NIST AI Risk Management Framework for Security Managers

Why This Topic Matters

The ISACA Advanced in AI Security Management (AAISM) certification expects candidates to understand how AI risk is governed, not just how AI systems are attacked. The NIST AI Risk Management Framework (AI RMF 1.0), released in January 2023, has become the de facto reference model for structuring AI governance programs in the United States and increasingly worldwide. Regulators, auditors, boards and customers frequently ask whether an organization has aligned its AI program to NIST AI RMF, in much the same way they ask about alignment to the NIST Cybersecurity Framework (CSF). For a security manager, the framework provides a common vocabulary to speak with data scientists, legal counsel, privacy officers and executives about AI risk, and it provides a defensible structure when questions of accountability arise after an AI incident.

In the AAISM Body of Knowledge, this topic sits within the AI Governance and Program Management domain. Exam questions will test whether you can identify the purpose of the framework, name and distinguish its four core functions, recognize the characteristics of trustworthy AI, and, most importantly, apply the framework to realistic managerial scenarios. Because the framework is voluntary and outcome-based rather than prescriptive, questions tend to focus on which function or activity is most appropriate rather than on memorizing control numbers.

What the NIST AI RMF Is

The AI RMF was developed by the U.S. National Institute of Standards and Technology under a mandate from the National AI Initiative Act of 2020. Key facts you should know:

- It is voluntary, non-sector-specific, use-case agnostic and rights-preserving.
- It is intended to help organizations incorporate trustworthiness considerations into the design, development, use and evaluation of AI products, services and systems.
- It is designed to be a living document, reviewed and updated as AI technology and practice evolve.
- It is accompanied by a Playbook (suggested actions, references and documentation for each subcategory), Crosswalks to other standards (such as ISO/IEC 42001, ISO/IEC 23894, the OECD AI Principles and the NIST CSF), and Profiles, including the Generative AI Profile (NIST AI 600-1, July 2024).

The framework document is divided into two parts:

Part 1: Foundational Information defines AI risk, explains the challenges of measuring AI risk, identifies the AI actors across the lifecycle, and describes the seven characteristics of trustworthy AI.

Part 2: Core and Profiles presents the four core functions (GOVERN, MAP, MEASURE, MANAGE), their categories and subcategories, and explains how organizations build Profiles to tailor the framework to their context.

How NIST Defines AI Risk

NIST defines risk as the composite measure of an event's probability of occurring and the magnitude or degree of the consequences. Critically, the AI RMF notes that AI risk can produce harms to people (individuals, groups, communities, society), harms to organizations (operations, reputation, legal exposure) and harms to ecosystems (interconnected systems, the environment, the financial system). The framework also acknowledges that AI risks can be positive as well as negative and that the goal is to maximize benefits while minimizing negative impacts, not to eliminate all risk.

The framework identifies unique challenges in AI risk measurement, including risks from third-party components and data, emergent risks that appear only after deployment, difficulty tracking AI risk in production, differences between laboratory and real-world performance, and the inherent opacity of many models. Security managers should recognize that these challenges are why continuous monitoring and Test, Evaluation, Verification and Validation (TEVV) activities are emphasized throughout the AI lifecycle.

The Seven Characteristics of Trustworthy AI

Memorize these; they appear frequently in exam questions and define what the framework is trying to achieve:

1. Valid and Reliable - the system performs as intended, accurately and consistently, under expected conditions. NIST describes this as the necessary condition for trustworthiness.
2. Safe - the system does not lead to a state that endangers human life, health, property or the environment.
3. Secure and Resilient - the system can withstand adversarial attacks (such as data poisoning, model extraction, evasion and prompt injection) and can maintain or return to normal function after disruption. This is the characteristic most directly owned by security managers.
4. Accountable and Transparent - information about the system and its outputs is available to appropriate stakeholders, and roles and responsibilities are clearly assigned.
5. Explainable and Interpretable - the mechanisms behind outputs can be described (explainability) and the meaning of outputs can be understood in context (interpretability).
6. Privacy-Enhanced - norms such as anonymity, confidentiality and control over personal data are respected, often through privacy-enhancing technologies and data minimization.
7. Fair - with Harmful Bias Managed - systemic, computational/statistical and human-cognitive biases are identified and mitigated.

