AIGO — NIST AI RMF AIGO Control Mapping

1. Document Purpose

This document establishes the detailed control-level mapping between the NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0 and the AIGO AI Governance Operating Framework. NIST AI RMF 1.0, identified by NIST as NIST AI 100-1, was published on 26 January 2023. NIST describes the framework as voluntary, flexible, rights-preserving, non-sector-specific, and use-case agnostic. The purpose of this document is to translate NIST AI RMF functions, categories, and subcategory-level outcomes into reusable AIGO controls while maintaining a clear distinction between:

NIST framework content;
NIST implementation guidance;
AIGO controls;
organizational procedures;
evidence;
assurance; and
applicable legal requirements.

This document is an operational AIGO crosswalk. It does not constitute NIST endorsement, NIST certification, legal compliance, or an independent assurance opinion.

2. Mapping Information

Field	Value
Mapping	AIGO NIST AI RMF AIGO Control Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-NIST-AIRMF-010`
Document Type	AI Risk Management Framework Mapping
Mapping Package	`AIGO-MAP-NIST-AIRMF`
Primary Framework	NIST AI RMF 1.0
Primary Publication	NIST AI 100-1
Publication Date	26 January 2023
Primary Function	NIST outcome-to-AIGO-control crosswalk
Architecture	`AIGO-MAP-NIST-AIRMF-ARCH-001`
Registry	`00-AIGO-NIST-AI-RMF-Mapping-Registry-v0.1.json`

3. Control-Mapping Principle

The control architecture is:

NIST AI RMF
      ↓
Function
      ↓
Category
      ↓
Subcategory / Outcome
      ↓
AIGO Governance Objective
      ↓
AIGO Control
      ↓
AIGO Process
      ↓
Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Improvement

AIGO controls operationalize governance outcomes. They do not alter the meaning of the NIST framework.

4. NIST AI RMF Functions

The mapping must preserve the four AI RMF Core functions:

GOVERN
MAP
MEASURE
MANAGE

NIST describes these as an iterative core rather than a mandatory linear sequence.

5. Control Relationship Types

The mapping registry shall support:

DIRECT
PARTIAL
SUPPORTING
INTEGRATED
CONDITIONAL
CROSS_REFERENCE
DERIVED
NO_DIRECT_EQUIVALENT

DIRECT

The AIGO control directly operationalizes the mapped NIST outcome.

PARTIAL

The control addresses only a portion of the outcome.

SUPPORTING

The control supports implementation but does not independently cover the outcome.

INTEGRATED

Multiple AIGO controls collectively address the outcome.

CONDITIONAL

The control applies only under defined context or risk conditions.

CROSS_REFERENCE

An existing AIGO control or artifact is authoritative.

DERIVED

The relationship is derived from another controlled mapping.

NO_DIRECT_EQUIVALENT

The outcome requires an organizational activity for which no dedicated AIGO control currently exists.

6. Control Status

AIGO control status shall distinguish:

MAPPED
DEFINED
IMPLEMENTED
PARTIALLY_IMPLEMENTED
EVIDENCED
MEASURED
MANAGED
ASSESSED
MONITORED
ASSURED
SUPERSEDED
RETIRED

These are operational AIGO statuses and are not NIST certification statuses.

7. Control Identifier Convention

Recommended relationship identifiers:

NIST-AIRMF-CTRL-<DOMAIN>-<SEQUENCE>

Examples:

NIST-AIRMF-CTRL-GOV-001
NIST-AIRMF-CTRL-MAP-001
NIST-AIRMF-CTRL-MEA-001
NIST-AIRMF-CTRL-MAN-001

Where a control already exists in the AIGO Control Schema, the authoritative AIGO control identifier should be referenced rather than creating a duplicate operational control.

8. Control Domains

The initial mapping domains are:

GOV     GOVERN
MAP     MAP
MEA     MEASURE
MAN     MANAGE
CTX     Context
STA     Stakeholders
RSK     Risk
IMP     Impact
DATA    Data
TEST    Testing
PERF    Performance
SAFE    Safety
SEC     Security
PRIV    Privacy
FAIR    Fairness / Bias
EXP     Explainability / Interpretability
TRN     Transparency
HUM     Human Oversight
EVD     Evidence
MON     Monitoring
INC     Incident
CHG     Change
TPG     Third-Party Governance
ASSR    Assurance
GOVR    Governance Review
RET     Retirement

9. GOVERN — Policy and Governance

`NIST-AIRMF-CTRL-GOV-001`

Name: AI Risk Governance Objective: Establish governance structures, accountability, and oversight for AI risk management. Mapped Function: GOVERN Relationship: DIRECT AIGO Components:

Governance;
Management Review;
Risk;
Control;
Assurance.

Activities:

establish governance;
assign accountability;
define decision authority;
establish escalation;
monitor governance effectiveness;
review governance changes.

Evidence:

governance charter;
role assignments;
governance decisions;
management-review records.

10. `NIST-AIRMF-CTRL-GOV-002`

Name: AI Governance Policy Objective: Establish and maintain policies governing AI risk management. Mapped Areas:

GOVERN;
policy-related governance outcomes.

Relationship: DIRECT Evidence:

AI policy;
policy approval;
version history;
communication.

11. `NIST-AIRMF-CTRL-GOV-003`

Name: AI Governance Accountability Objective: Assign accountable owners for material AI risks, systems, and governance outcomes. Relationship: DIRECT / CRITICAL Activities:

identify accountable owner;
establish authority;
define responsibility;
maintain delegation;
review accountability after change.

