NIST AI RMF

This content was generated with the assistance of AI and should be verified against the official documentation of each tool and framework before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

Written on 2026-10-01 against the NIST AI Risk Management Framework 1.0 (NIST AI 100-1) and the Generative AI Profile NIST AI 600-1 (July 2024); see the version baseline. The mapping on this page is the author’s reading of the documents, not an official NIST crosswalk, and no assessment results are reported: the DocsAssistant is a teaching scenario.

The OWASP lists tell you what attackers do; the NIST AI RMF tells an organisation how to manage AI risk as a whole. It is voluntary and technology-neutral, which makes it the usual bridge between engineering controls and the policies an auditor or a regulator asks about (see EU AI Act).

The four functions

The framework organises risk management into four functions that run continuously rather than once.

flowchart LR G[GOVERN
policies, roles, culture] --> MP[MAP
context and risks] MP --> ME[MEASURE
test, evaluate, monitor] ME --> MA[MANAGE
prioritise, treat, respond] MA -. lessons .-> MP G -. applies to all .-> ME G -. applies to all .-> MA
Function Purpose Typical evidence for a team

Govern

Cross-cutting. Accountability, risk tolerance, policies, third-party and supply-chain oversight, and a culture that allows incidents to be reported.

Named owner, written risk appetite, approved-model list, incident procedure.

Map

Establish context: intended purpose, users, deployment setting, known limits, who can be harmed and how.

System description, data inventory, threat model, list of foreseeable misuse.

Measure

Select and apply quantitative and qualitative methods to analyse and track risks and trustworthiness characteristics.

Evaluation sets, red-team reports, monitoring dashboards.

Manage

Prioritise risks, decide how to treat them, plan responses and recovery, and communicate.

Risk register, mitigation backlog, rollback and incident runbooks.

The Generative AI Profile (AI 600-1)

AI 600-1 is a companion profile that applies the four functions to generative AI. It lists twelve risks that are unique to or made worse by generative AI, and for each one it proposes suggested actions grouped by function. The risks are:

AI 600-1 risk What it means for an application like the DocsAssistant

CBRN information or capabilities

Easier access to information relevant to chemical, biological, radiological or nuclear harm. Mostly a model-provider concern; an application mitigates by narrowing its domain.

Confabulation

Confidently stated but false content (the profile’s term for hallucination).

Dangerous, violent or hateful content

Output that incites, instructs or radicalises.

Data privacy

Leakage or inference of personal data, and unlawful processing of it.

Environmental impacts

Energy and resource cost of training and serving.

Harmful bias and homogenization

Unequal performance across groups and convergence of outputs.

Human-AI configuration

Over-reliance, automation bias and poorly designed oversight.

Information integrity

Mis- and disinformation, and difficulty telling synthetic content from authentic content.

Information security

Attacks on and through the system: prompt injection, data poisoning, exfiltration.

Intellectual property

Reproduction of protected material and uncertain licensing of training data.

Obscene, degrading or abusive content

Including non-consensual intimate or child sexual abuse material.

Value chain and component integration

Opaque third-party models, data and components.

The suggested actions are numbered per function and risk in the document itself; read the profile for the exact wording and identifiers rather than relying on a paraphrase. Typical themes are documenting provenance, testing with red teams and structured public feedback, setting content and usage policies, monitoring after release, and having a way to disengage or decommission a system.

Mapping DocsAssistant controls

The table links each AI 600-1 risk to the OWASP 2026 identifier that usually causes it and to the control pages in this section. A blank technical control means the risk is handled by organisational measures or by the model provider.

AI 600-1 risk Related OWASP 2026 DocsAssistant control RMF function mostly involved

Confabulation

LLM07 Misinformation

Grounding with citations, abstaining when retrieval is empty, see Misinformation and Hallucination Risk

Measure, Manage

Data privacy

LLM02, LLM08

Redaction, access-controlled retrieval, see Sensitive Information and Hidden Context

Map, Manage

Information security

LLM01, LLM03, LLM09, LLM10

Input and output guardrails, least-privilege tools, safe rendering, see Prompt Injection and Guardrails

Measure, Manage

Value chain and component integration

LLM04, LLM05

Pinned and verified models, ML-BOM, see Supply Chain Security

Govern, Map

Human-AI configuration

LLM03

Approval gates for write actions, visible AI disclosure, see Responsible AI Practices

Govern, Manage

Information integrity

LLM07

Labelling AI-generated answers; transparency duties in the EU AI Act

Govern

Harmful bias and homogenization

(none)

Evaluation across user groups and languages, see Responsible AI Practices

Measure

Intellectual property

(none)

Licence checks on indexed content, attribution of sources

Govern, Map

Dangerous, violent or hateful; obscene, degrading or abusive

LLM01 (jailbreak)

Moderation on input and output, red teaming, see AI Red Teaming

Measure, Manage

CBRN; environmental impacts

(none)

Domain restriction; model choice and caching, see Cost Management

Map

Measure and Manage depend on evidence that stays current, which is what LLMSecOps automates, and the Govern function corresponds to the practices in Operational Governance. For the cloud-platform view of the same ideas, see Azure Governance and Compliance.

Using the framework without over-investing

  • Start with Map: a one-page system description and threat model (Trust Boundaries and Threat Modeling) already covers most of it.

  • Pick a small number of Measure indicators you will actually track, and tie each to a threshold in Manage.

  • Keep the mapping in the repository next to the code so it changes with the system.

Where to go next

References