AIGO — NIST AI Risk Management Framework Mapping

AIGO — AI Governance Operating Framework

Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-NIST-AIRMF-001 Mapping Standard: NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0 Mapping Type: Master Framework Mapping Owner: AIGO Governance Function Review Cycle: At least annually and upon material changes to AIGO or the referenced NIST framework Classification: Controlled Framework Documentation

1. Purpose

This document establishes the master relationship between the AIGO AI Governance Operating Framework and the NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0. The purpose of this mapping is to demonstrate how AIGO provides an operational governance architecture capable of implementing, organizing, evidencing, monitoring, and continually improving AI risk-management activities aligned with the NIST AI RMF. This document provides the top-level mapping architecture. Detailed mappings are maintained in the associated documents:

02-AIGO-NIST-AI-RMF-Functions-Mapping-v0.1.md
03-AIGO-NIST-AI-RMF-Categories-Mapping-v0.1.md
04-AIGO-NIST-AI-RMF-Lifecycle-Mapping-v0.1.md
05-AIGO-NIST-AI-RMF-Risk-Mapping-v0.1.md
06-AIGO-NIST-AI-RMF-Governance-Mapping-v0.1.md
07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md
08-AIGO-NIST-AI-RMF-Implementation-Mapping-v0.1.md

This document should therefore be treated as the master cross-framework relationship document, while the subordinate mapping documents provide progressively greater implementation detail.

2. Mapping Baseline

The primary external reference for this mapping is: NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0, NIST AI 100-1. NIST describes the AI RMF Core through four functions:

GOVERN
MAP
MEASURE
MANAGE

The GOVERN function is cross-cutting and is intended to inform and be integrated throughout the other functions. NIST describes the framework as voluntary and designed to support organizations in managing AI risks and promoting trustworthy and responsible AI systems. This AIGO mapping is therefore not intended to represent NIST AI RMF as a mandatory compliance standard. It establishes a structured correspondence between the NIST AI RMF and the AIGO operating model.

3. Mapping Status and Version Control

This document is based on the NIST AI RMF 1.0 baseline. NIST currently indicates that the AI RMF 1.0 is being revised. Consequently, this mapping shall be reviewed when a revised NIST AI RMF is formally issued. Until such revision occurs, references to the NIST AI RMF in this document mean:

NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0.

AIGO shall not silently change the mapping baseline when NIST publishes supporting material, profiles, playbooks, informative references, or other related resources. Material changes to the mapping baseline shall be documented through AIGO change management.

4. Scope

This mapping covers the relationship between NIST AI RMF 1.0 and the following AIGO components:

AIGO governance architecture
AIGO governance domains
AIGO governance roles
AIGO AI governance lifecycle
AIGO AI risk management
AIGO governance controls
AIGO implementation guidance
AIGO operational procedures
AIGO monitoring and assurance
AIGO continuous improvement
AIGO evidence management
AIGO decision-making and approval structures
AIGO AI system profiles
AIGO maturity assessment

The mapping does not attempt to reproduce the complete text of the NIST AI RMF.

5. Mapping Objectives

The mapping has the following objectives:

Establish traceability between AIGO and NIST AI RMF 1.0.
Demonstrate where AIGO addresses NIST AI RMF functions.
Identify the AIGO governance mechanisms supporting NIST AI RMF activities.
Establish relationships between AI risk management and the AIGO lifecycle.
Establish evidence relationships for NIST-aligned AI risk management.
Support implementation of NIST AI RMF through AIGO procedures and controls.
Support assessment and assurance activities.
Identify potential mapping gaps.
Prevent unsupported claims of equivalence or certification.
Provide a stable foundation for future NIST AI RMF profiles and mappings.

6. Nature of the Mapping

This is a cross-framework traceability mapping. It does not assert that AIGO and NIST AI RMF are identical frameworks. Instead, the mapping identifies:

alignment,
operational correspondence,
implementation support,
evidence relationships,
governance relationships,
lifecycle relationships,
risk-management relationships,
and areas requiring additional implementation.

The mapping therefore distinguishes between conceptual alignment and operational implementation.

7. AIGO and NIST AI RMF Relationship

AIGO is designed as an operating framework for AI governance. NIST AI RMF provides a flexible risk-management framework organized around four functions. The relationship can therefore be represented as:

NIST AI RMF
    |
    +-- GOVERN
    |
    +-- MAP
    |
    +-- MEASURE
    |
    +-- MANAGE
            |
            v
      NIST AI Risk
      Management Activities
            |
            v
        AIGO Operating
          Framework
            |
    +-------+-------+--------+---------+
    |       |       |        |         |
Governance Risk  Lifecycle Controls Evidence
    |       |       |        |         |
    +-------+-------+--------+---------+
                    |
                    v
            Procedures / Decisions
                    |
                    v
             Monitoring / Assurance
                    |
                    v
           Continuous Improvement

The diagram represents an operational relationship rather than an assertion that NIST prescribes the AIGO structure.

