> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 01 AIGO NIST AI RMF Mapping v0.1

# AIGO — NIST AI Risk Management Framework Mapping

## AIGO — AI Governance Operating Framework

**Version:** 0.1
**Status:** Draft
**Working Name:** AIGO
**Full Name:** AI Governance Operating Framework
**Document Identifier:** `AIGO-MAP-NIST-AIRMF-001`
**Mapping Standard:** NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0
**Mapping Type:** Master Framework Mapping
**Owner:** AIGO Governance Function
**Review Cycle:** At least annually and upon material changes to AIGO or the referenced NIST framework
**Classification:** Controlled Framework Documentation

***

## 1. Purpose

This document establishes the master relationship between the **AIGO AI Governance Operating Framework** and the **NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0**.

The purpose of this mapping is to demonstrate how AIGO provides an operational governance architecture capable of implementing, organizing, evidencing, monitoring, and continually improving AI risk-management activities aligned with the NIST AI RMF.

This document provides the top-level mapping architecture.

Detailed mappings are maintained in the associated documents:

* `02-AIGO-NIST-AI-RMF-Functions-Mapping-v0.1.md`
* `03-AIGO-NIST-AI-RMF-Categories-Mapping-v0.1.md`
* `04-AIGO-NIST-AI-RMF-Lifecycle-Mapping-v0.1.md`
* `05-AIGO-NIST-AI-RMF-Risk-Mapping-v0.1.md`
* `06-AIGO-NIST-AI-RMF-Governance-Mapping-v0.1.md`
* `07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md`
* `08-AIGO-NIST-AI-RMF-Implementation-Mapping-v0.1.md`

This document should therefore be treated as the **master cross-framework relationship document**, while the subordinate mapping documents provide progressively greater implementation detail.

***

## 2. Mapping Baseline

The primary external reference for this mapping is:

**NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0, NIST AI 100-1.**

NIST describes the AI RMF Core through four functions:

1. GOVERN
2. MAP
3. MEASURE
4. MANAGE

The GOVERN function is cross-cutting and is intended to inform and be integrated throughout the other functions. NIST describes the framework as voluntary and designed to support organizations in managing AI risks and promoting trustworthy and responsible AI systems.

This AIGO mapping is therefore not intended to represent NIST AI RMF as a mandatory compliance standard. It establishes a structured correspondence between the NIST AI RMF and the AIGO operating model.

***

## 3. Mapping Status and Version Control

This document is based on the NIST AI RMF 1.0 baseline.

NIST currently indicates that the AI RMF 1.0 is being revised. Consequently, this mapping shall be reviewed when a revised NIST AI RMF is formally issued.

Until such revision occurs, references to the NIST AI RMF in this document mean:

> NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0.

AIGO shall not silently change the mapping baseline when NIST publishes supporting material, profiles, playbooks, informative references, or other related resources.

Material changes to the mapping baseline shall be documented through AIGO change management.

***

## 4. Scope

This mapping covers the relationship between NIST AI RMF 1.0 and the following AIGO components:

* AIGO governance architecture
* AIGO governance domains
* AIGO governance roles
* AIGO AI governance lifecycle
* AIGO AI risk management
* AIGO governance controls
* AIGO implementation guidance
* AIGO operational procedures
* AIGO monitoring and assurance
* AIGO continuous improvement
* AIGO evidence management
* AIGO decision-making and approval structures
* AIGO AI system profiles
* AIGO maturity assessment

The mapping does not attempt to reproduce the complete text of the NIST AI RMF.

***

## 5. Mapping Objectives

The mapping has the following objectives:

1. Establish traceability between AIGO and NIST AI RMF 1.0.
2. Demonstrate where AIGO addresses NIST AI RMF functions.
3. Identify the AIGO governance mechanisms supporting NIST AI RMF activities.
4. Establish relationships between AI risk management and the AIGO lifecycle.
5. Establish evidence relationships for NIST-aligned AI risk management.
6. Support implementation of NIST AI RMF through AIGO procedures and controls.
7. Support assessment and assurance activities.
8. Identify potential mapping gaps.
9. Prevent unsupported claims of equivalence or certification.
10. Provide a stable foundation for future NIST AI RMF profiles and mappings.

***

## 6. Nature of the Mapping

This is a **cross-framework traceability mapping**.

It does not assert that AIGO and NIST AI RMF are identical frameworks.

Instead, the mapping identifies:

* alignment,
* operational correspondence,
* implementation support,
* evidence relationships,
* governance relationships,
* lifecycle relationships,
* risk-management relationships,
* and areas requiring additional implementation.

The mapping therefore distinguishes between **conceptual alignment** and **operational implementation**.

***

## 7. AIGO and NIST AI RMF Relationship

AIGO is designed as an operating framework for AI governance.

NIST AI RMF provides a flexible risk-management framework organized around four functions.

