NIST AI RMF KitNIST AI RMF MAP 4
Risks are mapped for every part of the system, including third-party models and data.
What NIST says
Risks and benefits are mapped for all components of the AI system including third-party software and data.
Category statement quoted from NIST AI 100-1 (AI RMF 1.0). Function: MAP, context is recognized and risks related to context are identified.
Evidence that shows you're doing it
- Risk register entries per component
- Data sources with licence and provenance
Rate yourself
- Not done
- Ad hoc
- Defined
- Operating
- Measured and improving
The AI Governance Toolkit (Professional, $599) has the NIST AI RMF mapping workbook: maturity scoring, evidence, owners and next steps for every category, plus the ISO/IEC 42001 crosswalk.
Other MAP categories
- MAP 1: For each AI system you know its purpose, users, setting, limits and the laws that apply.
- MAP 2: Each AI system is classified: what task it performs, how it works, and how much risk it carries.
- MAP 3: You know what the AI is meant to achieve, what it costs, and how it compares with alternatives, including not using AI.
- MAP 5: You have assessed who could be affected by the AI and how, likely and unlikely.