NIST stresses that these characteristics involve trade-offs. For example, increasing explainability may reduce accuracy, or improving privacy may reduce fairness measurement capabilities. Governance decisions must balance them based on context.

The Four Core Functions

The AI RMF Core is organized into four functions. Each function contains categories and subcategories that describe outcomes. Unlike the NIST CSF, the functions are not strictly sequential; MAP, MEASURE and MANAGE are iterative, and GOVERN is cross-cutting and informs all the others.

GOVERN - Cultivate and implement a culture of risk management.
GOVERN establishes the policies, processes, accountability structures and organizational culture that support AI risk management. Its categories address: policies and procedures that are transparent and aligned with legal requirements; accountability structures with clearly defined roles; workforce diversity, equity and inclusion; organizational commitment to a risk-aware culture; engagement with relevant AI actors and stakeholders; and policies for managing third-party risks, including supply chain. GOVERN is described as the foundation and is intended to be applied continuously across the lifecycle. For the security manager, GOVERN is where you establish the AI acceptable use policy, define risk tolerance, assign ownership of AI systems, and integrate AI risk into the enterprise risk management (ERM) program.

MAP - Establish context and identify risks related to that context.
MAP gathers the information needed to understand where and how an AI system is used, who is affected, and what could go wrong. Its categories cover: establishing and understanding context (intended purpose, deployment setting, legal requirements); categorizing the AI system (task, methods, knowledge limits); understanding capabilities, usage, goals and expected benefits and costs; mapping risks and benefits for all components including third-party software and data; and characterizing impacts to individuals, groups, communities and society. MAP is typically performed before development or acquisition decisions and provides the basis for the decision to proceed, modify or halt. Security managers contribute threat modeling, data classification, and identification of attack surfaces during MAP.

MEASURE - Employ quantitative, qualitative or mixed-method tools to analyze, assess, benchmark and monitor AI risk.
MEASURE involves identifying appropriate methods and metrics, evaluating systems for the trustworthy characteristics, tracking identified risks over time, and gathering feedback about the efficacy of measurement. It includes TEVV, red teaming, performance monitoring, bias audits, and tracking of risks that cannot be fully measured. MEASURE outputs feed MANAGE. For security managers, MEASURE includes adversarial testing, vulnerability scanning of AI pipelines, monitoring for model drift and anomalous outputs, and establishing security metrics for AI systems.

MANAGE - Allocate risk resources to mapped and measured risks on a regular basis.
MANAGE involves prioritizing risks based on impact, likelihood and tolerance; deciding on treatment (mitigate, transfer, avoid or accept); documenting residual risk; planning for incident response and recovery; managing third-party risks and benefits; and ensuring that post-deployment monitoring, communication and continual improvement occur. MANAGE is where the security manager implements controls, establishes AI incident response playbooks, defines decommissioning procedures and communicates residual risk to leadership.

A helpful mnemonic: GOVERN surrounds the lifecycle, and inside it you MAP (understand), MEASURE (test) and MANAGE (act), repeating as the system and context change.

AI Actors and the Lifecycle

The framework uses the OECD-inspired AI lifecycle: Plan and Design, Collect and Process Data, Build and Use Model, Verify and Validate, Deploy and Use, Operate and Monitor, with people and planet at the center. AI actors are those who play an active role in the lifecycle, including designers, developers, deployers, operators, end users, TEVV professionals and affected individuals. NIST emphasizes that TEVV should be performed by actors who are independent of those who built the system where possible, which maps directly to the security manager's expectation of segregation of duties.

