NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — SP 800-53 Coverage
How well do NIST SP 800-53 Rev 5 controls address each NIST AI RMF 1.0 requirement? This analysis maps from framework clauses back to SP 800-53, with expert coverage weightings and gap identification.
Clause-by-Clause Analysis
Sorted by clauseGOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and documented
Rationale
PT-02 has the organisation determine and document the authority that permits processing of PII. SI-12 manages and retains information in line with applicable laws, and CM-10 uses software in accordance with contracts and copyright law.
Gaps
No control requires the laws and regulations that apply to AI to be identified, understood and tracked as they change.
GOVERN 1.2 The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices
Rationale
PM-01 and PM-18 set the security and privacy programme plans, PT-01 sets privacy policy and procedures, SA-03 builds security and privacy into the system life cycle, and SA-08 applies security and privacy engineering principles.
Gaps
These reach two of the AI RMF's seven characteristics of trustworthy AI, secure and resilient, and privacy-enhanced. Valid and reliable, safe, accountable and transparent, explainable and interpretable, and fair are not addressed.
GOVERN 1.3 Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance
Rationale
PM-09 expresses risk tolerance in the risk management strategy and PM-28 documents it. RA-02 categorises the system, and PL-10 and PL-11 select and tailor the controls to the level its category calls for.
Gaps
The categories and baselines are built on security and privacy impact. They do not set the level of AI risk management by the harms an AI system can cause.
GOVERN 1.4 The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities
Rationale
PM-09 has the risk management strategy implemented consistently across the organisation, PM-28 documents its assumptions, constraints and tolerance, PM-10 runs the authorisation process, and RA-01 sets risk assessment policy and procedures.
Gaps
Transparency of the process and its outcomes to those outside the security function is not required.
GOVERN 1.5 Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review
Rationale
PM-31 sets an organisation-wide continuous monitoring strategy with its frequencies, and CA-07 monitors at system level. PM-09 and PM-28 have the strategy and its framing reviewed and updated, PM-14 keeps the plans for testing, training and monitoring, PM-10 the authorisation process, and RA-03 updates the risk assessment.
Gaps
The review covers the security and privacy risk management process, not the AI risk management process and its outcomes as such.
GOVERN 1.6 Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities
Rationale
PM-05 keeps an inventory of organisational systems and CM-08 an inventory of system components, so AI systems and their components are inventoried as any other.
Gaps
No control asks for AI systems to be identified as such in the inventory, or for the inventory to be resourced by risk priority.
GOVERN 1.7 Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness
Rationale
SA-03 manages the system through a life cycle that includes its disposal. MP-06 sanitises media, SR-12 disposes of components, SI-12 disposes of information as retention requires, and SA-22 replaces components that are no longer supported.
Gaps
Decommissioning an AI system so that risk does not rise, including its models, training data and dependent systems, is not addressed as such.
GOVERN 2.1 Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization
Rationale
PM-29 appoints a senior accountable official for risk management and a risk executive function, PS-09 puts security and privacy roles into position descriptions, and SA-03 defines roles throughout the life cycle. PL-02 records the roles in the system plan, and PM-10 assigns roles in authorisation.
Gaps
Lines of communication about AI risk across the organisation are not required.
GOVERN 2.2 The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements
Rationale
AT-02 gives literacy training and awareness to all users, including managers and contractors, AT-03 gives role-based training, and PM-13 develops the security and privacy workforce.
Gaps
The content of the training on AI risk management is not specified, and partners outside the organisation's users are not covered.
GOVERN 2.3 Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment
Rationale
CA-06 has a senior official authorise the system to operate and accept its risk. PM-29 appoints a senior accountable official for risk management, and PM-19 a senior official for privacy.
Gaps
Executive responsibility is for security and privacy risk. Decisions about AI risks beyond those are not addressed.
GOVERN 3.1 Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds) 0%
Rationale
No SP 800-53 control addresses this subcategory.
Gaps
No control asks for decisions on AI risk to be informed by a team diverse in demographics, disciplines, experience, expertise or background.