8. High-Level Function Mapping

The primary relationship is:

NIST AI RMF Function	AIGO Primary Relationship
GOVERN	AIGO Governance, Roles, Policies, Controls, Procedures, Accountability
MAP	AIGO AI System Registration, Classification, Context, Risk Identification
MEASURE	AIGO Risk Assessment, Control Assessment, Monitoring, Testing, Assurance
MANAGE	AIGO Risk Treatment, Approval, Incident Management, Change Management, Retirement
Cross-cutting governance	AIGO Governance Architecture and Governance Lifecycle
Continuous risk management	AIGO Monitoring, Assurance and Continuous Improvement

NIST identifies GOVERN, MAP, MEASURE and MANAGE as the four functions of the AI RMF Core.

9. GOVERN Mapping

NIST GOVERN establishes organizational structures, policies, processes, procedures, accountability and practices for managing AI risks. AIGO addresses these areas through:

AIGO Framework Charter
AIGO Governance Domains
AIGO Governance Roles
AIGO Governance Procedures
AIGO Governance Controls
AI System Registration
AI Classification
Risk Assessment
Approval
Change Management
Incident Management
Monitoring
Assurance
Risk Acceptance
Retirement
Continuous Improvement

The AIGO governance architecture therefore provides the organizational operating layer through which NIST GOVERN activities can be implemented. NIST describes GOVERN as a cross-cutting function that informs and is infused throughout the other AI RMF functions.

10. MAP Mapping

NIST MAP establishes and documents context, categorizes AI systems, identifies risks, and considers potential impacts. AIGO provides corresponding mechanisms through:

AI System Profiles
AI System Registration Procedure
AI Classification Procedure
Risk Assessment Procedure
AI Governance Lifecycle
Governance Domains
Risk Management Framework
Stakeholder and role definitions
Intended-use documentation
System context documentation
Risk identification
Risk classification
Impact analysis

The AIGO lifecycle provides the operational environment in which MAP activities can be initiated, recorded, reviewed and maintained.

11. MEASURE Mapping

NIST MEASURE addresses measurement, testing, evaluation, monitoring, assessment and documentation of AI risks and trustworthiness-related characteristics. AIGO provides corresponding mechanisms through:

Control Assessment Procedure
Risk Assessment Procedure
Monitoring Procedure
Assurance Procedure
Monitoring and Assurance Implementation Guidance
Evidence Management
Performance and risk indicators
Control effectiveness assessment
Assurance activities
Management review
Corrective action
Continuous improvement

NIST describes MEASURE as using quantitative, qualitative or mixed methods to analyze, assess, benchmark and monitor AI risk and related impacts.

12. MANAGE Mapping

NIST MANAGE addresses prioritization, response and management of risks identified through MAP and MEASURE. AIGO provides corresponding mechanisms through:

Risk Management
Risk Treatment
Risk Acceptance
AI Approval
Change Management
Incident Management
Monitoring
Corrective Action
Retirement
Continuous Improvement

AIGO therefore treats risk management as an operational decision process rather than solely an assessment activity. NIST identifies risk response options including mitigation, transfer, avoidance and acceptance within the MANAGE function.

13. AIGO Governance Architecture Relationship

The AIGO governance architecture provides the organizational foundation supporting the NIST functions.

AIGO Governance Architecture
             |
             v
     Governance Principles
             |
             v
      Governance Domains
             |
             v
      Governance Roles
             |
             v
          Controls
             |
             v
         Procedures
             |
             v
       AI Lifecycle
             |
             v
      Risk Management
             |
             v
   Monitoring and Assurance
             |
             v
   Continuous Improvement

This architecture allows NIST AI RMF activities to be embedded into normal organizational governance rather than treated as an isolated AI risk exercise.

14. AIGO Lifecycle Relationship

AIGO uses an operational lifecycle to connect governance decisions and risk-management activities. The high-level lifecycle relationship is:

Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change / Continue / Retire

The NIST AI RMF functions are not required to be executed as a rigid linear sequence. Instead, AIGO maps them across lifecycle stages. This is consistent with NIST’s description that the AI RMF functions may be performed in different orders and should be integrated iteratively across the AI lifecycle.

15. Lifecycle-to-Function Relationship

AIGO Lifecycle Activity	GOVERN	MAP	MEASURE	MANAGE
Identify	✓	✓
Classify	✓	✓		✓
Assess	✓	✓	✓
Treat	✓		✓	✓
Approve	✓		✓	✓
Deploy	✓	✓	✓	✓
Operate	✓		✓	✓
Monitor	✓		✓	✓
Assure	✓		✓	✓
Improve	✓		✓	✓
Change	✓	✓	✓	✓
Retire	✓	✓	✓	✓

The relationship is intentionally many-to-many. A lifecycle stage may require multiple AI RMF functions, and a single AI RMF function may operate across multiple lifecycle stages.

