NIST AI RMF coverage
Overview
Section titled “Overview”Govern → Compliance program → Framework controls → NIST AI RMF covers every subcategory of the AI RMF Core: 72 subcategories in 19 categories under the four functions GOVERN, MAP, MEASURE and MANAGE. Every subcategory has a status in every environment, so you can show a reviewer a complete current profile rather than a selection.
Source
Section titled “Source”The subcategories, their ids and their wording come from:
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, January 2023, Tables 1–4 (doi.org/10.6028/NIST.AI.100-1).
Each subcategory carries NIST’s wording verbatim, shown when you expand it and in the export as text. NIST publications are works of the US Government and are not subject to copyright in the United States. Ids are written GOVERN-1.1 (NIST writes “GOVERN 1.1”) so that exports stay comparable with earlier releases. The pack version is 2.0.0; the export names the source under source.
The AI RMF Playbook suggests actions for each subcategory. The one-line hint in the attestation dialog is written for Shield360 and is not taken from the Playbook.
How a subcategory gets its status
Section titled “How a subcategory gets its status”Each subcategory has an attestation, from its Statement of Applicability entry: whether it applies, who owns it, where its evidence is and when it was last reviewed. Where Shield360 observes something that genuinely evidences the outcome, the subcategory also has observed checks. The status is the worst of the attestation and the checks:
| Status | Meaning |
|---|---|
| Met | Attested (applicable, owned, evidenced, reviewed within its cadence) and every observed check is met. |
| Gap | The attestation is incomplete or overdue, or an observed check found a gap. The reason says which. |
| No evidence | Nobody has recorded whether the subcategory applies, or an observed source has nothing to judge or could not be read. |
| Not applicable | Recorded as not applicable, with a justification. It leaves the status whatever was observed. |
A subcategory that is a gap or has no evidence but has at least one met check is also shown as Partly met.
An attestation never hides an observed gap. A subcategory whose checks are all met is never met until someone attests it.
Observed and attested only
Section titled “Observed and attested only”- 44 subcategories are observed and attested. Runtime evidence speaks to them: the AI inventory, the risk register, impact assessments, AI requests, evaluations, prompt-injection detection, sensitive-data protection, agent ownership and authorization, red teaming, the audit log, alerting, transports and activity provenance.
- 28 subcategories are attested only. They describe organisational outcomes a runtime platform cannot observe, such as training (GOVERN 2.2), executive responsibility (GOVERN 2.3), workforce diversity (GOVERN 3.1), external feedback (GOVERN 5), benefits and costs (MAP 3.1, 3.2), human-subject evaluations (MEASURE 2.2), environmental impact (MEASURE 2.12) and consultation with domain experts (MEASURE 4). What your team records is their only evidence.
A check is mapped only where it shows the outcome, or a measurable part of it. Where it shows only part, the subcategory’s note says which part, and the rest is attested. For example, GOVERN 1.7 (decommissioning) is observed only to the extent that rejected or retired AI is not still in use.
Two checks exist for the AI RMF:
- AI risks are owned, reviewed on time and treated (
risks.managed) reads the risk register. - AI output is evaluated for bias (
evaluations.bias) shows a bias evaluation ran. It shows bias is measured, not that the output is fair.
