NIST AI RMF

AI Risk Management Framework: AI component inventory, transparency, AI versioning.


Short name	AI RMF
Region	Americas
Country or scope	United States
Sector	AI
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers AI RMF

Scan requirements: 4, all decided by a scan.
Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for AI RMF.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for AI RMF and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AIRNMF-MAP-1` AI/ML Component Identification	NIST AI RMF requires identification of AI/ML components for risk categorization	Scan
`AIRNMF-MAP-3` AI Model Documentation	AI models must be documented with purpose, training data, and limitations	Scan
`AIRNMF-GOVERN-1` AI System Transparency	NIST AI RMF requires transparency about AI systems including component identification	Scan
`AIRNMF-MEASURE-2` AI Component Version Tracking	AI model versions must be tracked for drift detection and reproducibility	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`GOVERN-1.1`	Establish policies and processes for AI risk management
`GOVERN-1.2`	Integrate AI risk management into enterprise risk management
`GOVERN-4.1`	Define accountability for AI system outcomes
`MAP-1.1`	Identify context and intended purpose of AI systems
`MAP-2.1`	Identify and classify AI risks prior to deployment
`MAP-3.1`	Assess impact on individuals and society from AI systems
`MEASURE-1.1`	Test AI system performance against stated objectives
`MEASURE-2.1`	Evaluate AI system bias and fairness
`MEASURE-2.6`	Evaluate AI system security and adversarial robustness
`MANAGE-1.1`	Implement controls to manage AI risks
`MANAGE-2.2`	Maintain human oversight of high-risk AI decisions
`MANAGE-3.1`	Monitor AI system behavior in production
`MANAGE-4.1`	Plan for decommissioning of AI systems

Policy templates

Written for AI RMF:

AI Governance and Accountability Policy
AI Risk Identification and Categorization Policy
AI System Evaluation and Measurement Policy
AI Incident Management and Response Policy

And 22 from the standard set, adapted to AI RMF.