The relationship can therefore be represented as:

```text theme={null}
NIST AI RMF
    |
    +-- GOVERN
    |
    +-- MAP
    |
    +-- MEASURE
    |
    +-- MANAGE
            |
            v
      NIST AI Risk
      Management Activities
            |
            v
        AIGO Operating
          Framework
            |
    +-------+-------+--------+---------+
    |       |       |        |         |
Governance Risk  Lifecycle Controls Evidence
    |       |       |        |         |
    +-------+-------+--------+---------+
                    |
                    v
            Procedures / Decisions
                    |
                    v
             Monitoring / Assurance
                    |
                    v
           Continuous Improvement
```

The diagram represents an operational relationship rather than an assertion that NIST prescribes the AIGO structure.

***

## 8. High-Level Function Mapping

The primary relationship is:

| NIST AI RMF Function       | AIGO Primary Relationship                                                         |
| -------------------------- | --------------------------------------------------------------------------------- |
| GOVERN                     | AIGO Governance, Roles, Policies, Controls, Procedures, Accountability            |
| MAP                        | AIGO AI System Registration, Classification, Context, Risk Identification         |
| MEASURE                    | AIGO Risk Assessment, Control Assessment, Monitoring, Testing, Assurance          |
| MANAGE                     | AIGO Risk Treatment, Approval, Incident Management, Change Management, Retirement |
| Cross-cutting governance   | AIGO Governance Architecture and Governance Lifecycle                             |
| Continuous risk management | AIGO Monitoring, Assurance and Continuous Improvement                             |

NIST identifies GOVERN, MAP, MEASURE and MANAGE as the four functions of the AI RMF Core.

***

## 9. GOVERN Mapping

NIST GOVERN establishes organizational structures, policies, processes, procedures, accountability and practices for managing AI risks.

AIGO addresses these areas through:

* AIGO Framework Charter
* AIGO Governance Domains
* AIGO Governance Roles
* AIGO Governance Procedures
* AIGO Governance Controls
* AI System Registration
* AI Classification
* Risk Assessment
* Approval
* Change Management
* Incident Management
* Monitoring
* Assurance
* Risk Acceptance
* Retirement
* Continuous Improvement

The AIGO governance architecture therefore provides the organizational operating layer through which NIST GOVERN activities can be implemented.

NIST describes GOVERN as a cross-cutting function that informs and is infused throughout the other AI RMF functions.

***

## 10. MAP Mapping

NIST MAP establishes and documents context, categorizes AI systems, identifies risks, and considers potential impacts.

AIGO provides corresponding mechanisms through:

* AI System Profiles
* AI System Registration Procedure
* AI Classification Procedure
* Risk Assessment Procedure
* AI Governance Lifecycle
* Governance Domains
* Risk Management Framework
* Stakeholder and role definitions
* Intended-use documentation
* System context documentation
* Risk identification
* Risk classification
* Impact analysis

The AIGO lifecycle provides the operational environment in which MAP activities can be initiated, recorded, reviewed and maintained.

***

## 11. MEASURE Mapping

NIST MEASURE addresses measurement, testing, evaluation, monitoring, assessment and documentation of AI risks and trustworthiness-related characteristics.

AIGO provides corresponding mechanisms through:

* Control Assessment Procedure
* Risk Assessment Procedure
* Monitoring Procedure
* Assurance Procedure
* Monitoring and Assurance Implementation Guidance
* Evidence Management
* Performance and risk indicators
* Control effectiveness assessment
* Assurance activities
* Management review
* Corrective action
* Continuous improvement

NIST describes MEASURE as using quantitative, qualitative or mixed methods to analyze, assess, benchmark and monitor AI risk and related impacts.

***

## 12. MANAGE Mapping

NIST MANAGE addresses prioritization, response and management of risks identified through MAP and MEASURE.

AIGO provides corresponding mechanisms through:

* Risk Management
* Risk Treatment
* Risk Acceptance
* AI Approval
* Change Management
* Incident Management
* Monitoring
* Corrective Action
* Retirement
* Continuous Improvement

AIGO therefore treats risk management as an operational decision process rather than solely an assessment activity.

NIST identifies risk response options including mitigation, transfer, avoidance and acceptance within the MANAGE function.

***

## 13. AIGO Governance Architecture Relationship

The AIGO governance architecture provides the organizational foundation supporting the NIST functions.

```text theme={null}
AIGO Governance Architecture
             |
             v
     Governance Principles
             |
             v
      Governance Domains
             |
             v
      Governance Roles
             |
             v
          Controls
             |
             v
         Procedures
             |
             v
       AI Lifecycle
             |
             v
      Risk Management
             |
             v
   Monitoring and Assurance
             |
             v
   Continuous Improvement
```

This architecture allows NIST AI RMF activities to be embedded into normal organizational governance rather than treated as an isolated AI risk exercise.

***

## 14. AIGO Lifecycle Relationship

AIGO uses an operational lifecycle to connect governance decisions and risk-management activities.

