NIST AI RMF Functions: Govern, Map, Measure, Manage

1. Why This Topic Matters

The NIST AI Risk Management Framework (AI RMF 1.0) is one of the most heavily referenced AI governance frameworks in the world and is a core knowledge area within the ISACA Advanced in AI Risk (AAIR) domain on AI Risk Governance and Framework Integration. Released by the U.S. National Institute of Standards and Technology in January 2023, it is voluntary, rights-preserving, non-sector-specific, and use-case agnostic. Regulators, auditors, boards, and procurement teams increasingly expect organizations to demonstrate that AI risk is being handled in a structured way, and the four Core Functions — Govern, Map, Measure, Manage — give risk professionals a shared vocabulary to do that.

For the AAIR exam, you must be able to: (1) define each function, (2) recognize which function a described activity belongs to, (3) understand how the functions interrelate, (4) connect the functions to the seven characteristics of trustworthy AI, and (5) integrate the AI RMF with other frameworks such as ISO/IEC 42001, ISO/IEC 23894, the NIST Cybersecurity Framework, COBIT, and the EU AI Act. Questions on this topic are frequently scenario-based, so understanding the purpose of each function matters more than memorizing subcategory numbers.

2. What the NIST AI RMF Is

The AI RMF is structured in two parts:
• Part 1 — Foundational Information: explains how to frame AI risk, who the AI actors are across the AI lifecycle, the challenges of AI risk measurement, risk tolerance, and the seven characteristics of trustworthy AI.
• Part 2 — Core and Profiles: defines the four functions (the Core), each broken into categories and subcategories describing outcomes, and introduces Profiles that tailor the Core to a sector, use case, or maturity target.

Companion resources you should recognize: the AI RMF Playbook (suggested actions for each subcategory), the AI RMF Roadmap, the Crosswalks to other standards, and the Generative AI Profile (NIST AI 600-1, July 2024), which applies the four functions to generative AI risks such as confabulation, data privacy, information integrity, and harmful content.

The seven trustworthy AI characteristics (these are tested often and are what Measure actually measures):
1. Valid and reliable
2. Safe
3. Secure and resilient
4. Accountable and transparent
5. Explainable and interpretable
6. Privacy-enhanced
7. Fair — with harmful bias managed

NIST notes that valid and reliable is a necessary condition for trustworthiness, and that trade-offs among characteristics are inevitable and must be decided based on context and risk tolerance.

3. How the Four Functions Work

NIST describes the Core as a set of outcomes rather than a checklist. The functions are iterative and non-sequential; Govern is a cross-cutting function that informs and is informed by the other three. Think of Govern as the hub of a wheel, with Map, Measure, and Manage as the spokes that keep turning throughout the AI lifecycle.

3.1 GOVERN — Cultivate a culture of risk management

Purpose: Establish the policies, processes, accountability structures, and culture that make AI risk management possible across the organization. Govern is applied to all AI activities and connects AI risk to enterprise risk management.

Six categories (GOVERN 1–6):
• GOVERN 1 — Policies, processes, procedures, and practices are in place, transparent, and implemented effectively (including legal and regulatory requirements, risk tolerance, and lifecycle-wide risk management).
• GOVERN 2 — Accountability structures: roles, responsibilities, and lines of communication are defined, and personnel are trained.
• GOVERN 3 — Workforce diversity, equity, inclusion, and accessibility are prioritized in AI risk decision-making.
• GOVERN 4 — Organizational teams are committed to a culture that considers and communicates AI risk (e.g., critical thinking, safety-first mindset, documentation practices).
• GOVERN 5 — Processes for robust engagement with relevant AI actors and external stakeholders, including feedback mechanisms.
• GOVERN 6 — Policies and procedures address AI risks and benefits arising from third-party software, data, and supply chains, including contingency plans for third-party failures.

Key signal words: policy, accountability, roles, culture, board oversight, risk appetite and tolerance, training, documentation standards, senior leadership, third-party policy.

3.2 MAP — Establish context and identify risks

Purpose: Understand the context in which an AI system will operate, categorize the system, identify its intended purpose, benefits, costs, and potential impacts, and surface risks before they are measured or treated. Map is the foundation that makes Measure and Manage meaningful.