12. `NIST-AIRMF-CTRL-GOV-004`

Name: AI Governance Resource Management Objective: Ensure resources are available to execute AI risk-management activities. Relationship: SUPPORTING Resources may include:

personnel;
technical infrastructure;
evaluation capability;
monitoring;
assurance;
security;
incident response.

13. `NIST-AIRMF-CTRL-GOV-005`

Name: AI Risk Culture and Escalation Objective: Promote an organizational environment in which AI risks can be identified, challenged, escalated, and addressed. Relationship: SUPPORTING Evidence:

escalation records;
governance training;
incident reporting;
management decisions;
lessons learned.

14. `NIST-AIRMF-CTRL-GOV-006`

Name: Legal and Regulatory Requirements Register Objective: Identify and maintain applicable legal, regulatory, standards, contractual, and organizational requirements relevant to AI risk. Relationship: DIRECT / CROSS-CUTTING Activities:

identify source;
assess applicability;
map requirement;
assign owner;
monitor change;
update controls.

This control supports NIST GOVERN outcomes concerning understanding and documenting legal and regulatory requirements.

15. `NIST-AIRMF-CTRL-GOV-007`

Name: AI Governance Competence Objective: Ensure people performing AI risk-management activities possess appropriate competence. Relationship: DIRECT Evidence:

competence profiles;
training;
qualifications;
experience;
assessments.

16. `NIST-AIRMF-CTRL-GOV-008`

Name: AI Governance Communication Objective: Govern internal and external communication relevant to AI risk. Relationship: DIRECT

17. MAP — AI System Context

`NIST-AIRMF-CTRL-MAP-001`

Name: AI System Context Definition Objective: Define the organizational, technical, operational, legal, and societal context relevant to an AI system. Mapped Function: MAP Relationship: DIRECT / CRITICAL Evidence:

AI System Profile;
context assessment;
deployment environment;
system dependencies;
stakeholder analysis.

18. `NIST-AIRMF-CTRL-MAP-002`

Name: Intended Purpose Governance Objective: Ensure the intended purpose and expected use of an AI system are documented and current. Relationship: DIRECT Evidence:

intended-purpose statement;
use-case definition;
approved system profile.

19. `NIST-AIRMF-CTRL-MAP-003`

Name: AI System Boundary and Dependency Mapping Objective: Identify system boundaries, interfaces, dependencies, external services, datasets, models, and infrastructure. Relationship: DIRECT Evidence:

architecture;
dependency inventory;
supply-chain record;
system map.

20. `NIST-AIRMF-CTRL-MAP-004`

Name: Stakeholder Identification Objective: Identify relevant stakeholders and their interests, expectations, concerns, and possible impacts. Relationship: DIRECT Evidence:

stakeholder register;
consultations;
governance records;
requirements.

21. `NIST-AIRMF-CTRL-MAP-005`

Name: Affected-Person Identification Objective: Identify individuals and groups that may be directly or indirectly affected by an AI system. Relationship: DIRECT / CONDITIONAL Evidence:

affected-person analysis;
impact assessment;
user research;
rights assessment.

22. `NIST-AIRMF-CTRL-MAP-006`

Name: AI Impact Assessment Objective: Identify and evaluate potential impacts associated with AI-system use. Relationship: DIRECT / CRITICAL Activities:

identify impacts;
assess severity;
assess likelihood;
identify affected groups;
determine mitigation;
document residual impact.

23. `NIST-AIRMF-CTRL-MAP-007`

Name: AI Lifecycle Context Assessment Objective: Maintain awareness of how risk and impact context changes across the AI lifecycle. Relationship: INTEGRATED Lifecycle:

Design
 ↓
Development
 ↓
Testing
 ↓
Deployment
 ↓
Operation
 ↓
Change
 ↓
Retirement

24. `NIST-AIRMF-CTRL-MAP-008`

Name: Supply-Chain Context Assessment Objective: Identify risks introduced by third-party models, datasets, software, infrastructure, and services. Relationship: DIRECT / CONDITIONAL

25. MAP — Risk Identification

`NIST-AIRMF-CTRL-MAP-009`

Name: AI Risk Identification Objective: Identify risks associated with an AI system, its context, and lifecycle. Relationship: DIRECT / CRITICAL Risk domains may include:

safety;
security;
privacy;
fairness;
bias;
reliability;
robustness;
explainability;
transparency;
operational;
legal;
social;
reputational.

26. `NIST-AIRMF-CTRL-MAP-010`

Name: Risk Interdependency Mapping Objective: Identify relationships among AI risks, controls, systems, stakeholders, and organizational objectives. Relationship: SUPPORTING

27. MEASURE — Measurement Governance

`NIST-AIRMF-CTRL-MEA-001`

Name: AI Risk Measurement Governance Objective: Define measurement objectives, methods, metrics, thresholds, and evidence requirements for material AI risks. Mapped Function: MEASURE Relationship: DIRECT / CRITICAL Evidence:

measurement plan;
metrics;
methodology;
test records;
results.

28. `NIST-AIRMF-CTRL-MEA-002`

Name: AI Evaluation Planning Objective: Establish appropriate evaluation activities for identified AI risks and trustworthiness characteristics. Relationship: DIRECT Activities:

define evaluation objective;
define criteria;
select method;
identify data;
identify system version;
define reviewer.

29. `NIST-AIRMF-CTRL-MEA-003`

Name: Measurement Method Control Objective: Ensure material measurements use documented and appropriate methods. Relationship: DIRECT Evidence:

methodology;
assumptions;
test environment;
data;
calculation;
limitations.

30. `NIST-AIRMF-CTRL-MEA-004`

Name: Measurement Data Quality Objective: Ensure measurement results rely on sufficiently reliable data. Relationship: SUPPORTING Activities:

source validation;
completeness checks;
representativeness;
data quality;
lineage.