GOVERN 3.2 Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems
Rationale
AC-05 identifies and documents the duties to be separated, PL-04 sets out users' responsibilities and expected behaviour, and SA-09 defines oversight and user roles for external system services.
Gaps
Roles in human-AI configurations, and the oversight of AI systems by people, are not addressed.
GOVERN 4.1 Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts
Rationale
SA-03 builds security and privacy into the life cycle, SA-08 applies engineering principles in design and development, and AT-02 builds awareness among users.
Gaps
A safety-first mindset, and critical thinking about the negative impacts of AI, are outside these controls' words.
GOVERN 4.2 Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly
Rationale
RA-03 has risk assessment results documented and disseminated, RA-08 conducts privacy impact assessments, CM-04 analyses the impact of changes, and SA-11 documents the results of developer testing.
Gaps
Impacts on individuals, communities and society beyond security and privacy are not assessed, and wider communication about them is not required.
GOVERN 4.3 Organizational practices are in place to enable AI testing, identification of incidents, and information sharing
Rationale
SA-11 and CA-08 provide for testing, IR-04 and IR-06 for handling and reporting incidents, and PM-14 for testing plans. PM-15 and PM-16 provide for sharing information with security groups and across organisations.
Gaps
Testing for AI-specific risks and sharing information about AI incidents are not addressed as such.
GOVERN 5.1 Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks
Rationale
PM-26 receives and responds to complaints, concerns and questions from individuals about privacy practices, and PM-20 makes privacy programme information public.
Gaps
Collecting and integrating feedback from outside the team on the individual and societal impacts of an AI system is not covered.
GOVERN 5.2 Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation
GOVERN 6.1 Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights
Rationale
SR-01, SR-02 and PM-30 set supply chain risk management policy, plan and strategy, SR-03 sets supply chain controls, and SA-04 and SA-09 govern acquisitions and external services. CM-10 uses software in accordance with contracts and copyright law.
Gaps
Risks particular to third-party AI, such as models and training data from others, and infringement of others' intellectual property beyond software licences, are addressed only in part.
GOVERN 6.2 Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk
Rationale
CP-02 plans for contingencies, IR-04 handles incidents, SR-03 and SR-08 set supply chain controls and notification agreements, and SI-22 uses an alternative source of information when the primary one is corrupted or unavailable.
Gaps
Contingency for the failure of third-party AI systems, and for corrupted third-party training data, is not addressed as such.
MAP 1.1 Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics
Rationale
PM-11 defines mission and business processes, PL-07 a concept of operations, and PL-02 the system's operational context. PT-02 and PT-03 document the authority and purposes for processing PII, and RA-03 assesses impacts.
Gaps
Intended uses, users and their expectations, settings of deployment, context-specific norms and the limits of the system's purposes are not documented as the AI RMF asks.
MAP 1.2 Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized 0%
Rationale
No SP 800-53 control addresses this subcategory.
Gaps
No control asks for interdisciplinary actors, or diversity in demographics and expertise, in establishing the context of an AI system.
MAP 1.3 The organization's mission and relevant goals for AI technology are understood and documented
MAP 1.4 The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated
Rationale
PM-11 defines the business processes, PL-02 and PL-07 describe the system's purpose and operation, and PM-32 analyses systems to ensure that resources are used consistent with their intended purpose.
Gaps
The business value of an AI system is not defined or re-evaluated as such.
MAP 1.5 Organizational risk tolerances are determined and documented 85%
Rationale
PM-28 identifies and documents organisational risk tolerance.
Gaps
Risk tolerance is framed for security and privacy risk, not for AI risk generally.
Mapped Controls
MAP 1.6 System requirements (e.g., "the system shall respect the privacy of its users") are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks
Rationale
SA-02 determines security and privacy requirements in mission and business planning, SA-04 states them in acquisitions, SA-08 applies engineering principles in design, and PL-08 develops security and privacy architectures.
Gaps
Requirements beyond security and privacy, and the socio-technical implications of design decisions, are not addressed.
MAP 2.1 The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders)
MAP 2.2 Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions
Rationale
SA-05 gives administrators and users documentation of the system's functions and how to use them, PL-04 sets rules of behaviour for users, and SA-08 applies engineering principles.