16. Risk Management Relationship

AIGO treats AI risk management as a continuous governance process. The high-level relationship is:

AI System Context
       ↓
Risk Identification
       ↓
Risk Analysis
       ↓
Risk Evaluation
       ↓
Risk Prioritization
       ↓
Risk Treatment
       ↓
Risk Acceptance / Approval
       ↓
Monitoring
       ↓
Reassessment
       ↓
Change / Continue / Retire

This corresponds primarily to the interaction between NIST MAP, MEASURE and MANAGE, with GOVERN establishing the organizational conditions under which these activities occur. NIST explicitly describes the AI RMF process as iterative and continuous rather than a one-time assessment.

17. Governance-to-Risk Relationship

AIGO governance determines:

who owns AI risks;
who may assess risks;
who may approve risk treatment;
who may accept residual risk;
who monitors risk;
who may authorize deployment;
who may authorize material change;
who manages incidents;
who may retire an AI system;
who assures governance effectiveness.

This provides the accountability structure required to operationalize AI risk management.

18. Control Relationship

AIGO controls translate governance requirements into operational expectations. The relationship is:

NIST AI RMF Outcome
        ↓
AIGO Governance Requirement
        ↓
AIGO Control
        ↓
AIGO Procedure
        ↓
Operational Activity
        ↓
Evidence
        ↓
Assessment
        ↓
Assurance

The detailed control relationship will be maintained in the appropriate AIGO control and NIST mapping documents.

19. Evidence Relationship

NIST AI RMF activities commonly require organizational documentation, measurement results, assessments, decisions and other evidence to demonstrate that risk-management activities have been performed. AIGO therefore establishes an evidence relationship:

Requirement / Outcome
        ↓
Control
        ↓
Procedure
        ↓
Activity
        ↓
Evidence
        ↓
Review
        ↓
Decision
        ↓
Assurance

The detailed evidence mapping is maintained in: 07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md NIST emphasizes documentation and transparency as important components of AI risk management.

20. Decision Traceability

AIGO establishes traceability between AI governance decisions and their supporting information. The target relationship is:

AI System
   ↓
Lifecycle Stage
   ↓
NIST AI RMF Function
   ↓
Risk / Impact
   ↓
AIGO Control
   ↓
Evidence
   ↓
Assessment
   ↓
Decision
   ↓
Accountable Role

This traceability model is intended to support accountability, assurance and later reconstruction of governance decisions.

21. Role and Accountability Relationship

NIST GOVERN includes organizational accountability structures and clearly documented roles and responsibilities. AIGO provides:

governance roles;
accountable owners;
responsible operational roles;
reviewers;
approvers;
risk owners;
control owners;
assurance roles;
monitoring responsibilities;
escalation responsibilities.

NIST GOVERN includes requirements related to documented roles, responsibilities and communication lines for AI risk management.

22. Policy and Procedure Relationship

AIGO distinguishes between:

Policy / Framework Level

Defines:

principles;
governance expectations;
organizational responsibilities;
decision rights;
control objectives.

Procedure Level

Defines:

how activities are performed;
required inputs;
required outputs;
responsibilities;
review points;
escalation;
evidence;
approvals.

Operational Level

Defines:

actual implementation;
measurements;
monitoring;
records;
decisions;
corrective actions.

The NIST AI RMF mapping therefore connects NIST outcomes to the appropriate AIGO level instead of placing every NIST element into a single control layer.

23. Trustworthiness Relationship

NIST identifies characteristics associated with trustworthy AI, including:

validity and reliability;
safety;
security and resilience;
accountability and transparency;
explainability and interpretability;
privacy enhancement;
fairness with harmful bias managed.

AIGO addresses these characteristics through its combined:

governance;
risk;
controls;
lifecycle;
monitoring;
assurance;
evidence;
continuous-improvement architecture.

The mapping should not imply that the existence of an AIGO control automatically demonstrates that a system possesses a particular trustworthiness characteristic. Trustworthiness must remain subject to system-specific assessment and evidence.

24. Cross-Functional Nature of GOVERN

GOVERN is treated in this mapping as a cross-cutting capability.

                  GOVERN
                     |
        +------------+------------+
        |            |            |
       MAP         MEASURE       MANAGE
        |            |            |
        +------------+------------+
                     |
                AI Lifecycle
                     |
          Monitoring / Assurance
                     |
             Improvement

This is a fundamental architectural relationship. AIGO therefore does not isolate governance to a single lifecycle stage. Governance applies throughout the AI system lifecycle.

25. Continuous Risk Management

AIGO maps continuous risk management to the iterative nature of the NIST AI RMF. The operating cycle is:

Govern
   ↓
Map
   ↓
Measure
   ↓
Manage
   ↓
Monitor
   ↓
Review
   ↓
Improve
   ↓
Re-map
   ↓
Re-measure
   ↓
Re-manage

The cycle may be triggered by:

changes in system functionality;
changes in intended use;
changes in deployment context;
new risks;
new evidence;
incidents;
regulatory changes;
organizational changes;
changes in risk tolerance;
changes in technology;
changes in stakeholder expectations.