Five categories (MAP 1–5):
• MAP 1 — Context is established and understood: intended purpose, deployment setting, assumptions, legal requirements, users, affected communities, and the organization's risk tolerance for the system.
• MAP 2 — Categorization of the AI system is performed: task, method, knowledge limits, and whether it is a learning system or operates in a human-in-the-loop setting.
• MAP 3 — AI capabilities, targeted usage, goals, and expected benefits and costs are understood (including whether AI is actually the right tool).
• MAP 4 — Risks and benefits are mapped for all components, including third-party software and data.
• MAP 5 — Impacts to individuals, groups, communities, organizations, and society are characterized, including likelihood and magnitude of harm.

Key signal words: context, intended use, stakeholders, impact assessment, categorize, scope, assumptions, identify risks, dependencies, use case definition.

3.3 MEASURE — Analyze, assess, benchmark, and monitor

Purpose: Employ quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts. Measure uses the trustworthiness characteristics as the lens for evaluation and relies heavily on TEVV — Test, Evaluation, Verification, and Validation.

Four categories (MEASURE 1–4):
• MEASURE 1 — Appropriate methods and metrics are identified and applied; the most significant risks identified in Map are selected for measurement, and independent assessors are involved where possible.
• MEASURE 2 — AI systems are evaluated for trustworthy characteristics: validity, reliability, safety, security, resilience, transparency, accountability, explainability, privacy, and fairness/bias, plus environmental impact and performance in deployment conditions.
• MEASURE 3 — Mechanisms for tracking identified AI risks over time are in place (including emergent and previously unknown risks).
• MEASURE 4 — Feedback about the efficacy of measurement is gathered and assessed, including input from domain experts and end users.

Key signal words: metrics, testing, evaluation, benchmark, validation, bias audit, red teaming, performance monitoring, drift detection, KPIs and KRIs, independent assessment, TEVV.

3.4 MANAGE — Prioritize and act on risks

Purpose: Allocate resources to mapped and measured risks on a regular basis and as defined by Govern. Manage covers risk treatment decisions, response and recovery, communication, and continuous monitoring after deployment.

Four categories (MANAGE 1–4):
• MANAGE 1 — AI risks based on Map and Measure outputs are prioritized, responded to, and managed; this includes determining whether the system achieves its intended purpose and choosing a response — avoid, mitigate, transfer, or accept — documented and based on risk tolerance.
• MANAGE 2 — Strategies to maximize benefits and minimize negative impacts are planned, prepared, implemented, and documented, including mechanisms to deactivate or supersede the system when performance or outcomes are inconsistent with intended use.
• MANAGE 3 — AI risks and benefits from third-party entities are managed and monitored.
• MANAGE 4 — Risk treatments, including response and recovery and communication plans for identified and measured risks, are documented and monitored regularly; incidents are tracked and lessons learned fed back into the process.

Key signal words: prioritize, treat, mitigate, accept, transfer, avoid, incident response, recovery, decommission, kill switch, remediation plan, continuous monitoring post-deployment, communicate to stakeholders.

4. How the Functions Fit Together

A simplified lifecycle view:
• Govern sets the risk appetite, policies, and roles that apply to every AI system.
• Map establishes context and identifies the risks of a specific system.
• Measure quantifies and qualifies those risks against trustworthiness characteristics.
• Manage decides what to do about them and monitors the result.
• Findings from Manage and Measure loop back to update Map (new context) and Govern (policy improvements).

Notice the recurring theme of third-party risk: it appears in GOVERN 6 (policies), MAP 4 (identification), and MANAGE 3 (treatment). Exam questions often test whether you can tell which layer a third-party activity sits in.

5. Profiles and Framework Integration

Profiles:
• Use-case profiles (e.g., hiring, lending, generative AI) tailor the Core to a domain.
• Temporal profiles — a Current Profile describes where the organization is; a Target Profile describes the desired state. The gap between them drives the roadmap.
• Cross-sectoral profiles address risks common across industries.

Integration with other frameworks (AAIR emphasis):
• ISO/IEC 42001 (AI Management System) — Govern aligns with leadership, planning, and support clauses; Map/Measure/Manage align with operation, performance evaluation, and improvement. 42001 is certifiable; the AI RMF is not.
• ISO/IEC 23894 (AI risk management guidance) — follows the ISO 31000 process (context, identification, analysis, evaluation, treatment, monitoring); NIST publishes a crosswalk.
• NIST Cybersecurity Framework 2.0 — CSF added its own Govern function in 2024, mirroring the AI RMF structure; CSF focuses on cyber, AI RMF on sociotechnical AI risk.
• COBIT 2019 — AI RMF Govern maps to the EDM (Evaluate, Direct, Monitor) governance objectives; Manage maps to APO12 (Managed Risk).
• EU AI Act — Article 9 requires a risk management system for high-risk AI; organizations commonly use the AI RMF functions as the operational method to satisfy it.
• NIST Privacy Framework and SP 800-53 — complement the privacy-enhanced and secure/resilient characteristics.

