Cloud 101CircleEventsBlog
Register for CSA’s free Virtual Cloud Trust Summit to tackle enterprise challenges in cloud assurance.

NIST's AI Risk Management Framework Explained

NIST's AI Risk Management Framework Explained

Blog Article Published: 08/30/2023

Originally published by Schellman.

The National Institute of Standards and Technology (NIST) has made a significant move in introducing its groundbreaking AI Risk Management Framework (AI RMF). Designed to empower organizations and individuals with comprehensive risk management guidance, the AI RMF aims to create a world where AI can thrive responsibly.

Such a development indicates that NIST recognizes the pressing need for effective AI risk management now that this game-changing technology is revolutionizing industries and reshaping processes—from personalized recommendations and predictive analytics to autonomous vehicles and advanced medical diagnostics, AI's potential seems limitless.

However, with great power comes great responsibility—as AI's capabilities expand, so do the risks associated with its deployment, and with it proliferating across various sectors, managing the inherent risks has become paramount to ensure a safe, accountable, and trustworthy AI landscape.

To address these challenges, NIST created its AI RMF, which offers a flexible set of guidelines to assist AI actors—be it organizations or individuals—in understanding and mitigating the unique risks posed by AI systems. We’re going to break down the framework—including its foundation information and core functions—so that as the use of AI continues to open new doors, your organization is better informed and can stay on the right side of progress.

What is the NIST AI RMF?

As AI continues to embed itself into more and more, privacy breaches, security vulnerabilities, biased decision-making, and societal impacts are among the primary concerns that demand immediate attention.

3 Categories of AI Harm

Despite this variety of threats, the AI RMF begins by establishing three overarching categories of harm that AI actors must consider:

  • Harm to People: Ensuring the protection of individual liberties, physical and psychological safety, and equal opportunities while upholding democracy and education.
  • Harm to an Organization: Safeguarding against disruptions in business operations, potential security breaches, and damage to reputation.
  • Harm to an Ecosystem: Preventing disruptions in global financial or supply chain systems and minimizing environmental and natural resource damage.

7 Characteristics of Trustworthy AI Systems

So that organizations may avoid all of those types of harm, the NIST AI RMF aims to help improve developer ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.

In this, the framework outlines seven essential characteristics of said trustworthy AI systems:

  • Valid and Reliable: AI systems should deliver accurate and dependable outcomes.
  • Safe: AI systems should prioritize the safety of users and prevent harm.
  • Secure and Resilient: AI systems should safeguard against malicious attacks and ensure resilience in the face of challenges.
  • Accountable and Transparent: AI systems should be explainable, transparent, and accountable for their decisions.
  • Explainable and Interpretable: The inner workings of AI systems should be understandable and interpretable.
  • Privacy-Enhanced: AI systems should respect user privacy and protect personal data.
  • Fair with Harmful Bias Managed: AI systems should ensure fairness in AI outcomes and manage harmful biases.

What are the NIST AI RMF Core Functions?

To achieve AI systems of this caliber, regular evaluations of AI risk management effectiveness are encouraged to continuously improve risk mitigation strategies. But the AI RMF's core also divides these activities into four interconnected functions: Govern, Map, Measure, and Manage.

Each function comprises various categories and sub-categories, with specific actions recommended throughout the AI system lifecycle:

NIST AI RMF Core Function



Despite their interdependence, AI actors working together within a system oftentimes do not have visibility into or control over the other parts, making it difficult to reliably predict collective impacts during risk management.

As the first function in the lifecycle, the Map function asks that you gather diverse perspectives, including internal teams, any external collaborators, end users, and anyone else that may be potentially impacted so that you can more completely frame your AI risks.


Once you have the thorough understanding acquired through the Map function, the Measure function asks that AI systems be tested both before deployment and regularly while in operation to maintain a current understanding of their functionality and trustworthiness.

Consistently analyzing, assessing, benchmarking, and monitoring AI risks and impacts through a variety of different tools will help you manage them better, as well as preserve their security.


With such a complete understanding and regular reevaluations of AI systems, you’ll be better able to Manage them with proper risk treatment, including allocating appropriate resources to maximize AI benefits while minimizing negative impacts.


This overarching function enables all the others, as it provides guidelines for the implementation of structures, systems, processes, and teams to help you:

  • Establish a strong risk management culture;
  • Developing policies and procedures; and
  • Integrate feedback mechanisms for effective risk identification and mitigation.

For all of these functions, the NIST AI RMF Playbook contains further categories of information and specific practices regarding how to implement each.

Though intended for voluntary use, the AI RMF offers a comprehensive roadmap to navigate AI risks responsibly, ensuring that AI becomes a force for positive change in our lives. In a world where AI's impact is reshaping possibilities, adopting this transformative framework can help you make AI a real asset where innovation, accountability, and societal benefit converge harmoniously to empower humanity.

Other Cybersecurity Considerations for the Future

Altogether, the release of NIST's AI Risk Management Framework marks a crucial step towards a future where AI thrives responsibly in the mainstream. Embracing the principles of the AI RMF will empower your organization to unlock the true potential of AI while safeguarding against potential risks.

Share this content on your favorite social network today!