26. Change Management Relationship

AIGO Change Management provides a mechanism for reassessing AI governance when an AI system or its context changes. Material changes may trigger:

renewed context assessment;
classification review;
risk reassessment;
control reassessment;
measurement updates;
approval review;
monitoring changes;
evidence updates;
assurance activities.

The NIST AI RMF should therefore not be treated as a one-time implementation assessment.

27. Incident Management Relationship

AI incidents may provide new information about:

system behavior;
risk likelihood;
impact severity;
control effectiveness;
monitoring effectiveness;
assumptions;
system limitations;
stakeholder impact.

AIGO Incident Management therefore feeds information back into:

Incident
   ↓
Investigation
   ↓
Risk Reassessment
   ↓
Control Assessment
   ↓
Corrective Action
   ↓
Management Decision
   ↓
Monitoring
   ↓
Continuous Improvement

This supports the iterative risk-management model of the NIST AI RMF.

28. Assurance Relationship

AIGO Assurance provides independent or appropriately separated review of governance effectiveness. Assurance may evaluate:

governance implementation;
risk-management effectiveness;
control effectiveness;
evidence quality;
monitoring effectiveness;
decision traceability;
compliance with internal requirements;
effectiveness of corrective actions.

Assurance results may feed into:

risk treatment;
management review;
change management;
continuous improvement.

29. Maturity Relationship

AIGO maturity assessment provides a mechanism for evaluating the organizational capability to implement AI governance. NIST AI RMF alignment can therefore be evaluated at multiple maturity levels. A simplified relationship is:

Initial
   ↓
Defined
   ↓
Implemented
   ↓
Measured
   ↓
Assured
   ↓
Continuously Improved

Maturity should evaluate actual capability rather than merely the presence of documentation.

30. Mapping Strength Classification

AIGO shall distinguish mapping strength.

30.1 Direct Alignment

AIGO contains an explicit governance mechanism substantially corresponding to the NIST AI RMF concept.

30.2 Operational Alignment

AIGO provides an operational process capable of implementing the NIST AI RMF concept.

30.3 Supporting Alignment

AIGO provides supporting governance, evidence, control or lifecycle capabilities that contribute to the NIST outcome.

30.4 Partial Alignment

AIGO addresses part of the NIST concept but additional implementation is required.

30.5 Gap

AIGO does not currently provide an identified mechanism sufficient to support the NIST concept.

30.6 Not Applicable

The NIST concept is not applicable to the defined organizational or system context.

31. Mapping Confidence

Each detailed mapping should consider mapping confidence. Recommended values:

Level	Meaning
High	Strong and explicit correspondence
Medium	Substantial operational correspondence but interpretation is required
Low	Conceptual relationship exists but additional implementation is required
Unmapped	No sufficient AIGO correspondence identified

Mapping confidence shall not be interpreted as a statement about AI system risk.

32. Gap Management

Where a NIST AI RMF function, category or subcategory is not sufficiently addressed by AIGO, the mapping shall identify:

the NIST reference;
the AIGO reference;
the identified gap;
the reason for the gap;
proposed remediation;
responsible owner;
target status;
evidence required for closure.

Gaps shall be managed through the applicable AIGO governance and continuous-improvement mechanisms.

33. NIST AI RMF Profile Relationship

NIST describes AI RMF Profiles as implementations of AI RMF functions, categories and subcategories for specific settings, applications, requirements, risk tolerances and resources. AIGO may use this mapping architecture as a foundation for future AIGO-specific NIST profiles. Potential future profiles may include:

Generative AI;
high-impact AI;
enterprise AI;
regulated AI;
third-party AI;
AI procurement;
AI-enabled decision systems;
safety-critical AI.

The creation of such profiles should occur after the core mapping architecture is sufficiently mature.

34. NIST AI RMF Playbook Relationship

The NIST AI RMF Playbook is treated as a supporting implementation resource rather than as a separate normative mapping baseline. The Playbook provides suggested actions and supporting material corresponding to the AI RMF Core functions, categories and subcategories. AIGO may use Playbook material as implementation guidance where appropriate. However:

Playbook suggestions shall not automatically become AIGO requirements;
applicability shall be determined by AIGO governance;
organizational context shall be considered;
risk tolerance shall be considered;
legal and regulatory requirements shall take precedence where applicable.

NIST explicitly states that the Playbook is not a one-size-fits-all checklist or ordered implementation sequence.

35. AIGO Operationalization Model

The overall AIGO operationalization model is:

NIST AI RMF
      ↓
Functions
      ↓
Categories / Subcategories
      ↓
AIGO Governance Requirements
      ↓
AIGO Controls
      ↓
AIGO Procedures
      ↓
AIGO Lifecycle Activities
      ↓
Operational Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Management Review
      ↓
Continuous Improvement

This model converts an external risk-management framework into an operational governance structure without claiming that NIST itself prescribes the AIGO implementation architecture.