Subcategories
Section titled “Subcategories”Govern
Section titled “Govern”GOVERN 1. Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| GOVERN-1.1 Legal and regulatory requirements are understood | Observed and attested | Approved model list is set and enforced; Sensitive-data protection is on in every channel; Runtime findings in the period |
| GOVERN-1.2 Trustworthy AI characteristics are in policy and practice | Observed and attested | Approved model list is set and enforced; Sensitive-data protection is on in every channel; Prompt-injection detection is on; Runtime findings in the period |
| GOVERN-1.3 Risk management effort follows risk tolerance | Observed and attested | AI assets have a risk rating; AI systems have a current approved impact assessment |
| GOVERN-1.4 Risk management is established through transparent policies and controls | Observed and attested | AI risks are owned, reviewed on time and treated; Sequence policies are on; Audit log is recording; Runtime findings in the period |
| GOVERN-1.5 Risk management is monitored and periodically reviewed | Observed and attested | AI assets are reviewed and decisions are current; AI risks are owned, reviewed on time and treated; Governance alerts reach a person |
| GOVERN-1.6 AI systems are inventoried | Observed and attested | AI inventory exists; AI assets have an owner; Every AI agent has an owner who is still an active member |
| GOVERN-1.7 AI systems are decommissioned safely | Observed and attested | Rejected AI is not in use |
GOVERN 2. Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| GOVERN-2.1 Roles, responsibilities and lines of communication are documented | Observed and attested | AI assets have an owner; Every AI agent has an owner who is still an active member; Every AI agent has an owner, a purpose and a current access review |
| GOVERN-2.2 Personnel and partners receive AI risk management training | Attested only | None |
| GOVERN-2.3 Executive leadership takes responsibility for AI risk decisions | Attested only | None |
GOVERN 3. Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| GOVERN-3.1 AI risk decisions are informed by a diverse team | Attested only | None |
| GOVERN-3.2 Roles for human-AI configurations and oversight are defined | Observed and attested | Sequence policies are on; Coding agents ask before acting; Every AI agent has an owner, a purpose and a current access review |
GOVERN 4. Organizational teams are committed to a culture that considers and communicates AI risk.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| GOVERN-4.1 A critical-thinking, safety-first culture is fostered | Attested only | None |
| GOVERN-4.2 Teams document and communicate AI risks and impacts | Observed and attested | AI risks are owned, reviewed on time and treated; AI systems have a current approved impact assessment |
| GOVERN-4.3 Testing, incident identification and information sharing are enabled | Observed and attested | Evaluations are running; AI agents under test are red-teamed and no critical attack gets through; Governance alerts reach a person |
GOVERN 5. Processes are in place for robust engagement with relevant AI actors.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| GOVERN-5.1 External feedback on impacts is collected and integrated | Attested only | None |
| GOVERN-5.2 Adjudicated feedback is incorporated into design | Attested only | None |
GOVERN 6. Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| GOVERN-6.1 Third-party AI risks are addressed by policy | Observed and attested | AI vendors have an owner and a decision; AI requests are decided by a reviewer; AI tools are used through the company’s accounts |
| GOVERN-6.2 Contingencies exist for high-risk third-party failures | Attested only | None |
MAP 1. Context is established and understood.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MAP-1.1 Intended purposes and context of use are documented | Observed and attested | AI inventory exists; AI systems have a current approved impact assessment; Runtime findings in the period |
| MAP-1.2 Context is set by interdisciplinary, diverse actors | Attested only | None |
| MAP-1.3 Mission and goals for AI are documented | Attested only | None |
| MAP-1.4 Business value is defined | Observed and attested | AI requests are decided by a reviewer |
| MAP-1.5 Risk tolerances are documented | Attested only | None |
| MAP-1.6 System requirements are elicited | Attested only | None |
MAP 2. Categorization of the AI system is performed.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MAP-2.1 Tasks and methods are defined | Observed and attested | AI inventory exists |
| MAP-2.2 Knowledge limits and human oversight are documented | Observed and attested | AI systems have a current approved impact assessment |
| MAP-2.3 Scientific integrity and TEVV considerations are documented | Observed and attested | Evaluations are running; Datasets feeding AI systems are owned, sourced, licensed, classified, examined for quality and bias, and approved; Runtime findings in the period |
MAP 3. AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MAP-3.1 Potential benefits are documented | Attested only | None |
| MAP-3.2 Potential costs are documented | Attested only | None |
| MAP-3.3 Targeted application scope is specified | Observed and attested | AI systems have a current approved impact assessment; Every AI agent has an owner, a purpose and a current access review |