Gaps
The system's knowledge limits, and how its output is to be used and overseen by people, are not documented as such.
MAP 2.3 Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation
Rationale
SA-11 plans and carries out developer testing and evaluation, CA-02 plans assessments, SA-15 sets development standards and tools, and SI-18 checks the accuracy, relevance and completeness of PII.
Gaps
Scientific integrity, experimental design, the representativeness of data and construct validation are not addressed.
MAP 3.1 Potential benefits of intended AI system functionality and performance are examined and documented 0%
Rationale
No SP 800-53 control addresses this subcategory.
Gaps
SP 800-53 deals with risk. The potential benefits of an AI system are not examined.
MAP 3.2 Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – are examined and documented
MAP 3.3 Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization
Rationale
RA-02 categorises the system, PL-02 defines its components and boundary, PL-07 its concept of operations, and CM-07 configures it to provide only the capabilities essential to its mission.
Gaps
The scope is set by security categorisation, not by the AI system's capability and established context.
MAP 3.4 Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented
Rationale
AT-03 gives role-based training, AT-04 keeps training records, AT-06 reports on training results, SA-16 has the developer provide training, and PM-13 develops the workforce.
Gaps
Proficiency with AI system performance and trustworthiness, and the relevant technical standards and certifications, are not specified.
MAP 3.5 Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function
Rationale
AC-04 can enforce human review of information flows, SI-10 provides a manual override for input validation, and SI-07 verifies the integrity of software and information.
Gaps
Processes for human oversight of an AI system's decisions are not defined as such.
MAP 4.1 Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights
Rationale
RA-03 includes supply chain risk assessment, SR-03, SR-04 and SR-06 address supply chain controls, provenance and supplier reviews, SA-09 external services, and CM-10 software licences and copyright.
Gaps
Legal risks of AI components, such as training data rights and intellectual property beyond software licences, are covered only in part.
MAP 4.2 Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented
Rationale
PL-02 documents the controls for the system, SA-17 the developer's security and privacy architecture and design, and SA-04, SA-09 and SR-03 the controls required of suppliers and external services.
Gaps
Controls particular to AI components, such as third-party models, are not identified as such.
MAP 5.1 Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented
Rationale
RA-03 determines the likelihood and magnitude of harm, and RA-08 assesses privacy impacts.
Gaps
Beneficial impacts, and impacts on groups, communities and society, are not characterised, and past uses of similar AI systems and public incident reports are not required as inputs.
MAP 5.2 Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented
MEASURE 1.1 Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented
MEASURE 1.2 Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities
MEASURE 1.3 Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance
Rationale
CA-02 and CA-07 provide for independent assessors and independent assessment, CA-08 for independent penetration testing, and SA-11 for independent verification of the developer's assessment plans and evidence.
Gaps
Consulting domain experts, users and affected communities is not required.
MEASURE 2.1 Test sets, metrics, and details about the tools used during TEVV are documented
MEASURE 2.2 Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population
MEASURE 2.3 AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented
MEASURE 2.4 The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production
MEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented
MEASURE 2.6 The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures
Rationale
SI-17 and SC-24 have the system fail in a known, safe state, CP-12 enters a safe mode, and SI-13 prevents predictable failures. SI-04 monitors in real time, SI-10 validates input, RA-03 weighs the risk, and CA-06 has residual risk accepted.
Gaps
Safety risks of AI systems, and safety metrics, are not evaluated as such.
MEASURE 2.7 AI system security and resilience – as identified in the MAP function – are evaluated and documented
Rationale
CA-02 assesses controls, CA-08 tests by penetration, RA-05 scans for vulnerabilities, SA-11 tests during development, and CP-04 tests the contingency plan.
Gaps
Attacks particular to AI, such as data poisoning, model evasion and model theft, are not named.
MEASURE 2.8 Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented 20%
Rationale
AU-02 has the events that support audit identified and logged.
Gaps
Risks to transparency and accountability are not examined and documented as such.