36. Master Traceability Model

The master traceability relationship is:

NIST AI RMF Reference
        ↓
NIST Function
        ↓
NIST Category
        ↓
NIST Subcategory
        ↓
AIGO Governance Domain
        ↓
AIGO Governance Requirement
        ↓
AIGO Control
        ↓
AIGO Procedure
        ↓
AIGO Lifecycle Stage
        ↓
Risk / Impact
        ↓
Evidence
        ↓
Assessment
        ↓
Decision
        ↓
Accountable Role
        ↓
Monitoring
        ↓
Assurance
        ↓
Improvement

The detailed mapping files shall preserve this traceability structure wherever applicable.

37. Master Mapping Matrix

NIST AI RMF Area	AIGO Domain	AIGO Lifecycle	AIGO Control	Procedure	Evidence	Assurance
GOVERN	Governance	All stages	Governance controls	Governance Procedure	Governance records	Governance assurance
MAP	AI System / Risk	Identify / Classify / Assess	Context and risk controls	Registration / Classification / Risk Assessment	System and risk records	Risk assurance
MEASURE	Risk / Controls / Monitoring	Assess / Operate / Monitor	Measurement and monitoring controls	Control Assessment / Monitoring	Metrics, tests, assessments	Assurance
MANAGE	Risk / Governance	Treat / Approve / Operate / Change	Risk treatment controls	Approval / Risk Acceptance / Change / Incident	Decisions and treatment records	Management assurance
Cross-cutting	Governance	All stages	Governance controls	Multiple procedures	Controlled records	Assurance
Continuous	Improvement	Improve / Change	Improvement controls	Continuous Improvement Procedure	Improvement records	Improvement assurance

38. Mapping to AIGO Framework Documents

The master NIST mapping is connected to the following AIGO framework documents:

AIGO Component	Relationship
Framework Charter	Establishes framework authority and scope
Terminology	Establishes common governance terminology
Framework Principles	Establishes governance principles
Governance Domains	Establishes governance areas
Governance Roles	Establishes accountability
AI Governance Lifecycle	Establishes lifecycle operating model
AI Risk Management	Establishes AI risk methodology
Governance Controls	Establishes control architecture
Governance Maturity	Establishes capability assessment
AI System Profiles	Establishes system-specific context
Implementation Guidance	Establishes practical implementation
Procedures	Establishes operational execution
Templates	Establishes standardized evidence structures
Examples	Demonstrates practical application

39. Mapping to AIGO Procedures

The NIST AI RMF mapping is operationally supported by:

01-AIGO-AI-Governance-Procedure-v0.1.md
02-AIGO-AI-System-Registration-Procedure-v0.1.md
03-AIGO-AI-Risk-Assessment-Procedure-v0.1.md
04-AIGO-AI-Classification-Procedure-v0.1.md
05-AIGO-AI-Control-Assessment-Procedure-v0.1.md
06-AIGO-AI-Approval-Procedure-v0.1.md
07-AIGO-AI-Change-Management-Procedure-v0.1.md
08-AIGO-AI-Incident-Management-Procedure-v0.1.md
09-AIGO-AI-Monitoring-Procedure-v0.1.md
10-AIGO-AI-Assurance-Procedure-v0.1.md
11-AIGO-AI-Risk-Acceptance-Procedure-v0.1.md
12-AIGO-AI-Retirement-Procedure-v0.1.md
13-AIGO-Continuous-Improvement-Procedure-v0.1.md

These procedures provide the operational mechanisms through which NIST-aligned activities can be executed.

40. Mapping to AIGO Implementation Guidance

The NIST mapping is supported by the AIGO implementation guidance set:

Implementation Guide
Governance Implementation
AI System Implementation
Risk Implementation
Control Implementation
Lifecycle Implementation
Monitoring and Assurance Implementation
Continuous Improvement

The implementation guidance translates governance requirements into practical organizational activities.

41. Evidence and Recordkeeping Principle

NIST-aligned AIGO implementation shall produce sufficient evidence to demonstrate that relevant risk-management activities were performed. Evidence should be:

attributable;
relevant;
reliable;
current;
retrievable;
protected from unauthorized modification;
linked to the applicable AI system;
linked to the applicable lifecycle stage;
linked to the applicable risk or control where appropriate;
retained according to applicable AIGO requirements.

Evidence requirements are further defined in: 07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md

42. Assessment Principle

A mapping does not constitute evidence of implementation. The following distinction shall be maintained:

Mapped
   ≠
Implemented
   ≠
Effective
   ≠
Assured

A NIST AI RMF reference may be mapped to an AIGO control without that control being implemented effectively. Implementation and effectiveness must therefore be separately assessed.

43. Conformity and Certification Disclaimer

This mapping does not constitute:

NIST certification;
NIST endorsement;
NIST accreditation;
legal compliance certification;
regulatory approval;
third-party assurance;
conformity certification.

