title: “NIST AI RMF Mapping” description: “How AIGO relates to the NIST AI Risk Management Framework.”
NIST AI RMF Mapping
The AIGO Framework provides a dedicated mapping package for relating AIGO governance structures, activities, controls, and records to the NIST AI Risk Management Framework (AI RMF). The mapping is intended to help organizations connect AIGO’s governance and lifecycle model with established AI risk-management practices. The NIST AI RMF remains a separate framework with its own structure, terminology, functions, categories, and intended use.Purpose
The mapping can help organizations: * understand relationships between AIGO and the NIST AI RMF * organize AI risk-management activities * identify governance responsibilities * relate AI RMF functions to AIGO activities and controls * support implementation planning * support gap analysis * identify evidence requirements * support assessment and assurance * combine AIGO with existing NIST AI RMF practices The mapping is intended as an implementation and traceability aid.Coverage
The AIGO v0.1 mapping package includes relationships covering: * NIST AI RMF functions * NIST AI RMF categories * AI risk management * governance * lifecycle activities * implementation * controls * evidence * monitoring * assessment * assurance * AIGO control relationships The detailed mapping artifacts are maintained separately under the repository mapping package.NIST AI RMF functions
The NIST AI RMF organizes AI risk management around four core functions: * Govern * Map * Measure * Manage AIGO provides governance and lifecycle structures that can be related to these functions. A simplified conceptual relationship is: Govern → Map → Measure → Manage → improve The exact mapping between individual NIST AI RMF categories and AIGO activities is maintained in the controlled mapping package.Using the mapping
Organizations already using the NIST AI RMF can use the mapping to identify relationships between existing risk-management practices and AIGO governance structures. A practical approach is: 1. Identify the applicable NIST AI RMF function or category. 2. Locate the corresponding AIGO mapping relationship. 3. Identify the relevant AIGO governance activity or control. 4. Determine the required governance records and evidence. 5. Assess the current implementation. 6. Identify gaps or deficiencies. 7. Implement improvements where appropriate. 8. Perform governance review or assurance. 9. Maintain traceability between the NIST AI RMF practice and the resulting AIGO records. A simplified relationship is: NIST AI RMF function / category → AIGO mapping → governance activity / control → evidence → assessment → assuranceGovern
The NIST AI RMF Govern function addresses organizational governance of AI risk. AIGO provides governance structures that can support areas such as: * governance ownership * accountability * decision authority * policies * procedures * risk governance * control ownership * escalation * assurance * management review * continual improvement These activities can provide an operational governance structure around AI systems and their associated risks.Map
The Map function supports understanding AI systems, their context, intended use, impacts, and risks. AIGO provides related lifecycle activities including: * AI system registration * intended-use documentation * stakeholder identification * classification * risk identification * deployment-context assessment * governance applicability * change management These records can provide structured context for understanding AI risks and governance requirements.Measure
The Measure function supports analysis, assessment, and measurement of AI risks and related characteristics. AIGO provides related mechanisms including: * risk assessment * control assessment * evidence collection * monitoring * assurance * governance evaluation * validation * findings * performance review Where machine-readable evaluation is used, defined governance conditions can also be represented through AIGO rules and evaluated against applicable governance records.Manage
The Manage function supports prioritization and treatment of identified AI risks. AIGO provides governance activities that can support this function, including: * risk treatment * control implementation * remediation * approval * monitoring * incident management * change management * risk acceptance * assurance * continual improvement * retirement This provides a lifecycle mechanism for responding to identified risks and maintaining governance decisions over time.Risk management
Risk management is a central relationship between AIGO and the NIST AI RMF. AIGO provides a structured governance chain: AI system → risk → treatment → control → evidence → assessment → assurance This can help organizations maintain traceability from an AI system and its context through risk identification and treatment to governance decisions and evidence. The NIST AI RMF mapping provides the relationship to the relevant AI RMF functions and categories.Controls
AIGO provides a dedicated governance control framework and machine-readable control schema. The mapping can help organizations identify where AIGO controls may support NIST AI RMF outcomes or practices. A mapping relationship may indicate that an AIGO control: * supports a relevant AI RMF practice * contributes to risk treatment * provides governance evidence * supports assessment * supports monitoring * supports assurance * addresses only part of a broader risk-management expectation A mapping does not mean that the AIGO control is identical to the NIST AI RMF practice.Evidence and traceability
AIGO provides structured governance records that can support evidence and traceability. Relevant records may include: * AI system records * classification records * risk assessments * control records * control assessments * approvals * monitoring records * incident records * change records * assurance records * management reviews * improvement records * retirement records A practical traceability chain is: AI RMF practice → AIGO activity / control → evidence → assessment → assurance Evidence should be evaluated in context. The existence of an AIGO evidence record does not automatically demonstrate that a particular NIST AI RMF outcome has been achieved.Evaluation and automation
AIGO’s machine-readable evaluation layer can support defined governance checks associated with mapped requirements or conditions. The conceptual relationship is: NIST AI RMF practice → AIGO mapping → governance condition → rule → evaluation → result Evaluation can help identify whether defined governance conditions are satisfied according to the rules that have been implemented. Automated evaluation should not be interpreted as a universal substitute for human risk assessment, contextual analysis, or governance judgment.Combining AIGO with NIST AI RMF
Organizations do not necessarily need to replace existing NIST AI RMF practices when adopting AIGO. AIGO can be used as an operational governance layer around existing AI risk-management activities. For example: NIST AI RMF → establishes risk-management functions and categories AIGO → provides governance lifecycle activities, controls, records, evidence relationships, and implementation guidance Organization → applies both within its own governance model, policies, risk criteria, and operating context This can allow organizations to maintain continuity with existing NIST AI RMF practices while introducing a more structured operational governance model.Relationship to conformity and certification
The NIST AI RMF is a voluntary risk-management framework and is not itself a certification standard. Therefore, an AIGO-to-NIST AI RMF mapping should not be interpreted as establishing: * certification * accreditation * legal compliance * regulatory conformity * successful external assessment * guaranteed achievement of every AI RMF outcome Organizations should determine how the AI RMF is being used within their own governance model and what evidence is appropriate for demonstrating the intended outcomes.Maintenance
The mapping should be reviewed when: * the NIST AI RMF changes * NIST publishes relevant updates or companion material * AIGO changes * AIGO controls change * governance processes change * new risk-management practices are introduced * assurance findings identify mapping deficiencies * organizational AI use changes Mapping updates should preserve appropriate version and source traceability.Important limitation
The AIGO NIST AI RMF mapping expresses relationships between two governance models. It does not mean that AIGO is equivalent to the NIST AI RMF or that implementation of AIGO automatically establishes achievement of every NIST AI RMF outcome. Organizations remain responsible for determining how the NIST AI RMF applies to their governance model, risk profile, AI systems, and intended outcomes.Canonical source
The complete NIST AI RMF mapping package is maintained in:mappings/nist-ai-rmf/
The repository contains the controlled AIGO mapping artifacts and associated supporting materials.
The mapping should be interpreted together with the applicable NIST AI RMF materials and authoritative NIST sources.