The high-level lifecycle relationship is:

```text theme={null}
Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change / Continue / Retire
```

The NIST AI RMF functions are not required to be executed as a rigid linear sequence.

Instead, AIGO maps them across lifecycle stages.

This is consistent with NIST's description that the AI RMF functions may be performed in different orders and should be integrated iteratively across the AI lifecycle.

***

## 15. Lifecycle-to-Function Relationship

| AIGO Lifecycle Activity | GOVERN | MAP | MEASURE | MANAGE |
| ----------------------- | :----: | :-: | :-----: | :----: |
| Identify                |    ✓   |  ✓  |         |        |
| Classify                |    ✓   |  ✓  |         |    ✓   |
| Assess                  |    ✓   |  ✓  |    ✓    |        |
| Treat                   |    ✓   |     |    ✓    |    ✓   |
| Approve                 |    ✓   |     |    ✓    |    ✓   |
| Deploy                  |    ✓   |  ✓  |    ✓    |    ✓   |
| Operate                 |    ✓   |     |    ✓    |    ✓   |
| Monitor                 |    ✓   |     |    ✓    |    ✓   |
| Assure                  |    ✓   |     |    ✓    |    ✓   |
| Improve                 |    ✓   |     |    ✓    |    ✓   |
| Change                  |    ✓   |  ✓  |    ✓    |    ✓   |
| Retire                  |    ✓   |  ✓  |    ✓    |    ✓   |

The relationship is intentionally many-to-many.

A lifecycle stage may require multiple AI RMF functions, and a single AI RMF function may operate across multiple lifecycle stages.

***

## 16. Risk Management Relationship

AIGO treats AI risk management as a continuous governance process.

The high-level relationship is:

```text theme={null}
AI System Context
       ↓
Risk Identification
       ↓
Risk Analysis
       ↓
Risk Evaluation
       ↓
Risk Prioritization
       ↓
Risk Treatment
       ↓
Risk Acceptance / Approval
       ↓
Monitoring
       ↓
Reassessment
       ↓
Change / Continue / Retire
```

This corresponds primarily to the interaction between NIST MAP, MEASURE and MANAGE, with GOVERN establishing the organizational conditions under which these activities occur.

NIST explicitly describes the AI RMF process as iterative and continuous rather than a one-time assessment.

***

## 17. Governance-to-Risk Relationship

AIGO governance determines:

* who owns AI risks;
* who may assess risks;
* who may approve risk treatment;
* who may accept residual risk;
* who monitors risk;
* who may authorize deployment;
* who may authorize material change;
* who manages incidents;
* who may retire an AI system;
* who assures governance effectiveness.

This provides the accountability structure required to operationalize AI risk management.

***

## 18. Control Relationship

AIGO controls translate governance requirements into operational expectations.

The relationship is:

```text theme={null}
NIST AI RMF Outcome
        ↓
AIGO Governance Requirement
        ↓
AIGO Control
        ↓
AIGO Procedure
        ↓
Operational Activity
        ↓
Evidence
        ↓
Assessment
        ↓
Assurance
```

The detailed control relationship will be maintained in the appropriate AIGO control and NIST mapping documents.

***

## 19. Evidence Relationship

NIST AI RMF activities commonly require organizational documentation, measurement results, assessments, decisions and other evidence to demonstrate that risk-management activities have been performed.

AIGO therefore establishes an evidence relationship:

```text theme={null}
Requirement / Outcome
        ↓
Control
        ↓
Procedure
        ↓
Activity
        ↓
Evidence
        ↓
Review
        ↓
Decision
        ↓
Assurance
```

The detailed evidence mapping is maintained in:

`07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md`

NIST emphasizes documentation and transparency as important components of AI risk management.

***

## 20. Decision Traceability

AIGO establishes traceability between AI governance decisions and their supporting information.

The target relationship is:

```text theme={null}
AI System
   ↓
Lifecycle Stage
   ↓
NIST AI RMF Function
   ↓
Risk / Impact
   ↓
AIGO Control
   ↓
Evidence
   ↓
Assessment
   ↓
Decision
   ↓
Accountable Role
```

This traceability model is intended to support accountability, assurance and later reconstruction of governance decisions.

***

## 21. Role and Accountability Relationship

NIST GOVERN includes organizational accountability structures and clearly documented roles and responsibilities.

AIGO provides:

* governance roles;
* accountable owners;
* responsible operational roles;
* reviewers;
* approvers;
* risk owners;
* control owners;
* assurance roles;
* monitoring responsibilities;
* escalation responsibilities.

NIST GOVERN includes requirements related to documented roles, responsibilities and communication lines for AI risk management.

***

## 22. Policy and Procedure Relationship

AIGO distinguishes between:

### Policy / Framework Level

Defines:

* principles;
* governance expectations;
* organizational responsibilities;
* decision rights;
* control objectives.

