacy Function Verification	MANAGE 2.4
SI-07	Software, Firmware, and Information Integrity	MAP 3.5MANAGE 3.2
SI-10	Information Input Validation	MAP 3.5MEASURE 2.6
SI-12	Information Management and Retention	GOVERN 1.1GOVERN 1.7
SI-13	Predictable Failure Prevention	MEASURE 2.5MEASURE 2.6
SI-15	Information Output Filtering	MEASURE 2.9
SI-17	Fail-safe Procedures	MEASURE 2.6MANAGE 2.4
SI-18	Personally Identifiable Information Quality Operations	MAP 2.3
SI-19	De-identification	MEASURE 2.10
SI-22	Information Diversity	GOVERN 6.2

SR Supply Chain Risk Management

Control	Name	NIST AI RMF 1.0 References
SR-01	Policy and Procedures	GOVERN 6.1
SR-02	Supply Chain Risk Management Plan	GOVERN 6.1
SR-03	Supply Chain Controls and Processes	GOVERN 6.1GOVERN 6.2MAP 4.1MAP 4.2MANAGE 3.1
SR-04	Provenance	MAP 4.1MANAGE 3.2
SR-06	Supplier Assessments and Reviews	MAP 4.1MANAGE 3.1
SR-08	Notification Agreements	GOVERN 6.2
SR-12	Component Disposal	GOVERN 1.7MANAGE 4.1