Profiles

A Profile is an implementation of the AI RMF functions, categories and subcategories tailored for a particular setting, sector or technology. Use-case profiles (for example, hiring, lending, or healthcare) describe how the framework applies to a context. Temporal profiles compare a current state to a target state, enabling gap analysis and roadmap development, exactly as in the NIST CSF. The Generative AI Profile (NIST AI 600-1) identifies twelve risk categories unique to or exacerbated by generative AI, including confabulation, data privacy, information security, harmful bias and homogenization, intellectual property, dangerous or violent content, environmental impacts, human-AI configuration, information integrity, obscene or abusive content, value chain and component integration, and CBRN information. For the exam, know that the Generative AI Profile exists, that it is a companion to AI RMF 1.0, and that it maps suggested actions to the four core functions.

How a Security Manager Operationalizes the Framework

1. Secure executive sponsorship and define roles (GOVERN). Establish an AI governance committee or extend the existing risk committee. Define who approves AI use cases, who owns each model and who accepts residual risk.
2. Build an AI inventory (MAP). You cannot govern what you do not know exists. Catalog AI systems, including embedded AI in SaaS products and shadow AI usage by employees.
3. Integrate with existing frameworks. Crosswalk AI RMF to the NIST CSF 2.0 (which also has a GOVERN function), NIST SP 800-53 controls, ISO/IEC 27001, ISO/IEC 42001 (AI management systems) and the ISACA COBIT framework. The exam rewards recognizing that AI RMF complements rather than replaces existing security governance.
4. Define risk tolerance and impact thresholds. AI RMF does not prescribe risk tolerance; the organization sets it, informed by legal requirements and stakeholder expectations.
5. Establish TEVV and red teaming (MEASURE). Incorporate adversarial ML testing, prompt-injection testing, supply chain verification of models and datasets, and bias testing into the SDLC.
6. Implement controls and incident response (MANAGE). Apply access control to training data and model artifacts, protect model weights as crown-jewel assets, monitor for drift and misuse, and prepare playbooks for AI-specific incidents such as data poisoning or model theft.
7. Document and communicate. Model cards, system cards, data sheets and risk registers provide the transparency and accountability the framework calls for.
8. Iterate. Re-run MAP and MEASURE when models are retrained, repurposed or when the deployment context changes.

Common Points of Confusion

- AI RMF vs. NIST RMF (SP 800-37). The Risk Management Framework for information systems is a federal authorization process with steps like Categorize, Select, Implement, Assess, Authorize, Monitor. The AI RMF is a voluntary framework with GOVERN, MAP, MEASURE, MANAGE. Do not mix the step names.
- AI RMF vs. NIST CSF. CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond, Recover. The only shared function name is GOVERN.
- GOVERN is not a phase. It is cross-cutting and continuous; if a question asks which function applies throughout the lifecycle, the answer is GOVERN.
- Voluntary does not mean optional in practice. Regulators and contracts may require alignment, and the framework is cited in U.S. executive policy on AI.
- Valid and Reliable is the foundation. NIST explicitly states that a system that is not valid and reliable cannot be trustworthy regardless of the other characteristics.
- Secure and Resilient is one characteristic among seven; the security manager must support all seven, not only security.

Exam Tips: Answering Questions on NIST AI Risk Management Framework for Security Managers

Tip 1: Match the verb to the function. If the question describes establishing policy, assigning accountability, setting culture or defining risk tolerance, the answer is GOVERN. If it describes understanding context, identifying stakeholders, inventorying systems or identifying potential impacts, the answer is MAP. If it describes testing, metrics, evaluation, benchmarking, red teaming or monitoring performance, the answer is MEASURE. If it describes prioritizing, treating, responding to incidents, communicating residual risk or decommissioning, the answer is MANAGE.

