AIGO — NIST AI RMF Lifecycle Mapping

AIGO — AI Governance Operating Framework

Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-NIST-AIRMF-004 Mapping Standard: NIST AI RMF 1.0 Mapping Type: Lifecycle Mapping

1. Purpose

This document defines the relationship between the NIST AI Risk Management Framework (AI RMF) and the AIGO AI Governance Lifecycle. The purpose of this mapping is to establish how NIST AI RMF Functions, Categories and Subcategories are operationalized throughout the AIGO lifecycle. The mapping recognizes that NIST AI RMF risk-management activities are continuous and iterative rather than strictly sequential. AIGO therefore provides lifecycle positioning for NIST activities while preserving the continuous nature of AI risk management.

2. Mapping Objective

The mapping establishes traceability between:

NIST AI RMF Functions;
NIST Categories;
NIST Subcategories;
AIGO lifecycle stages;
AIGO governance domains;
AIGO controls;
AIGO procedures;
AIGO roles;
evidence;
monitoring;
assurance;
continual improvement.

3. AIGO Lifecycle

The AIGO lifecycle consists of the following primary stages:

Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change / Continue / Retire

The lifecycle is iterative. A system may return to earlier stages when risk, context, requirements or system characteristics change.

4. NIST AI RMF Functions

The NIST AI RMF Core is organized around four Functions:

Function	Lifecycle Orientation
GOVERN	Continuous governance across lifecycle
MAP	Context and risk identification
MEASURE	Measurement, testing and evaluation
MANAGE	Risk prioritization and response

5. Lifecycle Mapping Principle

A NIST Function is not assigned to only one AIGO lifecycle stage. Instead:

NIST Function
      ↓
NIST Category
      ↓
Lifecycle Activity
      ↓
AIGO Control
      ↓
Operational Evidence

One NIST category may therefore map to multiple lifecycle stages.

6. Govern

6.1 Lifecycle Objective

The Govern stage establishes the organizational foundation for responsible AI governance. It defines:

governance authority;
policies;
principles;
roles;
responsibilities;
decision rights;
risk appetite;
control expectations;
oversight;
regulatory context.

6.2 NIST Mapping

Primary NIST Function: GOVERN Supporting Functions:

MAP;
MEASURE;
MANAGE.

6.3 GOVERN Category Relationship

NIST Category	AIGO Relationship
GOVERN 1	Governance policies and structures
GOVERN 2	Accountability
GOVERN 3	Competence
GOVERN 4	Risk culture
GOVERN 5	Stakeholders
GOVERN 6	Legal and regulatory requirements
GOVERN 7	Risk-management integration
GOVERN 8	Documentation
GOVERN 9	Third-party governance

6.4 Governance Model

Governance Authority
        ↓
AI Governance Policy
        ↓
Roles and Responsibilities
        ↓
Risk Criteria
        ↓
Controls
        ↓
Procedures
        ↓
Lifecycle Oversight

7. Identify

7.1 Lifecycle Objective

The Identify stage establishes the existence, purpose and context of the AI system. Activities include:

system identification;
owner identification;
purpose identification;
intended-use identification;
stakeholder identification;
dependency identification;
lifecycle initiation.

7.2 NIST Mapping

Primary Function: MAP Supporting Function: GOVERN

7.3 Mapping

NIST Area	AIGO Activity
MAP 1	System context
MAP 2	Initial categorization
MAP 3	Benefits and impacts
MAP 4	Initial risk identification
MAP 5	Human oversight context
MAP 6	Lifecycle context
GOVERN 5	Stakeholder governance
GOVERN 9	Third-party context

8. AI System Registration

The Identify stage initiates formal AI system registration. The registration record should identify:

system name;
system identifier;
owner;
purpose;
intended use;
deployment context;
provider;
dependencies;
affected stakeholders;
initial risk information.

9. Classify

9.1 Lifecycle Objective

The Classify stage determines the governance and risk classification of the AI system. Classification should consider:

risk;
impact;
criticality;
autonomy;
affected stakeholders;
legal requirements;
data;
deployment context.

9.2 NIST Mapping

Primary Function: MAP Supporting Function: GOVERN

9.3 Classification Model

AI System
    ↓
Context
    ↓
Intended Purpose
    ↓
Impact
    ↓
Risk Factors
    ↓
Classification
    ↓
Applicable Controls

10. Assess

10.1 Lifecycle Objective

The Assess stage performs detailed AI risk assessment and control assessment. Activities include:

risk identification;
risk analysis;
impact assessment;
control assessment;
testing;
measurement;
trustworthiness evaluation.