### Procedure Level

Defines:

* how activities are performed;
* required inputs;
* required outputs;
* responsibilities;
* review points;
* escalation;
* evidence;
* approvals.

### Operational Level

Defines:

* actual implementation;
* measurements;
* monitoring;
* records;
* decisions;
* corrective actions.

The NIST AI RMF mapping therefore connects NIST outcomes to the appropriate AIGO level instead of placing every NIST element into a single control layer.

***

## 23. Trustworthiness Relationship

NIST identifies characteristics associated with trustworthy AI, including:

* validity and reliability;
* safety;
* security and resilience;
* accountability and transparency;
* explainability and interpretability;
* privacy enhancement;
* fairness with harmful bias managed.

AIGO addresses these characteristics through its combined:

* governance;
* risk;
* controls;
* lifecycle;
* monitoring;
* assurance;
* evidence;
* continuous-improvement architecture.

The mapping should not imply that the existence of an AIGO control automatically demonstrates that a system possesses a particular trustworthiness characteristic.

Trustworthiness must remain subject to system-specific assessment and evidence.

***

## 24. Cross-Functional Nature of GOVERN

GOVERN is treated in this mapping as a cross-cutting capability.

```text theme={null}
                  GOVERN
                     |
        +------------+------------+
        |            |            |
       MAP         MEASURE       MANAGE
        |            |            |
        +------------+------------+
                     |
                AI Lifecycle
                     |
          Monitoring / Assurance
                     |
             Improvement
```

This is a fundamental architectural relationship.

AIGO therefore does not isolate governance to a single lifecycle stage.

Governance applies throughout the AI system lifecycle.

***

## 25. Continuous Risk Management

AIGO maps continuous risk management to the iterative nature of the NIST AI RMF.

The operating cycle is:

```text theme={null}
Govern
   ↓
Map
   ↓
Measure
   ↓
Manage
   ↓
Monitor
   ↓
Review
   ↓
Improve
   ↓
Re-map
   ↓
Re-measure
   ↓
Re-manage
```

The cycle may be triggered by:

* changes in system functionality;
* changes in intended use;
* changes in deployment context;
* new risks;
* new evidence;
* incidents;
* regulatory changes;
* organizational changes;
* changes in risk tolerance;
* changes in technology;
* changes in stakeholder expectations.

***

## 26. Change Management Relationship

AIGO Change Management provides a mechanism for reassessing AI governance when an AI system or its context changes.

Material changes may trigger:

* renewed context assessment;
* classification review;
* risk reassessment;
* control reassessment;
* measurement updates;
* approval review;
* monitoring changes;
* evidence updates;
* assurance activities.

The NIST AI RMF should therefore not be treated as a one-time implementation assessment.

***

## 27. Incident Management Relationship

AI incidents may provide new information about:

* system behavior;
* risk likelihood;
* impact severity;
* control effectiveness;
* monitoring effectiveness;
* assumptions;
* system limitations;
* stakeholder impact.

AIGO Incident Management therefore feeds information back into:

```text theme={null}
Incident
   ↓
Investigation
   ↓
Risk Reassessment
   ↓
Control Assessment
   ↓
Corrective Action
   ↓
Management Decision
   ↓
Monitoring
   ↓
Continuous Improvement
```

This supports the iterative risk-management model of the NIST AI RMF.

***

## 28. Assurance Relationship

AIGO Assurance provides independent or appropriately separated review of governance effectiveness.

Assurance may evaluate:

* governance implementation;
* risk-management effectiveness;
* control effectiveness;
* evidence quality;
* monitoring effectiveness;
* decision traceability;
* compliance with internal requirements;
* effectiveness of corrective actions.

Assurance results may feed into:

* risk treatment;
* management review;
* change management;
* continuous improvement.

***

## 29. Maturity Relationship

AIGO maturity assessment provides a mechanism for evaluating the organizational capability to implement AI governance.

NIST AI RMF alignment can therefore be evaluated at multiple maturity levels.

A simplified relationship is:

```text theme={null}
Initial
   ↓
Defined
   ↓
Implemented
   ↓
Measured
   ↓
Assured
   ↓
Continuously Improved
```

Maturity should evaluate actual capability rather than merely the presence of documentation.

***

## 30. Mapping Strength Classification

AIGO shall distinguish mapping strength.

### 30.1 Direct Alignment

AIGO contains an explicit governance mechanism substantially corresponding to the NIST AI RMF concept.

### 30.2 Operational Alignment

AIGO provides an operational process capable of implementing the NIST AI RMF concept.

### 30.3 Supporting Alignment

AIGO provides supporting governance, evidence, control or lifecycle capabilities that contribute to the NIST outcome.

### 30.4 Partial Alignment

AIGO addresses part of the NIST concept but additional implementation is required.

### 30.5 Gap

AIGO does not currently provide an identified mechanism sufficient to support the NIST concept.