AIGO may use the NIST AI RMF as a reference framework and may establish an internal or third-party assessment of alignment. Such assessment shall be described accurately and shall not imply endorsement by NIST.

44. Regulatory Relationship

NIST AI RMF alignment does not replace applicable law or regulation. Where an AI system is subject to legal or regulatory requirements, those requirements shall be identified and managed through the applicable AIGO governance and risk-management processes. The relationship is:

Applicable Law / Regulation
             ↓
Organizational Obligations
             ↓
AIGO Governance Requirements
             ↓
AIGO Controls
             ↓
AIGO Procedures
             ↓
AI System Implementation
             ↓
Evidence / Monitoring / Assurance

The NIST AI RMF mapping may support these activities but does not supersede legal obligations.

45. External Reference Management

The following external resources are recognized as relevant references:

NIST AI RMF 1.0
NIST AI RMF Core
NIST AI RMF Playbook
NIST AI RMF Profiles
NIST AI Resource Center
applicable NIST informative references

The controlled AIGO mapping baseline remains NIST AI RMF 1.0 unless this document is formally revised.

46. Review and Maintenance

This mapping shall be reviewed when:

NIST publishes a revised AI RMF;
material changes occur to the NIST AI RMF Core;
material changes occur to AIGO;
AIGO governance architecture changes;
AIGO lifecycle changes;
AIGO risk methodology changes;
AIGO controls materially change;
major procedures are changed;
applicable regulatory requirements materially change;
significant implementation gaps are identified.

The review shall determine whether subordinate mapping documents also require revision.

47. Change Management

Changes to this document shall be controlled through the applicable AIGO document and change-management process. Each material change should record:

change identifier;
date;
description;
reason;
affected sections;
affected mapping documents;
reviewer;
approver;
implementation status.

Changes affecting the external NIST baseline shall identify the applicable NIST source and version.

48. Mapping Governance

The owner of the mapping is responsible for:

maintaining the mapping;
monitoring changes to the reference framework;
coordinating subordinate mapping documents;
identifying gaps;
coordinating reviews;
maintaining traceability;
ensuring mapping consistency;
escalating material inconsistencies.

The mapping owner shall not unilaterally declare organizational conformity.

49. Mapping Hierarchy

The NIST mapping document family follows this hierarchy:

01 — Master Mapping
        ↓
02 — Functions Mapping
        ↓
03 — Categories Mapping
        ↓
04 — Lifecycle Mapping
        ↓
05 — Risk Mapping
        ↓
06 — Governance Mapping
        ↓
07 — Evidence Mapping
        ↓
08 — Implementation Mapping

The master mapping provides the architectural relationship. The subordinate documents provide detailed implementation traceability.

50. Relationship Between the Eight Mapping Documents

Document	Primary Question
01 Master Mapping	How does AIGO relate to NIST AI RMF overall?
02 Functions Mapping	How does AIGO address GOVERN, MAP, MEASURE and MANAGE?
03 Categories Mapping	How does AIGO address NIST categories and subcategories?
04 Lifecycle Mapping	Where do NIST activities occur in the AIGO lifecycle?
05 Risk Mapping	How are NIST AI risks represented and managed by AIGO?
06 Governance Mapping	How does AIGO establish accountability and governance?
07 Evidence Mapping	What evidence demonstrates implementation?
08 Implementation Mapping	How is NIST AI RMF operationalized through AIGO?

51. Implementation Traceability

A complete implementation trace should be capable of answering:

Which NIST AI RMF function applies?
Which category applies?
Which subcategory applies?
Which AIGO governance requirement addresses it?
Which AIGO control supports it?
Which procedure implements it?
Which lifecycle stage applies?
Which risk or impact is relevant?
What evidence is produced?
Who is accountable?
How is effectiveness measured?
How is assurance performed?
How are deficiencies corrected?
How is continual improvement performed?

52. Minimum Traceability Record

A detailed NIST mapping record should use the following conceptual structure:

Field	Description
NIST Reference	Function, category or subcategory
NIST Requirement / Outcome	Applicable NIST concept
AIGO Reference	Relevant AIGO document
AIGO Domain	Governance domain
Lifecycle Stage	Applicable lifecycle stage
Control	Applicable AIGO control
Procedure	Operational procedure
Evidence	Expected evidence
Role	Accountable or responsible role
Assessment	Assessment mechanism
Assurance	Assurance mechanism
Status	Mapping/implementation status
Confidence	Mapping confidence
Gap	Identified deficiency
Remediation	Planned action

53. Mapping Status Values

The following status values should be used consistently:

Mapped
Partially Mapped
Supported
Gap Identified
Not Applicable
Under Review
Implemented
Implemented and Assessed
Implemented and Assured

The mapping status shall not be confused with the mapping strength classification.