10.2 NIST Mapping

Primary Function: MEASURE Supporting Functions:

MAP;
GOVERN.

11. Assessment Mapping

NIST Function	AIGO Activity
MAP	Establish context
MEASURE	Evaluate risks
GOVERN	Apply governance criteria

12. Measurement Model

Risk
  ↓
Measurement Objective
  ↓
Metric / Test
  ↓
Result
  ↓
Threshold
  ↓
Evaluation
  ↓
Risk Decision

13. Assess — Trustworthiness

AIGO assessment may consider relevant characteristics including:

validity;
reliability;
safety;
security;
resilience;
accountability;
transparency;
explainability;
privacy;
fairness.

The applicable characteristics should be determined according to system context and risk.

14. Treat

14.1 Lifecycle Objective

The Treat stage establishes and implements responses to identified risks. Possible treatment strategies include:

mitigation;
avoidance;
restriction;
redesign;
additional controls;
transfer;
acceptance;
suspension.

14.2 NIST Mapping

Primary Function: MANAGE Supporting Functions:

MEASURE;
GOVERN.

15. Risk Treatment Model

Identified Risk
      ↓
Risk Analysis
      ↓
Prioritization
      ↓
Treatment Strategy
      ↓
Control Selection
      ↓
Implementation
      ↓
Residual Risk
      ↓
Acceptance / Escalation

16. Approve

16.1 Lifecycle Objective

The Approve stage establishes whether the AI system may proceed to deployment or continued operation. Approval considers:

risk;
controls;
residual risk;
evidence;
testing;
legal requirements;
governance criteria.

16.2 NIST Mapping

Primary Function: GOVERN Supporting Functions:

MEASURE;
MANAGE.

17. Approval Decision

Assessment
    ↓
Control Status
    ↓
Residual Risk
    ↓
Evidence
    ↓
Governance Review
    ↓
Approval Decision
       ↙     ↓      ↘
   Approve  Cond.   Reject

18. Deploy

18.1 Lifecycle Objective

The Deploy stage introduces the AI system into its approved operational environment. Deployment should confirm:

approved configuration;
approved purpose;
approved controls;
required monitoring;
required human oversight;
operational readiness.

18.2 NIST Mapping

Primary Functions: MANAGE + GOVERN Supporting Function: MEASURE

19. Deployment Control Gate

Approved System
      ↓
Deployment Readiness
      ↓
Control Verification
      ↓
Monitoring Readiness
      ↓
Human Oversight Readiness
      ↓
Deployment

20. Operate

20.1 Lifecycle Objective

The Operate stage maintains the AI system within its approved governance and risk boundaries. Activities include:

operational use;
human oversight;
incident handling;
access management;
control operation;
operational monitoring.

20.2 NIST Mapping

Primary Functions:

GOVERN;
MEASURE;
MANAGE.

21. Operational Risk Model

AI System
   ↓
Operational Use
   ↓
Observed Behaviour
   ↓
Monitoring
   ↓
Measurement
   ↓
Risk Evaluation
   ↓
Management Response

22. Monitor

22.1 Lifecycle Objective

The Monitor stage continuously evaluates whether the AI system and its controls remain within acceptable parameters. Monitoring may include:

performance;
incidents;
drift;
risk indicators;
control effectiveness;
stakeholder feedback;
changes in context;
regulatory developments.

22.2 NIST Mapping

Primary Function: MEASURE Supporting Function: MANAGE

23. Monitoring Model

Operate
   ↓
Monitor
   ↓
Measure
   ↓
Detect Change
   ↓
Evaluate Risk
   ↓
Manage

24. Assure

24.1 Lifecycle Objective

The Assure stage provides objective evaluation of governance, risk and control effectiveness. Assurance may include:

control review;
evidence review;
internal assessment;
independent assessment;
audit;
effectiveness evaluation.

24.2 NIST Mapping

Primary Function: MEASURE Supporting Functions:

GOVERN;
MANAGE.

25. Assurance Model

Requirement
    ↓
Control
    ↓
Implementation
    ↓
Evidence
    ↓
Operating Effectiveness
    ↓
Assurance Finding
    ↓
Corrective Action

26. Improve

26.1 Lifecycle Objective

The Improve stage incorporates lessons learned, findings and performance information into the governance system. Inputs include:

monitoring;
incidents;
assurance;
management review;
stakeholder feedback;
changes in requirements;
emerging risks.