| MAP-3.4 Operator and practitioner proficiency is defined | Attested only | None |
| MAP-3.5 Human oversight processes are defined | Observed and attested | Sequence policies are on; Coding agents ask before acting; Every AI agent has an owner, a purpose and a current access review; Runtime findings in the period |
MAP 4. Risks and benefits are mapped for all components of the AI system including third-party software and data.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MAP-4.1 Technology and legal risks of components are mapped | Observed and attested | AI vendors have an owner and a decision; AI assets have a risk rating; AI requests are decided by a reviewer; Datasets feeding AI systems are owned, sourced, licensed, classified, examined for quality and bias, and approved; Runtime findings in the period |
| MAP-4.2 Internal risk controls for components are identified | Observed and attested | Approved model list is set and enforced; AI provider keys are clean; Data reaching AI agents is classified, authorized and recorded; Datasets feeding AI systems are owned, sourced, licensed, classified, examined for quality and bias, and approved |
MAP 5. Impacts to individuals, groups, communities, organizations, and society are characterized.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MAP-5.1 Likelihood and magnitude of impacts are documented | Observed and attested | AI systems have a current approved impact assessment; AI assets have a risk rating; AI risks are owned, reviewed on time and treated; Runtime findings in the period |
| MAP-5.2 Engagement and feedback on impacts are in place | Attested only | None |
Measure
Section titled “Measure”MEASURE 1. Appropriate methods and metrics are identified and applied.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MEASURE-1.1 Approaches and metrics for the most significant risks are selected | Observed and attested | Evaluations are running; Runtime findings in the period |
| MEASURE-1.2 Metrics and control effectiveness are regularly assessed | Attested only | None |
| MEASURE-1.3 Independent assessors are involved | Attested only | None |
MEASURE 2. AI systems are evaluated for trustworthy characteristics.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MEASURE-2.1 Test sets, metrics and TEVV tools are documented | Observed and attested | Evaluations are running; AI agents under test are red-teamed and no critical attack gets through; Datasets feeding AI systems are owned, sourced, licensed, classified, examined for quality and bias, and approved |
| MEASURE-2.2 Evaluations with human subjects meet requirements | Attested only | None |
| MEASURE-2.3 Performance is measured in deployment-like conditions | Observed and attested | Evaluations are running; Runtime findings in the period |
| MEASURE-2.4 Functionality and behaviour are monitored in production | Observed and attested | Evaluations are running; Governance alerts reach a person; AI actions have provenance; Microsoft 365 Copilot interactions are recorded; Runtime findings in the period |
| MEASURE-2.5 Validity and reliability are demonstrated | Observed and attested | Evaluations are running; Runtime findings in the period |
| MEASURE-2.6 Safety risks are evaluated regularly | Observed and attested | Evaluations are running; Governance alerts reach a person; Runtime findings in the period |
| MEASURE-2.7 Security and resilience are evaluated | Observed and attested | Prompt-injection detection is on; Prompt-injection detections are handled; AI provider keys are clean; AI agents under test are red-teamed and no critical attack gets through; Runtime findings in the period |
| MEASURE-2.8 Transparency and accountability risks are examined | Observed and attested | Audit log is recording; AI actions have provenance; Every AI agent has an owner who is still an active member |
| MEASURE-2.9 The model is explained and output interpreted in context | Attested only | None |
| MEASURE-2.10 Privacy risk is examined | Observed and attested | Sensitive-data protection is on in every channel; Sensitive data is stopped before it reaches a model; Data reaching AI agents is classified, authorized and recorded; Runtime findings in the period |
| MEASURE-2.11 Fairness and bias are evaluated | Observed and attested | AI output is evaluated for bias |
| MEASURE-2.12 Environmental impact is assessed | Attested only | None |
| MEASURE-2.13 Effectiveness of TEVV metrics is evaluated | Attested only | None |
MEASURE 3. Mechanisms for tracking identified AI risks over time are in place.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MEASURE-3.1 Existing and emergent risks are tracked | Observed and attested | AI risks are owned, reviewed on time and treated; Governance alerts reach a person; Evaluations are running; Runtime findings in the period |
| MEASURE-3.2 Hard-to-measure risks are tracked | Attested only | None |
| MEASURE-3.3 End users can report problems and appeal outcomes | Attested only | None |
MEASURE 4. Feedback about efficacy of measurement is gathered and assessed.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MEASURE-4.1 Measurement is connected to deployment context | Attested only | None |
| MEASURE-4.2 Trustworthiness results are validated with domain experts | Attested only | None |
| MEASURE-4.3 Performance changes are identified from consultation and field data | Attested only | None |