31. MEASURE — Validity and Reliability

`NIST-AIRMF-CTRL-MEA-005`

Name: AI Validity and Reliability Assessment Objective: Assess whether the AI system performs as intended and whether measured results are sufficiently reliable for their intended use. Relationship: DIRECT Evidence:

performance tests;
validation;
benchmarks;
reliability analysis;
limitations.

32. MEASURE — Safety

`NIST-AIRMF-CTRL-SAFE-001`

Name: AI Safety Evaluation Objective: Identify and evaluate safety risks associated with AI-system operation. Relationship: DIRECT / CONDITIONAL Activities:

hazard analysis;
failure modes;
safety tests;
safeguards;
incident analysis.

33. `NIST-AIRMF-CTRL-SAFE-002`

Name: AI Safety Monitoring Objective: Monitor safety performance after deployment. Relationship: DIRECT / CONDITIONAL

34. MEASURE — Security

`NIST-AIRMF-CTRL-SEC-001`

Name: AI Security Risk Assessment Objective: Assess security risks affecting AI systems, models, data, infrastructure, and dependencies. Relationship: DIRECT

35. `NIST-AIRMF-CTRL-SEC-002`

Name: AI Security Testing Objective: Conduct appropriate cybersecurity and adversarial testing. Relationship: DIRECT / CONDITIONAL Evidence:

threat model;
vulnerability assessment;
penetration testing;
adversarial testing;
remediation.

36. `NIST-AIRMF-CTRL-SEC-003`

Name: AI Resilience and Recovery Objective: Maintain resilience and recovery capability for material AI-system failures or attacks. Relationship: DIRECT / CONDITIONAL

37. MEASURE — Privacy

`NIST-AIRMF-CTRL-PRIV-001`

Name: AI Privacy Risk Assessment Objective: Identify and evaluate privacy risks arising from AI-system data and operation. Relationship: DIRECT / CONDITIONAL

38. `NIST-AIRMF-CTRL-PRIV-002`

Name: AI Privacy Control Assessment Objective: Evaluate the effectiveness of controls addressing AI-related privacy risks. Relationship: SUPPORTING

39. MEASURE — Fairness and Bias

`NIST-AIRMF-CTRL-FAIR-001`

Name: AI Fairness Assessment Objective: Evaluate fairness-related risks and harmful bias in AI-system outcomes and processes. Relationship: DIRECT / CONDITIONAL Evidence:

fairness assessment;
subgroup analysis;
bias analysis;
mitigation;
retesting.

40. `NIST-AIRMF-CTRL-FAIR-002`

Name: Harmful-Bias Monitoring Objective: Monitor material bias indicators throughout the operational lifecycle. Relationship: DIRECT / CONDITIONAL

41. MEASURE — Explainability and Interpretability

`NIST-AIRMF-CTRL-EXP-001`

Name: AI Explainability and Interpretability Assessment Objective: Evaluate whether system behavior can be understood to the extent appropriate for the context and intended use. Relationship: DIRECT / CONDITIONAL Evidence:

explanation methods;
interpretability tests;
user evaluations;
limitations.

42. MEASURE — Transparency

`NIST-AIRMF-CTRL-TRN-001`

Name: AI Transparency Assessment Objective: Assess whether relevant information about AI systems, limitations, risks, and operation is appropriately available. Relationship: DIRECT / CONDITIONAL

43. MEASURE — Human Factors

`NIST-AIRMF-CTRL-HUM-001`

Name: Human Oversight Assessment Objective: Assess whether humans have appropriate information, authority, capability, and opportunity to oversee AI-system operation where required. Relationship: DIRECT / CONDITIONAL

44. `NIST-AIRMF-CTRL-HUM-002`

Name: Human-AI Interaction Assessment Objective: Evaluate whether human interaction with AI systems creates material risks requiring mitigation. Relationship: SUPPORTING

45. MEASURE — Testing and Evaluation

`NIST-AIRMF-CTRL-TEST-001`

Name: AI Test Governance Objective: Establish controlled testing throughout the AI lifecycle. Relationship: DIRECT / CRITICAL Evidence:

test plans;
test datasets;
test results;
exceptions;
approvals;
version.

46. `NIST-AIRMF-CTRL-TEST-002`

Name: Independent AI Evaluation Objective: Use sufficiently independent evaluation where risk, impact, or governance requirements justify it. Relationship: SUPPORTING / CONDITIONAL

47. `NIST-AIRMF-CTRL-TEST-003`

Name: Evaluation Limitation Governance Objective: Ensure limitations, assumptions, uncertainty, and unresolved gaps are documented. Relationship: DIRECT

48. MEASURE — Monitoring

`NIST-AIRMF-CTRL-MON-001`

Name: AI Risk Monitoring Objective: Continuously or periodically monitor material AI risks according to system context and risk. Relationship: DIRECT / CRITICAL

49. `NIST-AIRMF-CTRL-MON-002`

Name: AI Performance Monitoring Objective: Monitor material performance and trustworthiness indicators after deployment. Relationship: DIRECT / CONDITIONAL

50. `NIST-AIRMF-CTRL-MON-003`

Name: AI Monitoring Thresholds and Escalation Objective: Establish thresholds and escalation paths for significant deterioration or emerging risks. Relationship: DIRECT / CONDITIONAL

51. MANAGE — Risk Prioritization

`NIST-AIRMF-CTRL-MAN-001`

Name: AI Risk Prioritization Objective: Prioritize AI risks using contextually appropriate criteria. Mapped Function: MANAGE Relationship: DIRECT / CRITICAL Factors may include:

severity;
likelihood;
uncertainty;
affected population;
safety;
rights;
business impact;
resource constraints.

