NIST AI Risk Management Framework 1.0
GOVERN, MAP, MEASURE and MANAGE, with the verbatim public-domain subcategory text. The voluntary framework US regulators and customers increasingly ask about, tracked as real controls with evidence.
What NIST AI Risk Management Framework 1.0 is
The NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023) is the US government's voluntary framework for managing risk in AI systems. It is organised as a Core of four functions — GOVERN, MAP, MEASURE and MANAGE — each broken into categories and then into subcategory outcome statements. GOVERN is the cross-cutting one: it is about the culture, roles, policies and accountability that make the other three possible, and it is the function most organisations discover they are weakest on.
Unlike ISO 42001 the AI RMF is not certifiable and there is no auditor to satisfy. Its value is different: it is public-domain, it is what US federal agencies and their contractors reference, and it is increasingly the vocabulary that enterprise customers use when they ask an AI vendor to explain itself. Answering "which MEASURE subcategories do you satisfy, and with what evidence" is a much stronger position than answering "we take AI safety seriously".
Because it is voluntary and unnumbered by any regulator, it is also the framework most often adopted as a document and then abandoned. The subcategory statements are outcomes, not tasks, and without somewhere to attach an owner and an artefact they stay aspirational.
The four functions divide the work in a way that is worth understanding before you scope it. GOVERN is continuous and organisational: policies, roles, inventory, third-party risk, decommissioning, and the accountability structures that make the rest enforceable. MAP is contextual — establishing what a given AI system is for, who it affects, what its capabilities and limits are, and what could go wrong. MEASURE is the analytic function, covering the methods and metrics used to evaluate trustworthiness, and it is the one that most exposes whether an organisation actually tests its models or merely ships them. MANAGE closes the loop: prioritising risks, allocating resources, treating third-party risk, and responding to and recovering from incidents.
NIST also publishes the seven characteristics of trustworthy AI that run underneath the Core — valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. They are not subcategories and there is no checklist for them; they are the criteria the Core's outcomes are meant to serve, and they are the vocabulary a customer will use when they ask you to justify a system.
Who it applies to
- US federal contractors and anyone selling into agencies, where AI RMF alignment is now a routine question.
- Organisations that want a governance framework immediately, without a certification budget or a licensed standard.
- Teams building the evidence base for ISO 42001 later — the two overlap enough that work done against the AI RMF Core is not wasted.
- Security and risk functions that need a shared vocabulary with data science teams. The Core is the least contentious one available.
How it is structured in CMDash
CMDash seeds the AI RMF Core — the subcategories under GOVERN, MAP, MEASURE and MANAGE. The subcategories are the assessable, outcome-level statements the framework actually asks an organisation to satisfy, so they are what gets modelled as controls, the same convention used for ISO 42001's Annex A.
| GOVERN | 19 |
| MAP | 18 |
| MEASURE | 22 |
| MANAGE | 13 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: The AI RMF Core. The Generative AI Profile (NIST AI 600-1) is not included.
The control text
72 of the 72 seeded controls carry the publisher’s own wording, taken from NIST AI Risk Management Framework (AI RMF 1.0). It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for NIST AI Risk Management Framework 1.0
- Every subcategory carries the official NIST statement verbatim. AI 100-1 is US-government public-domain content, so CMDash reproduces the wording instead of paraphrasing it — you are assessing against what NIST wrote, not against someone's summary of it.
- Each subcategory has its own evidence requirement written for collection. GOVERN-1.6, for example, asks for an AI system inventory with owner, purpose, risk tier and lifecycle status per entry, and evidence that the inventory is maintained rather than one-time.
- Seeded crosswalks connect the Core to ISO 42001 Annex A and to NIST CSF 2.0, so an organisation running the AI RMF alongside a security programme can see where the same artefact answers both.
- The regulatory radar maps EU AI Act obligations onto eleven specific AI RMF subcategories, so the framework doubles as an EU AI Act readiness signal even though it is a US instrument.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to NIST AI Risk Management Framework 1.0’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- The Generative AI Profile (NIST AI 600-1) is not seeded as controls. A handful of its risk themes — confabulation, harmful output, data provenance, environmental cost — inform the evidence-requirement wording on the relevant subcategories, but if you need the Profile tracked as its own control set, it is not there.
- Part 1 of the publication (the framing, the seven trustworthiness characteristics, the AI actor taxonomy, the profiles concept) is guidance on applying the Core, not a list of discrete assessable items, and is not modelled as controls.
- There is no certification and CMDash does not imply one. There is no such thing as being "AI RMF certified".
Common questions
AI RMF or ISO 42001?
They answer different questions. If a customer or a certification body needs to see an accredited certificate, that is 42001. If you need a governance structure this quarter, with public-domain text and no licence to buy, that is the AI RMF. Running both is common and less than twice the work — CMDash seeds a crosswalk between them for that reason.
Is the control text really the official NIST wording?
Yes. The subcategory statements are taken from NIST AI 100-1, which is public domain. The one deliberate edit is MAP 1.1, whose trailing "Considerations include:" enumeration is dropped from the title because it is a sub-list rather than part of the outcome statement. Evidence-requirement text is CMDash's own and is not from the publication.
Where do most organisations fail?
GOVERN, and specifically the inventory and decommissioning subcategories. Almost nobody has a maintained AI system inventory with a risk tier per entry when they start, and almost nobody has a documented process for retiring a model. Both are subcategories, both need an artefact, and neither can be produced retrospectively.
Also in AI Governance
Paid plans cap how many frameworks you run at once, never which ones — NIST AI Risk Management Framework 1.0 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.