### 30.6 Not Applicable

The NIST concept is not applicable to the defined organizational or system context.

***

## 31. Mapping Confidence

Each detailed mapping should consider mapping confidence.

Recommended values:

| Level    | Meaning                                                                  |
| -------- | ------------------------------------------------------------------------ |
| High     | Strong and explicit correspondence                                       |
| Medium   | Substantial operational correspondence but interpretation is required    |
| Low      | Conceptual relationship exists but additional implementation is required |
| Unmapped | No sufficient AIGO correspondence identified                             |

Mapping confidence shall not be interpreted as a statement about AI system risk.

***

## 32. Gap Management

Where a NIST AI RMF function, category or subcategory is not sufficiently addressed by AIGO, the mapping shall identify:

1. the NIST reference;
2. the AIGO reference;
3. the identified gap;
4. the reason for the gap;
5. proposed remediation;
6. responsible owner;
7. target status;
8. evidence required for closure.

Gaps shall be managed through the applicable AIGO governance and continuous-improvement mechanisms.

***

## 33. NIST AI RMF Profile Relationship

NIST describes AI RMF Profiles as implementations of AI RMF functions, categories and subcategories for specific settings, applications, requirements, risk tolerances and resources.

AIGO may use this mapping architecture as a foundation for future AIGO-specific NIST profiles.

Potential future profiles may include:

* Generative AI;
* high-impact AI;
* enterprise AI;
* regulated AI;
* third-party AI;
* AI procurement;
* AI-enabled decision systems;
* safety-critical AI.

The creation of such profiles should occur after the core mapping architecture is sufficiently mature.

***

## 34. NIST AI RMF Playbook Relationship

The NIST AI RMF Playbook is treated as a supporting implementation resource rather than as a separate normative mapping baseline.

The Playbook provides suggested actions and supporting material corresponding to the AI RMF Core functions, categories and subcategories.

AIGO may use Playbook material as implementation guidance where appropriate.

However:

* Playbook suggestions shall not automatically become AIGO requirements;
* applicability shall be determined by AIGO governance;
* organizational context shall be considered;
* risk tolerance shall be considered;
* legal and regulatory requirements shall take precedence where applicable.

NIST explicitly states that the Playbook is not a one-size-fits-all checklist or ordered implementation sequence.

***

## 35. AIGO Operationalization Model

The overall AIGO operationalization model is:

```text theme={null}
NIST AI RMF
      ↓
Functions
      ↓
Categories / Subcategories
      ↓
AIGO Governance Requirements
      ↓
AIGO Controls
      ↓
AIGO Procedures
      ↓
AIGO Lifecycle Activities
      ↓
Operational Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Management Review
      ↓
Continuous Improvement
```

This model converts an external risk-management framework into an operational governance structure without claiming that NIST itself prescribes the AIGO implementation architecture.

***

## 36. Master Traceability Model

The master traceability relationship is:

```text theme={null}
NIST AI RMF Reference
        ↓
NIST Function
        ↓
NIST Category
        ↓
NIST Subcategory
        ↓
AIGO Governance Domain
        ↓
AIGO Governance Requirement
        ↓
AIGO Control
        ↓
AIGO Procedure
        ↓
AIGO Lifecycle Stage
        ↓
Risk / Impact
        ↓
Evidence
        ↓
Assessment
        ↓
Decision
        ↓
Accountable Role
        ↓
Monitoring
        ↓
Assurance
        ↓
Improvement
```

The detailed mapping files shall preserve this traceability structure wherever applicable.

***

## 37. Master Mapping Matrix

| NIST AI RMF Area | AIGO Domain                  | AIGO Lifecycle                     | AIGO Control                        | Procedure                                       | Evidence                        | Assurance             |
| ---------------- | ---------------------------- | ---------------------------------- | ----------------------------------- | ----------------------------------------------- | ------------------------------- | --------------------- |
| GOVERN           | Governance                   | All stages                         | Governance controls                 | Governance Procedure                            | Governance records              | Governance assurance  |
| MAP              | AI System / Risk             | Identify / Classify / Assess       | Context and risk controls           | Registration / Classification / Risk Assessment | System and risk records         | Risk assurance        |
| MEASURE          | Risk / Controls / Monitoring | Assess / Operate / Monitor         | Measurement and monitoring controls | Control Assessment / Monitoring                 | Metrics, tests, assessments     | Assurance             |
| MANAGE           | Risk / Governance            | Treat / Approve / Operate / Change | Risk treatment controls             | Approval / Risk Acceptance / Change / Incident  | Decisions and treatment records | Management assurance  |
| Cross-cutting    | Governance                   | All stages                         | Governance controls                 | Multiple procedures                             | Controlled records              | Assurance             |
| Continuous       | Improvement                  | Improve / Change                   | Improvement controls                | Continuous Improvement Procedure                | Improvement records             | Improvement assurance |