52. `NIST-AIRMF-CTRL-MAN-002`

Name: Risk Treatment Planning Objective: Establish risk responses and assign responsible owners. Relationship: DIRECT

53. `NIST-AIRMF-CTRL-MAN-003`

Name: Risk Response Governance Objective: Ensure selected risk responses are implemented, documented, monitored, and reassessed. Relationship: DIRECT / CRITICAL

54. `NIST-AIRMF-CTRL-MAN-004`

Name: Residual-Risk Governance Objective: Document and manage residual risk after treatment. Relationship: DIRECT Evidence:

post-treatment assessment;
residual risk;
decision;
approval;
monitoring.

55. `NIST-AIRMF-CTRL-MAN-005`

Name: Risk Acceptance Governance Objective: Control risk acceptance decisions where organizational policy and applicable law permit acceptance. Relationship: CONDITIONAL A risk acceptance process cannot authorize activity prohibited by applicable law.

56. MANAGE — Deployment Decisions

`NIST-AIRMF-CTRL-MAN-006`

Name: AI Deployment Decision Gate Objective: Ensure deployment decisions consider intended purpose, risk, measurement results, controls, unresolved issues, and accountability. Relationship: DIRECT / CRITICAL Evidence:

approval;
risk assessment;
testing;
residual-risk decision;
conditions.

57. `NIST-AIRMF-CTRL-MAN-007`

Name: AI Continuation Decision Objective: Periodically evaluate whether an AI system should continue operating. Relationship: DIRECT / CONDITIONAL Potential outcomes:

CONTINUE
CONTINUE_WITH_CONDITIONS
RESTRICT
REMEDIATE
SUSPEND
RETIRE

58. MANAGE — Incident Management

`NIST-AIRMF-CTRL-INC-001`

Name: AI Risk Incident Management Objective: Identify, manage, investigate, and learn from AI-related incidents. Relationship: DIRECT / CRITICAL Activities:

detection;
classification;
containment;
investigation;
notification analysis;
recovery;
corrective action.

59. `NIST-AIRMF-CTRL-INC-002`

Name: AI Incident Learning Objective: Ensure incident lessons feed MAP, MEASURE, MANAGE, and governance activities. Relationship: INTEGRATED

Incident
 ↓
Root Cause
 ↓
Risk Update
 ↓
Control Update
 ↓
Measurement Update
 ↓
Improvement

60. MANAGE — Change

`NIST-AIRMF-CTRL-CHG-001`

Name: AI Risk Change Assessment Objective: Determine whether changes affect AI risks, measurements, controls, or governance. Relationship: DIRECT / CRITICAL

61. `NIST-AIRMF-CTRL-CHG-002`

Name: AI Change Approval Objective: Ensure material AI changes are authorized before implementation. Relationship: DIRECT / CONDITIONAL

62. `NIST-AIRMF-CTRL-CHG-003`

Name: Post-Change Reassessment Objective: Reassess material AI risks and trustworthiness characteristics following change. Relationship: DIRECT

63. MANAGE — Third-Party Risk

`NIST-AIRMF-CTRL-TPG-001`

Name: AI Third-Party Risk Governance Objective: Identify and manage AI risks associated with suppliers and externally provided AI components. Relationship: DIRECT / CONDITIONAL

64. `NIST-AIRMF-CTRL-TPG-002`

Name: Third-Party AI Evidence Governance Objective: Ensure supplier claims, testing, security evidence, documentation, and relevant assurances are appropriately reviewed. Relationship: SUPPORTING

65. Cross-Cutting Evidence Controls

`NIST-AIRMF-CTRL-EVD-001`

Name: NIST AI RMF Evidence Management Objective: Maintain reliable evidence demonstrating implementation of selected AI RMF outcomes. Relationship: SUPPORTING / CROSS-CUTTING

66. `NIST-AIRMF-CTRL-EVD-002`

Name: AI Risk Traceability Objective: Maintain:

NIST Outcome
 ↓
AIGO Control
 ↓
Evidence
 ↓
Measurement
 ↓
Management Decision

Relationship: SUPPORTING / CRITICAL

67. `NIST-AIRMF-CTRL-EVD-003`

Name: AI Evidence Version Governance Objective: Associate evidence with AI-system, model, control, and mapping versions. Relationship: SUPPORTING

68. `NIST-AIRMF-CTRL-EVD-004`

Name: AI Evidence Integrity Objective: Protect material evidence against unauthorized modification or loss. Relationship: SUPPORTING

69. Assurance Controls

`NIST-AIRMF-CTRL-ASSR-001`

Name: NIST AI RMF Governance Assurance Objective: Evaluate whether selected governance outcomes are appropriately implemented and evidenced. Relationship: SUPPORTING / CROSS-CUTTING

70. `NIST-AIRMF-CTRL-ASSR-002`

Name: AI Risk-Control Effectiveness Assurance Objective: Evaluate whether selected controls are appropriately designed, implemented, and operating effectively. Relationship: SUPPORTING / CRITICAL

71. `NIST-AIRMF-CTRL-ASSR-003`

Name: AI Measurement Assurance Objective: Assess the adequacy, consistency, and reliability of selected AI risk measurements. Relationship: SUPPORTING

72. `NIST-AIRMF-CTRL-ASSR-004`

Name: AI Evidence Assurance Objective: Assess evidence quality, traceability, currency, and integrity. Relationship: SUPPORTING

73. `NIST-AIRMF-CTRL-ASSR-005`

Name: NIST Framework Readiness Assurance Objective: Assess organizational readiness to demonstrate implementation of selected AI RMF outcomes. Relationship: SUPPORTING This is an AIGO assurance activity and not a NIST certification.