Manage
Section titled “Manage”MANAGE 1. AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MANAGE-1.1 Go / no-go decision on development or deployment | Observed and attested | AI requests are decided by a reviewer; AI assets are reviewed and decisions are current; AI systems have a current approved impact assessment |
| MANAGE-1.2 Risk treatment is prioritised by impact and likelihood | Observed and attested | AI risks are owned, reviewed on time and treated |
| MANAGE-1.3 Responses to high-priority risks are planned | Observed and attested | AI risks are owned, reviewed on time and treated; Rejected AI is not in use; Use outside the approved list is stopped; Runtime findings in the period |
| MANAGE-1.4 Negative residual risks are documented | Observed and attested | AI systems have a current approved impact assessment; AI risks are owned, reviewed on time and treated |
MANAGE 2. Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MANAGE-2.1 Resources and non-AI alternatives are considered | Attested only | None |
| MANAGE-2.2 The value of deployed AI systems is sustained | Observed and attested | Evaluations are running; AI assets are reviewed and decisions are current |
| MANAGE-2.3 Previously unknown risks are responded to | Observed and attested | Governance alerts reach a person; AI risks are owned, reviewed on time and treated; Runtime findings in the period |
| MANAGE-2.4 Systems acting outside intended use can be disengaged | Observed and attested | Rejected AI is not in use; Use outside the approved list is stopped; Sequence policies are on; Runtime findings in the period |
MANAGE 3. AI risks and benefits from third-party entities are managed.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MANAGE-3.1 Third-party risks are monitored and controlled | Observed and attested | AI vendors have an owner and a decision; AI provider keys are clean; Approved model list is set and enforced; Use outside the approved list is stopped; AI tools are used through the company’s accounts |
| MANAGE-3.2 Pre-trained models are monitored | Observed and attested | Approved model list is set and enforced; Use outside the approved list is stopped |
MANAGE 4. Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.
| Subcategory | Evidence | Observed checks |
|---|---|---|
| MANAGE-4.1 Post-deployment monitoring plans are implemented | Observed and attested | Evaluations are running; Governance alerts reach a person; Audit log is recording; AI actions have provenance; Changes to AI artifacts are released through approved transports; Runtime findings in the period |
| MANAGE-4.2 Continual improvement is built into updates | Attested only | None |
| MANAGE-4.3 Incidents and errors are communicated and tracked | Observed and attested | Governance alerts reach a person; Audit log is recording |
“Runtime findings in the period” is the roll-up of per-trace finding categories (see Rolled-up findings).
Record the profile
Section titled “Record the profile”- Open Govern → Compliance program → Framework controls and choose NIST AI RMF.
- Use Function to work through GOVERN, MAP, MEASURE and MANAGE, and Evidence → Attested only to find the subcategories that depend on your records.
- Select Applicability, then Edit on a subcategory. The dialog shows NIST’s wording and a hint on the evidence that usually satisfies it.
- Record whether it applies (with a justification when it does not), the owner, a link or note to the evidence, the review cadence and the last review.
Changing an entry needs the Maintain the Statement of Applicability permission (compliance.soa.manage), and every change is written to the audit log without its free text. See Access.
Export and evidence package
Section titled “Export and evidence package”The JSON export carries all 72 subcategories with their statuses, checks, attestations, NIST wording and category, plus coverage, source and groups. The CSV has one row per subcategory with its category in group. The evidence package for the NIST AI RMF includes statement-of-applicability.json with the source and coverage, and the PDF report states the coverage and source under its controls table.
Limits
Section titled “Limits”- Attestation is self-reported. Shield360 does not check that the evidence you link is adequate or true. A reviewer still needs to look at it.
- Observation is partial. A met check shows what Shield360 saw in one environment for the period. It cannot show intent, culture, training or what happens outside the AI traffic Shield360 sees.
- Not every AI system is visible. Systems that never send telemetry, pass through a governed channel or appear in the inventory are not observed.
- One environment at a time. Statuses and attestations are kept per environment (database configuration). An organisation-wide profile means recording each environment.
- Bias is measured, not judged.
evaluations.biasshows bias evaluations ran, not that results meet your fairness criteria. - No NIST profile is implied. Shield360 does not implement a NIST use-case profile (such as the Generative AI Profile, NIST AI 600-1); its actions are not separately tracked.
- Ids changed meaning in pack 2.0.0. Earlier packs labelled some ids loosely (for example MEASURE-2.6 as security, MEASURE-2.7 as privacy). From 2.0.0 every id matches NIST’s numbering, so daily history recorded before the upgrade may reflect the earlier mapping for those ids.