26.2 NIST Mapping

Primary Function: MANAGE Supporting Functions:

GOVERN;
MEASURE.

27. Improvement Model

Evidence
   ↓
Finding
   ↓
Root Cause
   ↓
Corrective Action
   ↓
Implementation
   ↓
Effectiveness Review
   ↓
Improvement

28. Change

28.1 Lifecycle Objective

The Change stage governs material changes to AI systems, their context, controls or operating environment. Examples include:

model changes;
data changes;
provider changes;
purpose changes;
deployment changes;
integration changes;
regulatory changes.

28.2 NIST Mapping

Primary Functions:

MANAGE;
MEASURE.

Supporting Function:

GOVERN.

29. Change Management Model

Change Request
      ↓
Change Classification
      ↓
Impact Assessment
      ↓
Risk Reassessment
      ↓
Measurement / Testing
      ↓
Control Reassessment
      ↓
Approval
      ↓
Implementation
      ↓
Verification
      ↓
Monitoring

30. Continue

30.1 Lifecycle Objective

The Continue decision confirms that an AI system remains appropriate for ongoing operation. The decision should consider:

current risk;
performance;
incidents;
control effectiveness;
monitoring results;
assurance findings;
stakeholder impacts;
regulatory context.

31. Retire

31.1 Lifecycle Objective

The Retire stage ensures that an AI system is appropriately discontinued. Activities include:

retirement authorization;
system shutdown;
dependency closure;
data disposition;
evidence retention;
stakeholder notification;
residual-risk closure.

31.2 NIST Mapping

Primary Function: MANAGE Supporting Functions:

GOVERN;
MAP.

32. Retirement Model

Retirement Decision
      ↓
Authorization
      ↓
Operational Shutdown
      ↓
Dependency Closure
      ↓
Data / Asset Disposition
      ↓
Evidence Retention
      ↓
Residual Risk Review
      ↓
Closure

33. Cross-Lifecycle NIST Mapping

AIGO Stage	GOVERN	MAP	MEASURE	MANAGE
Govern	Primary	Supporting	Supporting	Supporting
Identify	Supporting	Primary
Classify	Supporting	Primary		Supporting
Assess	Supporting	Primary	Primary	Supporting
Treat	Supporting		Supporting	Primary
Approve	Primary		Supporting	Primary
Deploy	Primary		Supporting	Primary
Operate	Primary	Supporting	Primary	Primary
Monitor	Supporting	Supporting	Primary	Primary
Assure	Primary		Primary	Supporting
Improve	Primary	Supporting	Supporting	Primary
Change	Supporting	Supporting	Primary	Primary
Continue	Primary	Supporting	Primary	Primary
Retire	Supporting	Supporting		Primary

34. NIST Function Lifecycle Distribution

34.1 GOVERN

GOVERN is continuous.

Govern
  ↓
Identify
  ↓
Classify
  ↓
Assess
  ↓
Approve
  ↓
Operate
  ↓
Monitor
  ↓
Assure
  ↓
Improve

Governance provides the decision framework across the lifecycle.

35. MAP

MAP is concentrated in the establishment and reassessment of context.

Identify
   ↓
Classify
   ↓
Assess
   ↓
Change
   ↓
Reassess

MAP activities may recur whenever context changes.

36. MEASURE

MEASURE operates throughout assessment and operational monitoring.

Assess
   ↓
Test
   ↓
Measure
   ↓
Deploy
   ↓
Monitor
   ↓
Measure
   ↓
Assure

37. MANAGE

MANAGE translates identified and measured risk into decisions and actions.

Risk
 ↓
Prioritize
 ↓
Treat
 ↓
Approve
 ↓
Operate
 ↓
Monitor
 ↓
Respond
 ↓
Improve / Change / Retire

38. Lifecycle Feedback Loop

The AIGO lifecycle is not a one-way process.

Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change
   ↓
Reassess
   ↺

39. NIST Function Feedback Loop

GOVERN
   ↓
MAP
   ↓
MEASURE
   ↓
MANAGE
   ↓
GOVERN
   ↺

The functions operate continuously and may be invoked simultaneously.

40. Lifecycle Risk Decision Model

AI System
   ↓
Context
   ↓
Risk
   ↓
Measurement
   ↓
Management
   ↓
Decision
   ↓
Operation
   ↓
Monitoring
   ↓
New Evidence
   ↓
Updated Risk
   ↺

41. Lifecycle Evidence Model

Every significant lifecycle stage should generate appropriate evidence.