74. Governance Review Controls

`NIST-AIRMF-CTRL-GOVR-001`

Name: AI Risk Management Review Objective: Periodically review AI risk-management performance and material emerging issues. Relationship: SUPPORTING Inputs:

risk trends;
measurement;
incidents;
assurance;
regulatory developments;
stakeholder concerns;
changes.

75. `NIST-AIRMF-CTRL-GOVR-002`

Name: AI Risk Management Improvement Review Objective: Identify improvements to governance, controls, measurement, and risk treatment. Relationship: SUPPORTING / CROSS-CUTTING

76. Improvement Controls

`NIST-AIRMF-CTRL-IMP-001`

Name: AI Risk Corrective Action Objective: Address identified failures, incidents, control weaknesses, and significant risks. Relationship: DIRECT

77. `NIST-AIRMF-CTRL-IMP-002`

Name: AI Risk Continual Improvement Objective: Improve AI governance based on evidence, monitoring, assurance, incidents, and lessons learned. Relationship: DIRECT / CRITICAL

78. `NIST-AIRMF-CTRL-IMP-003`

Name: AI Risk Improvement Effectiveness Objective: Verify that improvement actions achieve their intended results. Relationship: SUPPORTING

79. Retirement Controls

`NIST-AIRMF-CTRL-RET-001`

Name: AI Risk Retirement Governance Objective: Ensure risks associated with retiring AI systems are managed and required records are retained. Relationship: DIRECT / CONDITIONAL

80. `NIST-AIRMF-CTRL-RET-002`

Name: Retirement Lessons Learned Objective: Capture lifecycle lessons from retired AI systems and feed them into future governance. Relationship: SUPPORTING

81. Trustworthiness Control Crosswalk

NIST Characteristic	Primary AIGO Controls
Valid and Reliable	MEA-001, MEA-005, TEST-001, MON-002
Safe	SAFE-001, SAFE-002, INC-001
Secure and Resilient	SEC-001, SEC-002, SEC-003
Accountable and Transparent	GOV-001, GOV-003, TRN-001
Explainable and Interpretable	EXP-001, HUM-001
Privacy-Enhanced	PRIV-001, PRIV-002
Fair with Harmful Bias Managed	FAIR-001, FAIR-002

The relationship is contextual and may require additional controls.

82. NIST Function-to-Control Matrix

Function	Principal AIGO Control Domains
GOVERN	GOV, TPG, EVD, GOVR
MAP	MAP, CTX, STA, IMP, RSK
MEASURE	MEA, TEST, PERF, SAFE, SEC, PRIV, FAIR, EXP, TRN, HUM, MON
MANAGE	MAN, INC, CHG, TPG, IMP, RET

83. NIST Function Interaction

The controls should support iterative movement:

GOVERN
   ↓
MAP
   ↓
MEASURE
   ↓
MANAGE
   ↓
MAP / MEASURE / GOVERN

This is an operational representation, not a mandatory sequence imposed by NIST.

84. Control Applicability

Each control should support:

APPLICABLE
CONDITIONAL
INTEGRATED
NOT_APPLICABLE
PLANNED
SUPERSEDED

Because AI RMF is voluntary and flexible, the organization may apply selected outcomes based on context and risk. The selection rationale should be documented.

85. Control Priority

AIGO may assign:

CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL

Priority should reflect:

potential harm;
system impact;
rights;
safety;
regulatory significance;
risk;
uncertainty.

Priority does not come from NIST as a universal numerical rating.

86. Critical Controls

Controls that may frequently warrant critical treatment include:

NIST-AIRMF-CTRL-GOV-003
NIST-AIRMF-CTRL-GOV-006
NIST-AIRMF-CTRL-MAP-001
NIST-AIRMF-CTRL-MAP-006
NIST-AIRMF-CTRL-MAP-009
NIST-AIRMF-CTRL-MEA-001
NIST-AIRMF-CTRL-TEST-001
NIST-AIRMF-CTRL-MON-001
NIST-AIRMF-CTRL-MAN-001
NIST-AIRMF-CTRL-MAN-003
NIST-AIRMF-CTRL-MAN-006
NIST-AIRMF-CTRL-INC-001
NIST-AIRMF-CTRL-CHG-001
NIST-AIRMF-CTRL-EVD-002
NIST-AIRMF-CTRL-ASSR-002
NIST-AIRMF-CTRL-IMP-002

Actual criticality is organization- and system-dependent.

87. Control Ownership

Each material control should identify:

CONTROL_OWNER
ACCOUNTABLE_OWNER
OPERATIONAL_OWNER
EVIDENCE_OWNER
ASSURANCE_OWNER

Assurance independence should be considered where the same person performs operational control activities.

88. Control Frequency

Possible frequencies:

CONTINUOUS
PER_SYSTEM
PER_CHANGE
PER_TRANSACTION
MONTHLY
QUARTERLY
SEMI_ANNUAL
ANNUAL
EVENT_DRIVEN

The frequency should be risk-based.

89. Control Evidence

Each material control should define expected evidence. Example:

Control:
NIST-AIRMF-CTRL-MAN-003

Evidence:
- Risk treatment plan
- Treatment implementation
- Residual-risk assessment
- Monitoring
- Management decision

90. Control Monitoring

Material controls should have monitoring where appropriate. Example:

Control:
NIST-AIRMF-CTRL-MON-001

Indicators:
- open high-priority risks
- overdue treatments
- emerging risk events
- monitoring exceptions
- reassessment status

91. Control Assurance

The preferred assurance chain is:

Control
 ↓
Evidence
 ↓
Test
 ↓
Finding
 ↓
Corrective Action
 ↓
Verification

92. Control Failure

A control failure should create an appropriate AIGO finding, incident, or improvement record. Example:

Control Failure
 ↓
Risk
 ↓
Incident / Finding
 ↓
Corrective Action
 ↓
Change
 ↓
Retest

93. Exceptions

An exception record should include:

control;
reason;
risk;
authority;
compensating control;
expiry;
review.

