NIST AI RMF KitNIST AI RMF maturity check and templates
Rate where you stand on each of the 19 categories of the NIST AI Risk Management Framework, see your score for Govern, Map, Measure and Manage, and get the workbook and templates to close the gaps.
The AI Governance Toolkit includes the full NIST AI RMF mapping workbook with maturity scoring, evidence, owners and an ISO/IEC 42001 crosswalk.
Runs locally · 0 bytes uploaded
Free NIST AI RMF maturity check
For each category pick 0 Not done · 1 Ad hoc · 2 Defined · 3 Operating · 4 Measured and improving.
NIST AI RMF templates: AI Governance Toolkit
The Professional edition has the NIST AI RMF mapping workbook (all 19 categories, maturity scoring and summary chart, ISO/IEC 42001 crosswalk) plus the ISO/IEC 42001 gap assessment and AI vendor contract clauses. Starter has the AI policy, inventory, risk register and risk assessment.
The four functions
| Function | NIST's description | Categories |
|---|---|---|
| GOVERN | A culture of risk management is cultivated and present. | 6 |
| MAP | Context is recognized and risks related to context are identified. | 5 |
| MEASURE | Identified risks are assessed, analyzed, or tracked. | 4 |
| MANAGE | Risks are prioritized and acted upon based on a projected impact. | 4 |
All 19 categories
- GOVERN 1: You have written, approved rules for how AI risk is handled, and people actually follow them.
- GOVERN 2: Named people own AI risk decisions, know it, and are trained for it.
- GOVERN 3: Decisions about AI risk draw on a range of backgrounds, skills and viewpoints, including people affected by the system.
- GOVERN 4: Teams talk openly about AI risk, test critically, and share what they find.
- GOVERN 5: You collect and act on input from people outside the team: users, customers, affected groups and experts.
- GOVERN 6: AI you buy or build on (models, APIs, data, plugins) is covered by your policies and contracts.
- MAP 1: For each AI system you know its purpose, users, setting, limits and the laws that apply.
- MAP 2: Each AI system is classified: what task it performs, how it works, and how much risk it carries.
- MAP 3: You know what the AI is meant to achieve, what it costs, and how it compares with alternatives, including not using AI.
- MAP 4: Risks are mapped for every part of the system, including third-party models and data.
- MAP 5: You have assessed who could be affected by the AI and how, likely and unlikely.
- MEASURE 1: You picked sensible ways to measure the risks you mapped, and you use them.
- MEASURE 2: Systems are tested for the qualities that make AI trustworthy: validity, safety, security, privacy, fairness, transparency and explainability.
- MEASURE 3: Risks are tracked over time, including new ones that appear after launch.
- MEASURE 4: You check whether your measurements are working and improve them.
- MANAGE 1: Risks found in Map and Measure are ranked and have a decision: treat, transfer, accept or stop.
- MANAGE 2: You plan how to get the benefits while limiting harm, and you can switch a system off if needed.
- MANAGE 3: Risks from third-party AI are monitored and managed, not just checked once at purchase.
- MANAGE 4: Treatments, incident response and communication plans for AI risks are written down and reviewed regularly.
Function descriptions and category statements are quoted from NIST AI 100-1 (AI RMF 1.0), a US government publication. NIST AI RMF core.
Questions
What is the NIST AI RMF?
The NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary US framework for managing AI risks. It is organised into four functions (Govern, Map, Measure, Manage) and 19 categories.
Is the NIST AI RMF mandatory?
No. It is voluntary, but US agencies, enterprise buyers and auditors increasingly ask vendors to show how they align with it.
How does it relate to ISO/IEC 42001?
They cover much of the same ground. ISO/IEC 42001 is a certifiable management-system standard; the NIST AI RMF is a framework for organising AI risk work. The toolkit's mapping links each NIST category to the ISO/IEC 42001 clauses and Annex A areas that cover similar ground (an indicative mapping, not an official crosswalk).
Is there a profile for generative AI?
Yes. NIST published a Generative AI Profile (NIST AI 600-1) in July 2024 as a companion to the AI RMF.