# NIST AI RMF

> The NIST AI Risk Management Framework is a voluntary, widely-adopted structure for identifying and managing AI risk across four functions: Govern, Map, Measure, Manage. Provael produces evidence for the Measure and Manage functions.

Regulation/standard: NIST AI 100-1 · Generative AI Profile (NIST AI 600-1)
Timing: Voluntary framework; widely referenced by auditors and procurement.

## What it is

- NIST AI 100-1 defines the core AI RMF; the Generative AI Profile (NIST AI 600-1) extends it.
- It is voluntary but frequently cited in US procurement and by third-party auditors as a maturity yardstick.
- The Measure function is about analysing, assessing and tracking AI risks with repeatable metrics.
- NIST AI 100-2e2025 provides the adversarial-ML taxonomy Provael names its attacks against (privacy attacks map to NISTAML.03).

## Where a red-team result fits

- **Measure 2.7** — The AI RMF sub-function “AI system security and resilience is evaluated” asks for exactly this evidence — Provael positions the calibrated ASR, its 95% CI and the benign-FPR control as the measurement for it.
- **Measure** — Quantify AI risks and trustworthiness characteristics with repeatable, documented methods — a calibrated ASR with a CI fits directly.
- **Manage** — Prioritise and act on measured risks; a CI red-team gate operationalises the Manage function in the development loop.

## What Provael maps to it

- Measure: a calibrated attack-success rate with a benign control and confidence interval, tracked over time.
- Manage: a CI gate that acts on the measurement and blocks regressions.
- Documentation and reproducible traces supporting the Govern function’s evidence trail.

## Dates (verified 6 Jul 2026)

- AI RMF 1.0 released: January 2023
- Generative AI Profile: July 2024

## Sources

- NIST AI RMF (NIST): https://www.nist.gov/itl/ai-risk-management-framework
- Generative AI Profile NIST AI 600-1 (NIST): https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
- NIST AI 100-2e2025 — Adversarial ML taxonomy (NIST CSRC): https://csrc.nist.gov/pubs/ai/100/2/e2025/final

Canonical: https://www.provael.com/compliance/nist-ai-rmf

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.