Tip 2: When two answers seem correct, pick the one that reflects governance first. ISACA exams consistently favor the managerial, risk-based answer over the purely technical one. A security manager's first step is almost always to establish context, obtain sponsorship, or align with risk tolerance, not to deploy a tool.

Tip 3: Remember the framework is outcome-based, not prescriptive. Any answer claiming AI RMF mandates a specific control, tool, certification or regulatory compliance is a distractor. The framework describes outcomes and lets organizations decide how to achieve them.

Tip 4: Know the seven trustworthiness characteristics cold. Questions may describe a scenario (for example, a model produces different approval rates for demographic groups) and ask which characteristic is implicated (Fair with Harmful Bias Managed). Practice mapping scenarios to characteristics.

Tip 5: Watch for trade-off questions. If a question asks about tension between characteristics, remember that the framework acknowledges trade-offs and expects contextual, documented decisions by accountable actors rather than a universal rule.

Tip 6: Third-party risk is explicitly covered. Questions about foundation models from vendors, pre-trained models, open-source components or outsourced data labeling should point you toward GOVERN (third-party policies) and MAP (mapping third-party risks and benefits), and MANAGE (managing third-party risks). Supply chain is a recurring theme.

Tip 7: Independence of TEVV. If a scenario describes developers testing their own model with no independent review, the best answer involves independent testing or assessment, echoing segregation of duties.

Tip 8: Profiles mean tailoring. If a question mentions sector-specific application, current versus target state, or gap analysis, think Profile. If it mentions large language models, hallucination/confabulation or synthetic content, think Generative AI Profile.

Tip 9: Harm categories. Remember the three groupings: harm to people, harm to organizations, harm to ecosystems. A question about societal or environmental impact is not a distractor; it is within scope of AI RMF.

Tip 10: Eliminate answers with absolute language. Words like eliminate all risk, guarantee, always or required by law are usually wrong in the context of a voluntary, risk-based framework whose stated goal is to minimize negative impacts and maximize benefits.

Tip 11: Read for the role. The exam is written for the security manager. Choose answers that reflect what a manager would do: establish governance, align with enterprise risk, communicate to stakeholders, ensure accountability and oversee implementation, rather than personally tuning model hyperparameters.

Sample Question Walkthroughs

Scenario A: An organization is about to acquire a third-party AI model for customer service. The security manager wants to understand the intended use, affected customers and legal requirements before approving. Which AI RMF function is being performed?
Answer: MAP. Establishing context and identifying impacts before deployment is the essence of MAP.

Scenario B: After deployment, the manager wants to detect whether model accuracy degrades over time and whether adversarial inputs are being submitted. Which function?
Answer: MEASURE. Ongoing monitoring, metrics and evaluation belong to MEASURE.

Scenario C: The board asks who is accountable for AI risk decisions and whether a policy exists. Which function?
Answer: GOVERN. Accountability structures and policies are GOVERN outcomes.

Scenario D: A measured bias risk exceeds tolerance. The manager must decide whether to retrain, restrict use or discontinue the system and document the residual risk. Which function?
Answer: MANAGE. Risk treatment and residual risk documentation are MANAGE outcomes.

Scenario E: Which trustworthiness characteristic is described as the necessary condition without which the others cannot be achieved?
Answer: Valid and Reliable.

Final Summary

The NIST AI RMF gives security managers a structured, widely recognized approach to governing AI risk. Know that it is voluntary and outcome-based; that it defines AI risk in terms of harms to people, organizations and ecosystems; that it names seven characteristics of trustworthy AI with Valid and Reliable as the foundation and Secure and Resilient as the security manager's primary domain; that its Core consists of the cross-cutting GOVERN function plus the iterative MAP, MEASURE and MANAGE functions; and that Profiles, the Playbook, Crosswalks and the Generative AI Profile support tailored implementation. On the AAISM exam, read each scenario for the action being described, map it to the correct function or characteristic, favor governance-first and risk-based answers, and eliminate choices that treat the framework as a prescriptive or mandatory control catalog.