54. AIGO-NIST Operating Model

The combined operating model can be represented as:

                 NIST AI RMF
                      |
        +-------------+-------------+
        |             |             |
      GOVERN          MAP        MEASURE
        |             |             |
        +-------------+-------------+
                      |
                   MANAGE
                      |
                      v
              AIGO Governance
                      |
        +-------------+-------------+
        |             |             |
      Risk        Lifecycle      Controls
        |             |             |
        +-------------+-------------+
                      |
                 Procedures
                      |
                 Operations
                      |
                  Evidence
                      |
                Monitoring
                      |
                  Assurance
                      |
             Management Review
                      |
              Improvement
                      |
                  Change
                      |
                 Reassessment

55. Core Architectural Principle

The central AIGO-NIST mapping principle is:

NIST AI RMF provides a risk-management reference model; AIGO provides an operational governance architecture through which AI risk-management activities can be implemented, controlled, evidenced, monitored, assured and improved.

This distinction shall be preserved throughout all subordinate mapping documents.

56. Mapping Limitations

This mapping has the following limitations:

It does not reproduce the NIST AI RMF.
It does not create NIST requirements where NIST does not establish them.
It does not establish legal obligations.
It does not establish certification.
It does not guarantee AI system trustworthiness.
It does not replace system-specific risk assessment.
It does not replace technical testing or evaluation.
It does not replace organizational governance.
It does not replace applicable legislation.
It does not represent NIST endorsement of AIGO.

57. Future Expansion

The AIGO NIST mapping architecture may subsequently be expanded to include:

NIST AI RMF revised editions;
NIST AI RMF Profiles;
NIST Generative AI Profile;
NIST AI RMF Playbook updates;
NIST AI RMF Crosswalks;
NIST AI-related standards;
NIST informative references;
sector-specific NIST AI guidance.

Such additions shall be managed as controlled changes.

58. Relationship to Other AIGO Mappings

The NIST AI RMF mapping is one component of the AIGO external-framework mapping architecture.

                    AIGO
                     |
        +------------+------------+
        |            |            |
   ISO/IEC 42001  NIST AI RMF  EU AI Act
        |            |            |
        +------------+------------+
                     |
              AIGO Common Model
                     |
        +------------+------------+
        |            |            |
     Governance     Risk       Lifecycle
        |            |            |
        +------------+------------+
                     |
                  Controls
                     |
                Procedures
                     |
                  Evidence

Each external mapping shall remain independently controlled.

59. Cross-Framework Consistency

The NIST mapping should remain consistent with the AIGO mappings for:

ISO/IEC 42001;
EU AI Act;
future external standards;
future regulatory mappings.

However, cross-framework consistency does not mean identical mappings. Different frameworks have different:

purposes;
structures;
terminology;
scopes;
normative characteristics;
risk models;
assessment approaches.

AIGO acts as the common operational layer.

60. Master Mapping Conclusion

The AIGO AI Governance Operating Framework provides a structured operational architecture for aligning organizational AI governance and risk-management activities with the NIST AI RMF 1.0. The relationship is based on:

governance;
risk identification;
context;
measurement;
risk treatment;
lifecycle integration;
accountability;
evidence;
monitoring;
assurance;
continuous improvement.

The four NIST AI RMF functions—GOVERN, MAP, MEASURE and MANAGE—are treated as interconnected risk-management capabilities rather than a rigid sequence. AIGO provides the organizational and operational mechanisms through which those capabilities may be embedded into AI governance processes.

61. Document Control

61.1 Controlled Information

Field	Value
Document Title	AIGO — NIST AI Risk Management Framework Mapping
Document ID	`AIGO-MAP-NIST-AIRMF-001`
Version	0.1
Status	Draft
Framework	AIGO AI Governance Operating Framework
Mapping Standard	NIST AI RMF 1.0
Mapping Domain	Master Framework Mapping
Primary Owner
Technical Reviewer
Governance Reviewer
Approver
Effective Date
Next Review Date

61.2 Source Baseline

Primary source: NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0. Primary NIST functions:

GOVERN
MAP
MEASURE
MANAGE

Related implementation resource: NIST AI RMF Playbook.

62. Final Control Statement

This document is controlled within the AIGO Framework documentation structure. It establishes the master relationship between AIGO and NIST AI RMF 1.0 and provides the architectural foundation for detailed function, category, lifecycle, risk, governance, evidence and implementation mappings. Any material modification to the AIGO framework or the referenced NIST AI RMF baseline shall trigger an appropriate review of this document and its subordinate mapping documents. This document does not constitute NIST certification, endorsement, accreditation or regulatory approval.