***

## 38. Mapping to AIGO Framework Documents

The master NIST mapping is connected to the following AIGO framework documents:

| AIGO Component          | Relationship                                 |
| ----------------------- | -------------------------------------------- |
| Framework Charter       | Establishes framework authority and scope    |
| Terminology             | Establishes common governance terminology    |
| Framework Principles    | Establishes governance principles            |
| Governance Domains      | Establishes governance areas                 |
| Governance Roles        | Establishes accountability                   |
| AI Governance Lifecycle | Establishes lifecycle operating model        |
| AI Risk Management      | Establishes AI risk methodology              |
| Governance Controls     | Establishes control architecture             |
| Governance Maturity     | Establishes capability assessment            |
| AI System Profiles      | Establishes system-specific context          |
| Implementation Guidance | Establishes practical implementation         |
| Procedures              | Establishes operational execution            |
| Templates               | Establishes standardized evidence structures |
| Examples                | Demonstrates practical application           |

***

## 39. Mapping to AIGO Procedures

The NIST AI RMF mapping is operationally supported by:

* `01-AIGO-AI-Governance-Procedure-v0.1.md`
* `02-AIGO-AI-System-Registration-Procedure-v0.1.md`
* `03-AIGO-AI-Risk-Assessment-Procedure-v0.1.md`
* `04-AIGO-AI-Classification-Procedure-v0.1.md`
* `05-AIGO-AI-Control-Assessment-Procedure-v0.1.md`
* `06-AIGO-AI-Approval-Procedure-v0.1.md`
* `07-AIGO-AI-Change-Management-Procedure-v0.1.md`
* `08-AIGO-AI-Incident-Management-Procedure-v0.1.md`
* `09-AIGO-AI-Monitoring-Procedure-v0.1.md`
* `10-AIGO-AI-Assurance-Procedure-v0.1.md`
* `11-AIGO-AI-Risk-Acceptance-Procedure-v0.1.md`
* `12-AIGO-AI-Retirement-Procedure-v0.1.md`
* `13-AIGO-Continuous-Improvement-Procedure-v0.1.md`

These procedures provide the operational mechanisms through which NIST-aligned activities can be executed.

***

## 40. Mapping to AIGO Implementation Guidance

The NIST mapping is supported by the AIGO implementation guidance set:

* Implementation Guide
* Governance Implementation
* AI System Implementation
* Risk Implementation
* Control Implementation
* Lifecycle Implementation
* Monitoring and Assurance Implementation
* Continuous Improvement

The implementation guidance translates governance requirements into practical organizational activities.

***

## 41. Evidence and Recordkeeping Principle

NIST-aligned AIGO implementation shall produce sufficient evidence to demonstrate that relevant risk-management activities were performed.

Evidence should be:

* attributable;
* relevant;
* reliable;
* current;
* retrievable;
* protected from unauthorized modification;
* linked to the applicable AI system;
* linked to the applicable lifecycle stage;
* linked to the applicable risk or control where appropriate;
* retained according to applicable AIGO requirements.

Evidence requirements are further defined in:

`07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md`

***

## 42. Assessment Principle

A mapping does not constitute evidence of implementation.

The following distinction shall be maintained:

```text theme={null}
Mapped
   ≠
Implemented
   ≠
Effective
   ≠
Assured
```

A NIST AI RMF reference may be mapped to an AIGO control without that control being implemented effectively.

Implementation and effectiveness must therefore be separately assessed.

***

## 43. Conformity and Certification Disclaimer

This mapping does not constitute:

* NIST certification;
* NIST endorsement;
* NIST accreditation;
* legal compliance certification;
* regulatory approval;
* third-party assurance;
* conformity certification.

AIGO may use the NIST AI RMF as a reference framework and may establish an internal or third-party assessment of alignment.

Such assessment shall be described accurately and shall not imply endorsement by NIST.

***

## 44. Regulatory Relationship

NIST AI RMF alignment does not replace applicable law or regulation.

Where an AI system is subject to legal or regulatory requirements, those requirements shall be identified and managed through the applicable AIGO governance and risk-management processes.

The relationship is:

```text theme={null}
Applicable Law / Regulation
             ↓
Organizational Obligations
             ↓
AIGO Governance Requirements
             ↓
AIGO Controls
             ↓
AIGO Procedures
             ↓
AI System Implementation
             ↓
Evidence / Monitoring / Assurance
```

The NIST AI RMF mapping may support these activities but does not supersede legal obligations.

***

## 45. External Reference Management

The following external resources are recognized as relevant references:

* NIST AI RMF 1.0
* NIST AI RMF Core
* NIST AI RMF Playbook
* NIST AI RMF Profiles
* NIST AI Resource Center
* applicable NIST informative references

The controlled AIGO mapping baseline remains NIST AI RMF 1.0 unless this document is formally revised.