Because NIST AI RMF is voluntary, organizations may tailor application. However, once an organization has formally adopted an AIGO/NIST control commitment, the exception should be governed through the organization’s approved process.

94. Cross-Control Dependencies

Key dependencies include:

GOV
 ↓
MAP
 ↓
Risk
 ↓
MEASURE
 ↓
MANAGE
 ↓
MONITOR
 ↓
ASSURANCE
 ↓
IMPROVEMENT

Dependencies should be represented in the registry where practical.

95. Shared-Control Architecture

The same AIGO operational control may support multiple frameworks:

AIGO Control
   ├── NIST AI RMF
   ├── ISO/IEC 42001
   └── EU AI Act

Each relationship remains separate.

96. Shared-Evidence Architecture

A single evidence record may support several mappings where:

system scope matches;
evidence is current;
version is compatible;
criteria are satisfied.

The evidence registry should preserve all relationships.

97. Shared-Assurance Architecture

One assurance activity may support several framework relationships when:

criteria are explicit;
scope is sufficient;
reviewer competence is adequate;
conclusions remain separately traceable.

98. Cross-Framework Conflict Rule

Where NIST, ISO/IEC 42001, and EU AI Act requirements differ:

Framework A Requirement
Framework B Requirement
Framework C Requirement
        ↓
AIGO Shared Control
        ↓
Separate Traceability

The control may implement the most demanding operational approach, but the sources must remain distinct.

99. NIST Playbook Boundary

The NIST AI RMF Playbook provides suggested actions rather than mandatory control requirements. NIST states that it is voluntary, flexible, and not intended to be used as a checklist. Therefore this control mapping should not convert every Playbook action into a mandatory AIGO control. Where the organization voluntarily adopts a Playbook action, the action should be recorded as an implementation choice.

100. Generative AI Profile Boundary

NIST AI 600-1 is a companion Generative AI Profile to AI RMF 1.0. It should be represented as a profile relationship rather than as a replacement for the Core framework. Potential profile relationship:

NIST AI RMF 1.0
      ↓
Generative AI Profile
      ↓
Additional Context-Specific Controls

A future dedicated profile mapping may extend the control set where needed.

101. Future NIST Revision

NIST’s current AI RMF resources indicate that AI RMF 1.0 is being revised. The mapping must therefore preserve version control. The future workflow is:

New NIST Framework
      ↓
Requirement Comparison
      ↓
Control Impact
      ↓
Evidence Impact
      ↓
Assurance Impact
      ↓
Registry Update

Existing AI RMF 1.0 control mappings should remain historically identifiable.

102. Draft NIST Material

Draft or concept material should not silently modify the current control baseline. The registry should identify draft material as:

DRAFT
CONCEPT
FUTURE

rather than: CURRENT_BASELINE.

103. Control Versioning

Each control should preserve:

control ID;
control version;
mapping version;
source framework version;
effective date;
status.

104. Control Review

Controls should be reviewed:

annually;
following NIST framework revisions;
after significant AI-system changes;
after major incidents;
after material assurance findings;
after relevant regulatory changes.

105. Regulatory Integration

Where a NIST control also supports a legal requirement:

NIST Outcome
    ↓
AIGO Control
    ↓
EU AI Act Requirement

the legal relationship must remain separately documented.

106. Management Review

Material NIST control results should feed AIGO Management Review. Potential inputs:

risk trends;
measurement results;
incidents;
assurance findings;
control failures;
emerging technology;
regulatory changes;
NIST framework developments.

107. Improvement

The improvement loop is:

Measurement
 ↓
Risk Management
 ↓
Assurance
 ↓
Finding
 ↓
Improvement
 ↓
Control Change
 ↓
Reassessment

108. Retirement

Controls may be retired when:

superseded;
no longer relevant;
replaced by a more integrated control;
framework relationship is retired.

Historical mapping relationships should remain available.

109. Control Retirement and NIST Revision

When a NIST version is superseded, AIGO should not delete the old mappings. Instead:

AI RMF 1.0 Control Mapping
        ↓
SUPERSEDED
        ↓
AI RMF New-Version Mapping

This preserves auditability and historical traceability.

110. Control Coverage

The Control Coverage Validator should calculate:

NIST Outcomes
      ↓
Mapped Controls
      ↓
Applicable Controls
      ↓
Implemented Controls
      ↓
Control Gaps

111. Evidence Coverage

The Evidence Coverage Validator should calculate:

NIST Outcome
      ↓
Control
      ↓
Evidence Required
      ↓
Evidence Available
      ↓
Evidence Validated

112. Assurance Coverage

The assurance coverage should calculate:

NIST Outcome
      ↓
Control
      ↓
Evidence
      ↓
Assurance Plan
      ↓
Assurance Completed
      ↓
Finding Resolution

113. Traceability Validation

The Traceability Validator should be able to reconstruct:

Function
 ↓
Category
 ↓
Subcategory
 ↓
AIGO Control
 ↓
Evidence
 ↓
Assurance

Broken chains should generate findings.

114. Reference Validation

The Reference Validator should verify:

NIST function IDs;
category identifiers;
control IDs;
schema references;
template references;
related mapping references.