63. End of Mapping Document

AIGO — NIST AI Risk Management Framework Mapping Document ID: AIGO-MAP-NIST-AIRMF-001 Version: 0.1 Status: Draft Mapping Standard: NIST AI RMF 1.0 End of Document

​AIGO — NIST AI Risk Management Framework Mapping

​AIGO — AI Governance Operating Framework

​1. Purpose

​2. Mapping Baseline

​3. Mapping Status and Version Control

​4. Scope

​5. Mapping Objectives

​6. Nature of the Mapping

​7. AIGO and NIST AI RMF Relationship

​8. High-Level Function Mapping

​9. GOVERN Mapping

​10. MAP Mapping

​11. MEASURE Mapping

​12. MANAGE Mapping

​13. AIGO Governance Architecture Relationship

​14. AIGO Lifecycle Relationship

​15. Lifecycle-to-Function Relationship

​16. Risk Management Relationship

​17. Governance-to-Risk Relationship

​18. Control Relationship

​19. Evidence Relationship

​20. Decision Traceability

​21. Role and Accountability Relationship

​22. Policy and Procedure Relationship

​Policy / Framework Level

​Procedure Level

​Operational Level

​23. Trustworthiness Relationship

​24. Cross-Functional Nature of GOVERN

​25. Continuous Risk Management

​26. Change Management Relationship

​27. Incident Management Relationship

​28. Assurance Relationship

​29. Maturity Relationship

​30. Mapping Strength Classification

​30.1 Direct Alignment

​30.2 Operational Alignment

​30.3 Supporting Alignment

​30.4 Partial Alignment

​30.5 Gap

​30.6 Not Applicable

​31. Mapping Confidence

​32. Gap Management

​33. NIST AI RMF Profile Relationship

​34. NIST AI RMF Playbook Relationship

​35. AIGO Operationalization Model

​36. Master Traceability Model

​37. Master Mapping Matrix

​38. Mapping to AIGO Framework Documents

​39. Mapping to AIGO Procedures

​40. Mapping to AIGO Implementation Guidance

​41. Evidence and Recordkeeping Principle

​42. Assessment Principle

​43. Conformity and Certification Disclaimer

​44. Regulatory Relationship

​45. External Reference Management

​46. Review and Maintenance

​47. Change Management

​48. Mapping Governance

​49. Mapping Hierarchy

​50. Relationship Between the Eight Mapping Documents

​51. Implementation Traceability

​52. Minimum Traceability Record

​53. Mapping Status Values

​54. AIGO-NIST Operating Model

​55. Core Architectural Principle

​56. Mapping Limitations

​57. Future Expansion

​58. Relationship to Other AIGO Mappings

​59. Cross-Framework Consistency

​60. Master Mapping Conclusion

​61. Document Control

​61.1 Controlled Information

​61.2 Source Baseline

​62. Final Control Statement

​63. End of Mapping Document

AIGO — NIST AI Risk Management Framework Mapping

AIGO — AI Governance Operating Framework

1. Purpose

2. Mapping Baseline

3. Mapping Status and Version Control

4. Scope

5. Mapping Objectives

6. Nature of the Mapping

7. AIGO and NIST AI RMF Relationship

8. High-Level Function Mapping

9. GOVERN Mapping

10. MAP Mapping

11. MEASURE Mapping

12. MANAGE Mapping

13. AIGO Governance Architecture Relationship

14. AIGO Lifecycle Relationship

15. Lifecycle-to-Function Relationship

16. Risk Management Relationship

17. Governance-to-Risk Relationship

18. Control Relationship

19. Evidence Relationship

20. Decision Traceability

21. Role and Accountability Relationship

22. Policy and Procedure Relationship

Policy / Framework Level

Procedure Level

Operational Level

23. Trustworthiness Relationship

24. Cross-Functional Nature of GOVERN

25. Continuous Risk Management

26. Change Management Relationship

27. Incident Management Relationship

28. Assurance Relationship

29. Maturity Relationship

30. Mapping Strength Classification

30.1 Direct Alignment

30.2 Operational Alignment

30.3 Supporting Alignment

30.4 Partial Alignment

30.5 Gap

30.6 Not Applicable

31. Mapping Confidence

32. Gap Management

33. NIST AI RMF Profile Relationship

34. NIST AI RMF Playbook Relationship

35. AIGO Operationalization Model

36. Master Traceability Model

37. Master Mapping Matrix

38. Mapping to AIGO Framework Documents

39. Mapping to AIGO Procedures

40. Mapping to AIGO Implementation Guidance

41. Evidence and Recordkeeping Principle

42. Assessment Principle

43. Conformity and Certification Disclaimer

44. Regulatory Relationship

45. External Reference Management

46. Review and Maintenance

47. Change Management

48. Mapping Governance

49. Mapping Hierarchy

50. Relationship Between the Eight Mapping Documents

51. Implementation Traceability

52. Minimum Traceability Record

53. Mapping Status Values

54. AIGO-NIST Operating Model

55. Core Architectural Principle

56. Mapping Limitations

57. Future Expansion

58. Relationship to Other AIGO Mappings

59. Cross-Framework Consistency

60. Master Mapping Conclusion

61. Document Control

61.1 Controlled Information

61.2 Source Baseline

62. Final Control Statement

63. End of Mapping Document