***

## 46. Review and Maintenance

This mapping shall be reviewed when:

* NIST publishes a revised AI RMF;
* material changes occur to the NIST AI RMF Core;
* material changes occur to AIGO;
* AIGO governance architecture changes;
* AIGO lifecycle changes;
* AIGO risk methodology changes;
* AIGO controls materially change;
* major procedures are changed;
* applicable regulatory requirements materially change;
* significant implementation gaps are identified.

The review shall determine whether subordinate mapping documents also require revision.

***

## 47. Change Management

Changes to this document shall be controlled through the applicable AIGO document and change-management process.

Each material change should record:

* change identifier;
* date;
* description;
* reason;
* affected sections;
* affected mapping documents;
* reviewer;
* approver;
* implementation status.

Changes affecting the external NIST baseline shall identify the applicable NIST source and version.

***

## 48. Mapping Governance

The owner of the mapping is responsible for:

* maintaining the mapping;
* monitoring changes to the reference framework;
* coordinating subordinate mapping documents;
* identifying gaps;
* coordinating reviews;
* maintaining traceability;
* ensuring mapping consistency;
* escalating material inconsistencies.

The mapping owner shall not unilaterally declare organizational conformity.

***

## 49. Mapping Hierarchy

The NIST mapping document family follows this hierarchy:

```text theme={null}
01 — Master Mapping
        ↓
02 — Functions Mapping
        ↓
03 — Categories Mapping
        ↓
04 — Lifecycle Mapping
        ↓
05 — Risk Mapping
        ↓
06 — Governance Mapping
        ↓
07 — Evidence Mapping
        ↓
08 — Implementation Mapping
```

The master mapping provides the architectural relationship.

The subordinate documents provide detailed implementation traceability.

***

## 50. Relationship Between the Eight Mapping Documents

| Document                  | Primary Question                                         |
| ------------------------- | -------------------------------------------------------- |
| 01 Master Mapping         | How does AIGO relate to NIST AI RMF overall?             |
| 02 Functions Mapping      | How does AIGO address GOVERN, MAP, MEASURE and MANAGE?   |
| 03 Categories Mapping     | How does AIGO address NIST categories and subcategories? |
| 04 Lifecycle Mapping      | Where do NIST activities occur in the AIGO lifecycle?    |
| 05 Risk Mapping           | How are NIST AI risks represented and managed by AIGO?   |
| 06 Governance Mapping     | How does AIGO establish accountability and governance?   |
| 07 Evidence Mapping       | What evidence demonstrates implementation?               |
| 08 Implementation Mapping | How is NIST AI RMF operationalized through AIGO?         |

***

## 51. Implementation Traceability

A complete implementation trace should be capable of answering:

1. Which NIST AI RMF function applies?
2. Which category applies?
3. Which subcategory applies?
4. Which AIGO governance requirement addresses it?
5. Which AIGO control supports it?
6. Which procedure implements it?
7. Which lifecycle stage applies?
8. Which risk or impact is relevant?
9. What evidence is produced?
10. Who is accountable?
11. How is effectiveness measured?
12. How is assurance performed?
13. How are deficiencies corrected?
14. How is continual improvement performed?

***

## 52. Minimum Traceability Record

A detailed NIST mapping record should use the following conceptual structure:

| Field                      | Description                       |
| -------------------------- | --------------------------------- |
| NIST Reference             | Function, category or subcategory |
| NIST Requirement / Outcome | Applicable NIST concept           |
| AIGO Reference             | Relevant AIGO document            |
| AIGO Domain                | Governance domain                 |
| Lifecycle Stage            | Applicable lifecycle stage        |
| Control                    | Applicable AIGO control           |
| Procedure                  | Operational procedure             |
| Evidence                   | Expected evidence                 |
| Role                       | Accountable or responsible role   |
| Assessment                 | Assessment mechanism              |
| Assurance                  | Assurance mechanism               |
| Status                     | Mapping/implementation status     |
| Confidence                 | Mapping confidence                |
| Gap                        | Identified deficiency             |
| Remediation                | Planned action                    |

***

## 53. Mapping Status Values

The following status values should be used consistently:

* `Mapped`
* `Partially Mapped`
* `Supported`
* `Gap Identified`
* `Not Applicable`
* `Under Review`
* `Implemented`
* `Implemented and Assessed`
* `Implemented and Assured`

The mapping status shall not be confused with the mapping strength classification.

***

## 54. AIGO-NIST Operating Model

The combined operating model can be represented as:

```text theme={null}
                 NIST AI RMF
                      |
        +-------------+-------------+
        |             |             |
      GOVERN          MAP        MEASURE
        |             |             |
        +-------------+-------------+
                      |
                   MANAGE
                      |
                      v
              AIGO Governance
                      |
        +-------------+-------------+
        |             |             |
      Risk        Lifecycle      Controls
        |             |             |
        +-------------+-------------+
                      |
                 Procedures
                      |
                 Operations
                      |
                  Evidence
                      |
                Monitoring
                      |
                  Assurance
                      |
             Management Review
                      |
              Improvement
                      |
                  Change
                      |
                 Reassessment
```

***

## 55. Core Architectural Principle

The central AIGO-NIST mapping principle is:

> NIST AI RMF provides a risk-management reference model; AIGO provides an operational governance architecture through which AI risk-management activities can be implemented, controlled, evidenced, monitored, assured and improved.