115. Framework Consistency Validation

The Framework Consistency Checker should detect:

duplicate control IDs;
inconsistent terminology;
conflicting NIST versions;
profile/core confusion;
conflicting applicability;
contradictory cross-framework relationships.

116. Document Integrity Validation

The Document Integrity Checker should verify:

file existence;
metadata;
status;
version;
internal references;
required sections.

117. Repository Health

Repository Health should aggregate:

Mapping Coverage
+
Control Coverage
+
Evidence Coverage
+
Assurance Coverage
+
Version Currency
+
Reference Integrity

118. Findings

Potential NIST control-mapping findings include:

NIST_OUTCOME_UNMAPPED
NIST_CONTROL_MISSING
NIST_CONTROL_OWNER_MISSING
NIST_CONTROL_APPLICABILITY_UNRESOLVED
NIST_CONTROL_EVIDENCE_MISSING
NIST_CONTROL_ASSURANCE_MISSING
NIST_CONTROL_DEPENDENCY_BROKEN
NIST_CONTROL_VERSION_CONFLICT
NIST_SOURCE_VERSION_GAP
NIST_PROFILE_MAPPING_GAP
NIST_CROSSFRAMEWORK_MAPPING_GAP

119. Critical Control Findings

Potential critical findings include:

high-impact AI risk has no mapped control;
material risk treatment is absent;
risk monitoring is absent;
critical measurement has no evidence;
incident lessons are not integrated;
material change does not trigger reassessment;
control effectiveness cannot be demonstrated.

120. Control Maturity

AIGO may optionally represent:

— NOT_ESTABLISHED
— INITIAL
— DEFINED
— IMPLEMENTED
— MANAGED
— OPTIMIZED

This is an internal AIGO maturity model, not a NIST maturity scale.

121. Certification Boundary

NIST AI RMF has no NIST certification scheme associated with AI RMF 1.0. Therefore:

AIGO NIST Mapping
       ≠
NIST Certification

AIGO may provide readiness or assurance statements limited to the selected scope and criteria.

122. NIST Framework Source Currency

The mapping should monitor:

AI RMF revisions;
official NIST AI RMF resources;
Playbook changes;
published profiles;
major crosswalks;
relevant NIST technical publications.

NIST’s current AI RMF resource page indicates an update to AI RMF 1.0 is underway.

123. Machine-Readable Control Registry

A future registry record may look conceptually like:

{
  "mappingId": "NIST-AIRMF-CTRL-MAN-003",
  "framework": "NIST AI RMF 1.0",
  "function": "MANAGE",
  "aigoControlId": "AIGO-CTRL-...",
  "relationship": "DIRECT",
  "priority": "CRITICAL",
  "applicability": "CONDITIONAL",
  "evidence": [],
  "assurance": [],
  "status": "MAPPED"
}

The actual machine-readable structure should remain aligned with the existing AIGO Control Schema and NIST mapping registry.

124. Existing AIGO Schema Relationship

Control Area	Primary AIGO Schema
AI System	AI System
Risk	Risk
Control	Control
Assessment	Assessment
Approval	Approval
Monitoring	Monitoring
Incident	Incident
Change	Change
Evidence	Evidence
Assurance	Assurance
Management Review	Management Review
Improvement	Improvement
Retirement	Retirement
Governance	Governance

125. Existing AIGO Template Relationship

Relevant templates include:

AI System Registration;
AI System Profile;
AI Risk Assessment;
AI Approval;
AI Monitoring;
AI Incident;
AI Change Management;
AI Assurance;
AI Management Review;
AI Continuous Improvement;
AI Retirement;
AI Evidence Record.

126. Relationship to NIST Mapping Files

File	Control Mapping Relationship
`01-AIGO-NIST-AI-RMF-Mapping-v0.1.md`	Master framework relationship
`02-AIGO-NIST-AI-RMF-Functions-Mapping-v0.1.md`	Function criteria
`03-AIGO-NIST-AI-RMF-Categories-Mapping-v0.1.md`	Category/subcategory criteria
`04-AIGO-NIST-AI-RMF-Lifecycle-Mapping-v0.1.md`	Lifecycle context
`05-AIGO-NIST-AI-RMF-Risk-Mapping-v0.1.md`	Risk architecture
`06-AIGO-NIST-AI-RMF-Governance-Mapping-v0.1.md`	Governance
`07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md`	Evidence
`08-AIGO-NIST-AI-RMF-Implementation-Mapping-v0.1.md`	Implementation
`09-AIGO-NIST-AI-RMF-Assurance-Mapping-v0.1.md`	Assurance

127. Registry Relationship

The mapping registry should contain:

document references;
NIST functions;
categories;
profiles;
relationships;
control domains;
source version;
validation requirements.

This control mapping should remain consistent with the registry.

128. Release Validation

Before this document is marked validated:

NIST AI RMF Version Verified
NIST Functions Verified
Category References Verified
AIGO Control IDs Verified
Schema References Verified
Template References Verified
Evidence Relationships Defined
Assurance Relationships Defined
Cross-Framework Relationships Checked
Registry Synchronized

129. Package-Level Validation

The complete NIST mapping package should pass:

structural validation;
NIST function coverage;
category coverage;
control coverage;
evidence coverage;
traceability;
assurance coverage;
framework consistency;
document integrity;
repository health.

130. Limitations

This mapping cannot independently establish:

that an organization has implemented the AI RMF;
that all NIST outcomes have been appropriately satisfied;
that AI risks are acceptable;
that measurements are technically adequate in every context;
that an AI system is safe;
that legal requirements are satisfied;
that NIST endorses AIGO.