Lifecycle Stage	Representative Evidence
Govern	Policies, roles, governance records
Identify	Registration record
Classify	Classification assessment
Assess	Risk and control assessments
Treat	Treatment plan
Approve	Approval decision
Deploy	Deployment readiness evidence
Operate	Operational records
Monitor	Monitoring records
Assure	Assurance reports
Improve	Improvement records
Change	Change records
Continue	Continuation decision
Retire	Retirement record

42. Lifecycle Role Model

Lifecycle Stage	Primary Role
Govern	Governance Authority
Identify	AI System Owner
Classify	AI Governance / Risk Owner
Assess	Risk Owner / Assessor
Treat	Risk Owner / Control Owner
Approve	Approval Authority
Deploy	System Owner
Operate	Operational Owner
Monitor	Monitoring / Control Owner
Assure	Assurance Function
Improve	Governance / Process Owner
Change	Change Authority
Continue	Governance Authority
Retire	System Owner / Approval Authority

43. Lifecycle Control Model

Controls should be assigned according to lifecycle risk.

Lifecycle Stage
      ↓
Risk
      ↓
Control Objective
      ↓
Control
      ↓
Procedure
      ↓
Evidence

Controls may apply to multiple stages.

44. Lifecycle and NIST Subcategories

NIST Subcategories should be traced to lifecycle activities at the lowest practical level. A detailed record should identify:

Field	Description
NIST Function	Applicable function
NIST Category	Applicable category
NIST Subcategory	Specific outcome
AIGO Lifecycle	Lifecycle stage
AIGO Domain	Governance domain
AIGO Control	Relevant control
Procedure	Operational procedure
Role	Responsible role
Evidence	Required evidence
Status	Mapping status

45. Lifecycle Mapping Strength

The following codes may be used:

Code	Meaning
D	Direct
S	Supporting
P	Partial
G	Gap
N/A	Not applicable

A lifecycle mapping is not evidence of implementation.

46. Lifecycle Gap Assessment

Where a NIST element does not have an adequate lifecycle placement, the gap should be recorded. A gap record should contain:

NIST reference;
AIGO lifecycle stage;
missing capability;
risk;
owner;
remediation;
target date;
status;
evidence.

47. Lifecycle Change Trigger

The following events should trigger lifecycle reassessment where material:

change in intended purpose;
change in deployment context;
material model update;
material data change;
new provider;
new integration;
new stakeholder population;
new legal requirement;
significant incident;
material monitoring deviation;
significant assurance finding.

48. Lifecycle Incident Feedback

Incidents may force movement backward through the lifecycle.

Incident
   ↓
Containment
   ↓
Investigation
   ↓
Risk Reassessment
   ↓
Control Reassessment
   ↓
Treatment
   ↓
Approval
   ↓
Return to Operation

Where the system cannot safely continue, suspension or retirement may be required.

49. Lifecycle Assurance Feedback

Assurance findings should feed into improvement.

Assurance
   ↓
Finding
   ↓
Risk Evaluation
   ↓
Corrective Action
   ↓
Implementation
   ↓
Effectiveness Testing
   ↓
Closure

50. Lifecycle Management Review

Management review should consider lifecycle performance as a whole. Inputs may include:

risk status;
monitoring;
incidents;
assurance findings;
control effectiveness;
stakeholder feedback;
regulatory developments;
changes;
improvement actions.

Outputs may include:

continued operation;
additional controls;
reassessment;
change;
suspension;
retirement.

51. Lifecycle-to-Procedure Traceability

Lifecycle Stage	AIGO Procedure
Govern	AI Governance Procedure
Identify	AI System Registration Procedure
Classify	AI Classification Procedure
Assess	AI Risk Assessment Procedure / Control Assessment Procedure
Treat	AI Risk Acceptance Procedure
Approve	AI Approval Procedure
Deploy	AI Approval / Governance Procedure
Operate	AI Governance Procedure
Monitor	AI Monitoring Procedure
Assure	AI Assurance Procedure
Improve	Continuous Improvement Procedure
Change	AI Change Management Procedure
Continue	AI Monitoring / Governance Procedure
Retire	AI Retirement Procedure

52. Lifecycle-to-Mapping Architecture

The lifecycle mapping connects the NIST mapping suite.