6. Common Misconceptions to Avoid

• The functions are not a strict waterfall; they are iterative and can run concurrently.
• The AI RMF is voluntary and does not itself impose legal obligations.
• Govern is not only for executives — it includes culture, training, and documentation practices at all levels.
• Measure does not fix risks; it quantifies them. Fixing belongs to Manage.
• Map is not testing; it is context-setting and identification. Testing belongs to Measure.
• Risk tolerance is set in Govern and applied in Map (system context) and Manage (treatment decisions).

7. Exam Tips: Answering Questions on NIST AI RMF Functions: Govern, Map, Measure, Manage

Tip 1 — Classify by verb. Ask what the scenario is actually doing: establishing or overseeing (Govern), understanding or identifying (Map), testing or quantifying (Measure), deciding or acting (Manage). The verb usually gives away the answer.

Tip 2 — Govern vs. Manage. Both sound like control. Govern is organizational and ongoing (policies, roles, culture, risk appetite). Manage is system-specific and action-oriented (treat this risk, respond to this incident, decommission this model). If the question mentions a board, a policy, or accountability structure, lean Govern. If it mentions a mitigation, a response plan, or a treatment decision, lean Manage.

Tip 3 — Map vs. Measure. Map answers what could go wrong and for whom; Measure answers how much and how do we know. Stakeholder impact assessments, intended-use definitions, and system categorization are Map. Bias audits, accuracy benchmarks, red-team exercises, and drift metrics are Measure.

Tip 4 — Watch for lifecycle timing. Pre-development context work points to Map. Pre-deployment validation points to Measure. Post-deployment monitoring that triggers a response points to Manage (with ongoing tracking in Measure 3). If a question asks which function should occur first for a new system after governance exists, the answer is Map.

Tip 5 — Know the seven characteristics cold. Questions may describe a problem (e.g., users cannot understand why a loan was denied) and ask which trustworthiness characteristic is at stake (explainable and interpretable) or which function evaluates it (Measure). Remember that valid and reliable is the foundational characteristic.

Tip 6 — Third-party questions. Policy for vendors = GOVERN 6. Identifying risks in a vendor model or dataset = MAP 4. Ongoing monitoring and treatment of vendor risk = MANAGE 3. Choose based on whether the stem is about policy, identification, or ongoing management.

Tip 7 — Risk treatment options. When asked how Manage addresses a risk, the four classic responses are avoid, mitigate, transfer, and accept — and the decision must be documented and consistent with risk tolerance set under Govern. Decommissioning or superseding a system is a legitimate Manage outcome, not a failure.

Tip 8 — Profiles and integration. If the stem describes comparing current practices against a desired state, the answer involves Current and Target Profiles. If the stem asks which framework is certifiable, answer ISO/IEC 42001, not the AI RMF. If it asks how to operationalize EU AI Act Article 9, the AI RMF functions are an acceptable method.

Tip 9 — Eliminate the distractor that is too narrow or too broad. ISACA questions often include one option that is a sub-activity of the correct function and one that belongs to a neighboring function. Pick the option that represents the function-level purpose described in the stem.

Tip 10 — Remember that Govern is cross-cutting. If a question asks which function applies to all AI activities or informs the other three, the answer is Govern.

8. Practice Scenarios

Scenario A: A healthcare provider documents the intended clinical setting, the patient populations affected, and the assumptions behind a triage model before development begins. — Map (MAP 1 and MAP 5).

Scenario B: The chief risk officer approves an enterprise AI risk appetite statement and assigns model owners for every production AI system. — Govern (GOVERN 1 and GOVERN 2).

Scenario C: An independent team runs disparate-impact tests across demographic groups and records accuracy metrics on a holdout dataset. — Measure (MEASURE 2).

Scenario D: After monitoring reveals unacceptable error rates in production, the team rolls back to a prior model version and notifies affected users per the communication plan. — Manage (MANAGE 2 and MANAGE 4).

Scenario E: A company adopts a standard contract clause requiring AI vendors to disclose training data provenance. — Govern (GOVERN 6), because it is a policy, not a system-specific assessment.

9. One-Line Summary

Govern builds the culture and rules; Map finds the risks in context; Measure tests and tracks them against the seven trustworthiness characteristics; Manage prioritizes, treats, responds, and monitors — all iteratively, with Govern at the center and feedback loops connecting every function.