The actual assurance result depends on system context, selected AI RMF scope, controls, evidence, and review criteria.

131. Final Control Architecture

The complete relationship is:

NIST AI RMF
      ↓
GOVERN / MAP / MEASURE / MANAGE
      ↓
Category
      ↓
Subcategory / Outcome
      ↓
AIGO Governance Objective
      ↓
AIGO Control
      ↓
AIGO Schema
      ↓
AIGO Process
      ↓
Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Finding
      ↓
Corrective Action
      ↓
Continual Improvement

This creates a reusable control layer that can support NIST AI RMF together with ISO/IEC 42001, EU AI Act requirements, and other AIGO mapping packages.

132. Document Control

Field	Value
Document	AIGO NIST AI RMF AIGO Control Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-NIST-AIRMF-010`
Document Type	AI Risk Management Framework Mapping
Primary Framework	NIST AI RMF 1.0
Primary Publication	NIST AI 100-1
Primary Purpose	NIST outcome-to-AIGO-control crosswalk
Owner
Framework Reviewer
Governance Reviewer
Risk Reviewer
Control Reviewer
Evidence Reviewer
Assurance Reviewer
Framework Architect
Approved By
Effective Date
Next Review Date

133. Document Status

Document: AIGO — NIST AI RMF AIGO Control Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-NIST-AIRMF-010 Document Type: AI Risk Management Framework Mapping This document establishes the detailed NIST AI RMF-to-AIGO control crosswalk, connecting GOVERN, MAP, MEASURE, and MANAGE outcomes to reusable AIGO controls, evidence, monitoring, assurance, incident management, change management, risk treatment, and continual improvement while preserving the voluntary status of NIST AI RMF 1.0 and the distinction between the core framework, profiles, implementation guidance, and binding legal requirements. End of Document

​AIGO — NIST AI RMF AIGO Control Mapping

​1. Document Purpose

​2. Mapping Information

​3. Control-Mapping Principle

​4. NIST AI RMF Functions

​5. Control Relationship Types

​DIRECT

​PARTIAL

​SUPPORTING

​INTEGRATED

​CONDITIONAL

​CROSS_REFERENCE

​DERIVED

​NO_DIRECT_EQUIVALENT

​6. Control Status

​7. Control Identifier Convention

​8. Control Domains

​9. GOVERN — Policy and Governance

​NIST-AIRMF-CTRL-GOV-001

​10. NIST-AIRMF-CTRL-GOV-002

​11. NIST-AIRMF-CTRL-GOV-003

​12. NIST-AIRMF-CTRL-GOV-004

​13. NIST-AIRMF-CTRL-GOV-005

​14. NIST-AIRMF-CTRL-GOV-006

​15. NIST-AIRMF-CTRL-GOV-007

​16. NIST-AIRMF-CTRL-GOV-008

​17. MAP — AI System Context

​NIST-AIRMF-CTRL-MAP-001

​18. NIST-AIRMF-CTRL-MAP-002

​19. NIST-AIRMF-CTRL-MAP-003

​20. NIST-AIRMF-CTRL-MAP-004

​21. NIST-AIRMF-CTRL-MAP-005

​22. NIST-AIRMF-CTRL-MAP-006

​23. NIST-AIRMF-CTRL-MAP-007

​24. NIST-AIRMF-CTRL-MAP-008

​25. MAP — Risk Identification

​NIST-AIRMF-CTRL-MAP-009

​26. NIST-AIRMF-CTRL-MAP-010

​27. MEASURE — Measurement Governance

​NIST-AIRMF-CTRL-MEA-001

​28. NIST-AIRMF-CTRL-MEA-002

​29. NIST-AIRMF-CTRL-MEA-003

​30. NIST-AIRMF-CTRL-MEA-004

​31. MEASURE — Validity and Reliability

​NIST-AIRMF-CTRL-MEA-005

​32. MEASURE — Safety

​NIST-AIRMF-CTRL-SAFE-001

​33. NIST-AIRMF-CTRL-SAFE-002

​34. MEASURE — Security

​NIST-AIRMF-CTRL-SEC-001

​35. NIST-AIRMF-CTRL-SEC-002

​36. NIST-AIRMF-CTRL-SEC-003

​37. MEASURE — Privacy

​NIST-AIRMF-CTRL-PRIV-001

​38. NIST-AIRMF-CTRL-PRIV-002

​39. MEASURE — Fairness and Bias

​NIST-AIRMF-CTRL-FAIR-001

​40. NIST-AIRMF-CTRL-FAIR-002

​41. MEASURE — Explainability and Interpretability

​NIST-AIRMF-CTRL-EXP-001

​42. MEASURE — Transparency

​NIST-AIRMF-CTRL-TRN-001

​43. MEASURE — Human Factors

​NIST-AIRMF-CTRL-HUM-001

​44. NIST-AIRMF-CTRL-HUM-002

​45. MEASURE — Testing and Evaluation

​NIST-AIRMF-CTRL-TEST-001

​46. NIST-AIRMF-CTRL-TEST-002

​47. NIST-AIRMF-CTRL-TEST-003

​48. MEASURE — Monitoring

​NIST-AIRMF-CTRL-MON-001

​49. NIST-AIRMF-CTRL-MON-002

​50. NIST-AIRMF-CTRL-MON-003

​51. MANAGE — Risk Prioritization

​NIST-AIRMF-CTRL-MAN-001

​52. NIST-AIRMF-CTRL-MAN-002

​53. NIST-AIRMF-CTRL-MAN-003

​54. NIST-AIRMF-CTRL-MAN-004

​55. NIST-AIRMF-CTRL-MAN-005

​56. MANAGE — Deployment Decisions