01 — NIST AI RMF Mapping
        ↓
02 — Requirements Mapping
        ↓
03 — Categories Mapping
        ↓
04 — Lifecycle Mapping
        ↓
05 — Risk Mapping
        ↓
06 — Governance Mapping
        ↓
07 — Evidence Mapping
        ↓
08 — Implementation Mapping

Each mapping document addresses a different traceability dimension.

53. Lifecycle Integration with Risk

The AIGO risk lifecycle operates within the broader AI lifecycle.

AI Lifecycle
      ↓
Risk Identification
      ↓
Risk Analysis
      ↓
Risk Treatment
      ↓
Risk Acceptance
      ↓
Monitoring
      ↓
Risk Reassessment

54. Lifecycle Integration with Controls

Controls are lifecycle-dependent. A control may operate:

before deployment;
during deployment;
during operation;
during monitoring;
after change;
during retirement.

Therefore, control effectiveness should be evaluated in lifecycle context.

55. Lifecycle Integration with Evidence

Evidence should demonstrate actual lifecycle execution.

Lifecycle Requirement
       ↓
Control
       ↓
Procedure
       ↓
Activity
       ↓
Evidence
       ↓
Assessment

56. Lifecycle Integration with Assurance

Assurance should evaluate both:

whether required lifecycle activities exist; and
whether those activities operate effectively.

57. Continuous Lifecycle Model

The complete AIGO-NIST relationship can be represented as:

                    GOVERN
                       ↓
                  ┌─────────┐
                  │ IDENTIFY│
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ CLASSIFY│
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ ASSESS  │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │  TREAT  │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ APPROVE │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ DEPLOY  │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ OPERATE │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ MONITOR │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ ASSURE  │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ IMPROVE │
                  └────┬────┘
                       ↓
                  ┌─────────┐
                  │ CHANGE  │
                  └────┬────┘
                       ↓
                 REASSESS / RETIRE
                       │
                       └──────────↺

58. Governance Interpretation

The lifecycle mapping should be interpreted as an operationalization model. NIST AI RMF provides a flexible risk-management framework. AIGO provides the organizational lifecycle mechanisms through which those activities can be implemented, governed, evidenced and assured.

59. Mapping Limitations

This document does not:

reproduce the NIST AI RMF;
create NIST requirements;
constitute NIST certification;
constitute legal compliance;
replace organizational risk management;
replace technical validation;
guarantee AI system trustworthiness;
constitute NIST endorsement.

60. Maintenance Requirements

This document should be reviewed when:

NIST AI RMF changes;
AIGO lifecycle changes;
AIGO procedures change;
AIGO controls change;
risk methodology changes;
governance roles change;
material regulatory requirements change;
material lifecycle gaps are identified.

61. Document Change Record

Version	Date	Change	Author	Reviewer	Approval
0.1		Initial lifecycle mapping

62. Document Control

62.1 Controlled Information

Field	Value
Document Title	AIGO — NIST AI RMF Lifecycle Mapping
Document ID	`AIGO-MAP-NIST-AIRMF-004`
Version	0.1
Status	Draft
Framework	AIGO AI Governance Operating Framework
Mapping Standard	NIST AI RMF 1.0
Mapping Domain	Lifecycle Management
Primary Owner
Technical Reviewer
Governance Reviewer
Approver
Effective Date
Next Review Date

63. Final Control Statement

This document establishes the lifecycle relationship between NIST AI RMF and the AIGO AI Governance Operating Framework. The mapping demonstrates how NIST AI RMF Functions, Categories and Subcategories may be operationalized throughout the AIGO lifecycle. The lifecycle should be treated as iterative and risk-driven rather than as a strictly linear sequence.

GOVERN
   ↓
MAP
   ↓
MEASURE
   ↓
MANAGE
   ↓
GOVERN
   ↺

These functions operate continuously across the AIGO lifecycle.

64. End of Mapping Document

AIGO — NIST AI RMF Lifecycle Mapping Document ID: AIGO-MAP-NIST-AIRMF-004 Version: 0.1 Status: Draft Mapping Standard: NIST AI RMF 1.0 Mapping Type: Lifecycle Mapping End of Document