Mapped Controls
MEASURE 2.9 The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance
MEASURE 2.10 Privacy risk of the AI system – as identified in the MAP function – is examined and documented
Rationale
RA-08 conducts privacy impact assessments, RA-03 assesses privacy risk, SI-19 de-identifies data sets, and PL-02 documents the privacy controls.
Gaps
Privacy risks particular to AI, such as inference about individuals from model outputs, are not named.
MEASURE 2.11 Fairness and bias – as identified in the MAP function – are evaluated and results are documented 0%
Rationale
No SP 800-53 control addresses this subcategory.
Gaps
No control evaluates fairness or bias.
MEASURE 2.12 Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented 0%
Rationale
No SP 800-53 control addresses this subcategory.
Gaps
No control assesses the environmental impact or sustainability of AI training and management.
MEASURE 2.13 Effectiveness of the employed TEVV metrics and processes in the MEASURE function are evaluated and documented
MEASURE 3.1 Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts
MEASURE 3.2 Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available 15%
Rationale
PM-28 documents the assumptions and uncertainties that affect risk assessment.
Gaps
Tracking risks that cannot yet be measured is not covered.
Mapped Controls
MEASURE 3.3 Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics
Rationale
PM-26 receives and responds to complaints, RA-05 can include a public channel for reporting vulnerabilities, and PT-08 gives individuals the opportunity to contest the findings of a computer matching programme before adverse action.
Gaps
Feedback from end users and affected communities, and appeal of AI system outcomes, are not integrated into evaluation metrics.
MEASURE 4.1 Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented
MEASURE 4.2 Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented
MEASURE 4.3 Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented
MANAGE 1.1 A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed
Rationale
CA-06 has a senior official authorise the system to operate, PM-32 checks that resources are used for their intended purpose, and SA-04 sets the requirements a system must meet when acquired.
Gaps
Whether the AI system achieves its intended purposes and stated objectives is not determined as such.
MANAGE 1.2 Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods
MANAGE 1.3 Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting
Rationale
RA-07 responds to risk findings, CA-05 and PM-04 document the remedial actions planned, PM-09's strategy covers how risk is accepted, mitigated, transferred or avoided, and CA-06 has the residual risk accepted.
Gaps
Responses are to security and privacy risks. Other high-priority AI risks are not covered.
MANAGE 1.4 Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented
MANAGE 2.1 Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts
MANAGE 2.2 Mechanisms are in place and applied to sustain the value of deployed AI systems
MANAGE 2.3 Procedures are followed to respond to and recover from a previously unknown risk when it is identified
MANAGE 2.4 Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use
Rationale
CP-12 enters a safe mode when set conditions are detected, SI-17 executes fail-safe procedures, SI-06 can shut down or restart the system when verification finds anomalies, and IR-04 contains incidents.
Gaps
Superseding, disengaging or deactivating an AI system whose performance or outcomes are inconsistent with intended use is not addressed as such.
MANAGE 3.1 AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented
Rationale
SA-09 monitors external providers' compliance with controls on an ongoing basis, SR-06 assesses and reviews suppliers, and SR-03 applies supply chain controls.
Gaps
Benefits from third-party resources are not monitored, and risks particular to third-party AI are not named.
MANAGE 3.2 Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance
MANAGE 4.1 Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management
Rationale
CA-07 implements continuous monitoring, IR-04 incident handling, CP-10 recovery, CM-03 change control and SR-12 disposal of components. PM-26 takes in complaints, and PT-08 gives individuals the opportunity to contest the findings of a computer matching programme.
Gaps
Capturing and evaluating input from users and other AI actors, and appeal and override of AI outcomes, are covered only in part.
MANAGE 4.2 Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors
MANAGE 4.3 Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented
Methodology and Disclaimer
This coverage analysis maps from NIST AI RMF 1.0 clauses/requirements back to NIST SP 800-53 Rev 5 controls, assessing how well the SP 800-53 control set addresses each framework requirement.
Coverage weighting represents an informed estimate based on control-objective alignment, not a definitive compliance determination. Weightings consider whether SP 800-53 controls address the intent of each framework requirement, even where terminology and structure differ.
This analysis should be validated by qualified assessors for use in compliance or audit activities. The authoritative source for any compliance determination is always the framework itself.