This distinction shall be preserved throughout all subordinate mapping documents.

***

## 56. Mapping Limitations

This mapping has the following limitations:

1. It does not reproduce the NIST AI RMF.
2. It does not create NIST requirements where NIST does not establish them.
3. It does not establish legal obligations.
4. It does not establish certification.
5. It does not guarantee AI system trustworthiness.
6. It does not replace system-specific risk assessment.
7. It does not replace technical testing or evaluation.
8. It does not replace organizational governance.
9. It does not replace applicable legislation.
10. It does not represent NIST endorsement of AIGO.

***

## 57. Future Expansion

The AIGO NIST mapping architecture may subsequently be expanded to include:

* NIST AI RMF revised editions;
* NIST AI RMF Profiles;
* NIST Generative AI Profile;
* NIST AI RMF Playbook updates;
* NIST AI RMF Crosswalks;
* NIST AI-related standards;
* NIST informative references;
* sector-specific NIST AI guidance.

Such additions shall be managed as controlled changes.

***

## 58. Relationship to Other AIGO Mappings

The NIST AI RMF mapping is one component of the AIGO external-framework mapping architecture.

```text theme={null}
                    AIGO
                     |
        +------------+------------+
        |            |            |
   ISO/IEC 42001  NIST AI RMF  EU AI Act
        |            |            |
        +------------+------------+
                     |
              AIGO Common Model
                     |
        +------------+------------+
        |            |            |
     Governance     Risk       Lifecycle
        |            |            |
        +------------+------------+
                     |
                  Controls
                     |
                Procedures
                     |
                  Evidence
```

Each external mapping shall remain independently controlled.

***

## 59. Cross-Framework Consistency

The NIST mapping should remain consistent with the AIGO mappings for:

* ISO/IEC 42001;
* EU AI Act;
* future external standards;
* future regulatory mappings.

However, cross-framework consistency does not mean identical mappings.

Different frameworks have different:

* purposes;
* structures;
* terminology;
* scopes;
* normative characteristics;
* risk models;
* assessment approaches.

AIGO acts as the common operational layer.

***

## 60. Master Mapping Conclusion

The AIGO AI Governance Operating Framework provides a structured operational architecture for aligning organizational AI governance and risk-management activities with the NIST AI RMF 1.0.

The relationship is based on:

* governance;
* risk identification;
* context;
* measurement;
* risk treatment;
* lifecycle integration;
* accountability;
* evidence;
* monitoring;
* assurance;
* continuous improvement.

The four NIST AI RMF functions—GOVERN, MAP, MEASURE and MANAGE—are treated as interconnected risk-management capabilities rather than a rigid sequence.

AIGO provides the organizational and operational mechanisms through which those capabilities may be embedded into AI governance processes.

***

## 61. Document Control

### 61.1 Controlled Information

| Field               | Value                                            |
| ------------------- | ------------------------------------------------ |
| Document Title      | AIGO — NIST AI Risk Management Framework Mapping |
| Document ID         | `AIGO-MAP-NIST-AIRMF-001`                        |
| Version             | 0.1                                              |
| Status              | Draft                                            |
| Framework           | AIGO AI Governance Operating Framework           |
| Mapping Standard    | NIST AI RMF 1.0                                  |
| Mapping Domain      | Master Framework Mapping                         |
| Primary Owner       |                                                  |
| Technical Reviewer  |                                                  |
| Governance Reviewer |                                                  |
| Approver            |                                                  |
| Effective Date      |                                                  |
| Next Review Date    |                                                  |

### 61.2 Source Baseline

**Primary source:** NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0.

**Primary NIST functions:**

* GOVERN
* MAP
* MEASURE
* MANAGE

**Related implementation resource:** NIST AI RMF Playbook.

***

## 62. Final Control Statement

This document is controlled within the AIGO Framework documentation structure.

It establishes the master relationship between AIGO and NIST AI RMF 1.0 and provides the architectural foundation for detailed function, category, lifecycle, risk, governance, evidence and implementation mappings.

Any material modification to the AIGO framework or the referenced NIST AI RMF baseline shall trigger an appropriate review of this document and its subordinate mapping documents.

This document does not constitute NIST certification, endorsement, accreditation or regulatory approval.

***

## 63. End of Mapping Document

**AIGO — NIST AI Risk Management Framework Mapping**

**Document ID:** `AIGO-MAP-NIST-AIRMF-001`

**Version:** 0.1

**Status:** Draft

**Mapping Standard:** NIST AI RMF 1.0

**End of Document**