​AIGO — NIST AI RMF Lifecycle Mapping

​AIGO — AI Governance Operating Framework

​1. Purpose

​2. Mapping Objective

​3. AIGO Lifecycle

​4. NIST AI RMF Functions

​5. Lifecycle Mapping Principle

​6. Govern

​6.1 Lifecycle Objective

​6.2 NIST Mapping

​6.3 GOVERN Category Relationship

​6.4 Governance Model

​7. Identify

​7.1 Lifecycle Objective

​7.2 NIST Mapping

​7.3 Mapping

​8. AI System Registration

​9. Classify

​9.1 Lifecycle Objective

​9.2 NIST Mapping

​9.3 Classification Model

​10. Assess

​10.1 Lifecycle Objective

​10.2 NIST Mapping

​11. Assessment Mapping

​12. Measurement Model

​13. Assess — Trustworthiness

​14. Treat

​14.1 Lifecycle Objective

​14.2 NIST Mapping

​15. Risk Treatment Model

​16. Approve

​16.1 Lifecycle Objective

​16.2 NIST Mapping

​17. Approval Decision

​18. Deploy

​18.1 Lifecycle Objective

​18.2 NIST Mapping

​19. Deployment Control Gate

​20. Operate

​20.1 Lifecycle Objective

​20.2 NIST Mapping

​21. Operational Risk Model

​22. Monitor

​22.1 Lifecycle Objective

​22.2 NIST Mapping

​23. Monitoring Model

​24. Assure

​24.1 Lifecycle Objective

​24.2 NIST Mapping

​25. Assurance Model

​26. Improve

​26.1 Lifecycle Objective

​26.2 NIST Mapping

​27. Improvement Model

​28. Change

​28.1 Lifecycle Objective

​28.2 NIST Mapping

​29. Change Management Model

​30. Continue

​30.1 Lifecycle Objective

​31. Retire

​31.1 Lifecycle Objective

​31.2 NIST Mapping

​32. Retirement Model

​33. Cross-Lifecycle NIST Mapping

​34. NIST Function Lifecycle Distribution

​34.1 GOVERN

​35. MAP

​36. MEASURE

​37. MANAGE

​38. Lifecycle Feedback Loop

​39. NIST Function Feedback Loop

​40. Lifecycle Risk Decision Model

​41. Lifecycle Evidence Model

​42. Lifecycle Role Model

​43. Lifecycle Control Model

​44. Lifecycle and NIST Subcategories

​45. Lifecycle Mapping Strength

​46. Lifecycle Gap Assessment

AIGO — NIST AI RMF Lifecycle Mapping

AIGO — AI Governance Operating Framework

1. Purpose

2. Mapping Objective

3. AIGO Lifecycle

4. NIST AI RMF Functions

5. Lifecycle Mapping Principle

6. Govern

6.1 Lifecycle Objective

6.2 NIST Mapping

6.3 GOVERN Category Relationship

6.4 Governance Model

7. Identify

7.1 Lifecycle Objective

7.2 NIST Mapping

7.3 Mapping

8. AI System Registration

9. Classify

9.1 Lifecycle Objective

9.2 NIST Mapping

9.3 Classification Model

10. Assess

10.1 Lifecycle Objective

10.2 NIST Mapping

11. Assessment Mapping

12. Measurement Model

13. Assess — Trustworthiness

14. Treat

14.1 Lifecycle Objective

14.2 NIST Mapping

15. Risk Treatment Model

16. Approve

16.1 Lifecycle Objective

16.2 NIST Mapping

17. Approval Decision

18. Deploy

18.1 Lifecycle Objective

18.2 NIST Mapping

19. Deployment Control Gate

20. Operate

20.1 Lifecycle Objective

20.2 NIST Mapping

21. Operational Risk Model

22. Monitor

22.1 Lifecycle Objective

22.2 NIST Mapping

23. Monitoring Model

24. Assure

24.1 Lifecycle Objective

24.2 NIST Mapping

25. Assurance Model

26. Improve

26.1 Lifecycle Objective

26.2 NIST Mapping

27. Improvement Model

28. Change

28.1 Lifecycle Objective

28.2 NIST Mapping

29. Change Management Model

30. Continue

30.1 Lifecycle Objective

31. Retire

31.1 Lifecycle Objective

31.2 NIST Mapping

32. Retirement Model

33. Cross-Lifecycle NIST Mapping

34. NIST Function Lifecycle Distribution

34.1 GOVERN

35. MAP

36. MEASURE

37. MANAGE

38. Lifecycle Feedback Loop

39. NIST Function Feedback Loop

40. Lifecycle Risk Decision Model

41. Lifecycle Evidence Model

42. Lifecycle Role Model

43. Lifecycle Control Model

44. Lifecycle and NIST Subcategories

45. Lifecycle Mapping Strength

46. Lifecycle Gap Assessment