> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 10 AIGO NIST AI RMF AIGO Control Mapping v0.1

# AIGO — NIST AI RMF AIGO Control Mapping

## 1. Document Purpose

This document establishes the detailed control-level mapping between the **NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0** and the AIGO AI Governance Operating Framework.

NIST AI RMF 1.0, identified by NIST as **NIST AI 100-1**, was published on 26 January 2023. NIST describes the framework as voluntary, flexible, rights-preserving, non-sector-specific, and use-case agnostic.

The purpose of this document is to translate NIST AI RMF functions, categories, and subcategory-level outcomes into reusable AIGO controls while maintaining a clear distinction between:

* NIST framework content;
* NIST implementation guidance;
* AIGO controls;
* organizational procedures;
* evidence;
* assurance; and
* applicable legal requirements.

This document is an operational AIGO crosswalk. It does not constitute NIST endorsement, NIST certification, legal compliance, or an independent assurance opinion.

***

# 2. Mapping Information

| Field               | Value                                            |
| ------------------- | ------------------------------------------------ |
| Mapping             | AIGO NIST AI RMF AIGO Control Mapping            |
| Version             | 0.1                                              |
| Status              | Draft                                            |
| Document Identifier | `AIGO-MAP-NIST-AIRMF-010`                        |
| Document Type       | AI Risk Management Framework Mapping             |
| Mapping Package     | `AIGO-MAP-NIST-AIRMF`                            |
| Primary Framework   | NIST AI RMF 1.0                                  |
| Primary Publication | NIST AI 100-1                                    |
| Publication Date    | 26 January 2023                                  |
| Primary Function    | NIST outcome-to-AIGO-control crosswalk           |
| Architecture        | `AIGO-MAP-NIST-AIRMF-ARCH-001`                   |
| Registry            | `00-AIGO-NIST-AI-RMF-Mapping-Registry-v0.1.json` |

***

# 3. Control-Mapping Principle

The control architecture is:

```text id="8lvmc6" theme={null}
NIST AI RMF
      ↓
Function
      ↓
Category
      ↓
Subcategory / Outcome
      ↓
AIGO Governance Objective
      ↓
AIGO Control
      ↓
AIGO Process
      ↓
Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Improvement
```

AIGO controls operationalize governance outcomes. They do not alter the meaning of the NIST framework.

***

# 4. NIST AI RMF Functions

The mapping must preserve the four AI RMF Core functions:

```text id="d7p47q" theme={null}
GOVERN
MAP
MEASURE
MANAGE
```

NIST describes these as an iterative core rather than a mandatory linear sequence.

***

# 5. Control Relationship Types

The mapping registry shall support:

```text id="4t0wxa" theme={null}
DIRECT
PARTIAL
SUPPORTING
INTEGRATED
CONDITIONAL
CROSS_REFERENCE
DERIVED
NO_DIRECT_EQUIVALENT
```

### DIRECT

The AIGO control directly operationalizes the mapped NIST outcome.

### PARTIAL

The control addresses only a portion of the outcome.

### SUPPORTING

The control supports implementation but does not independently cover the outcome.

### INTEGRATED

Multiple AIGO controls collectively address the outcome.

### CONDITIONAL

The control applies only under defined context or risk conditions.

### CROSS\_REFERENCE

An existing AIGO control or artifact is authoritative.

### DERIVED

The relationship is derived from another controlled mapping.

### NO\_DIRECT\_EQUIVALENT

The outcome requires an organizational activity for which no dedicated AIGO control currently exists.

***

# 6. Control Status

AIGO control status shall distinguish:

```text id="s8xb5z" theme={null}
MAPPED
DEFINED
IMPLEMENTED
PARTIALLY_IMPLEMENTED
EVIDENCED
MEASURED
MANAGED
ASSESSED
MONITORED
ASSURED
SUPERSEDED
RETIRED
```

These are operational AIGO statuses and are not NIST certification statuses.

***

# 7. Control Identifier Convention

Recommended relationship identifiers:

```text id="4fnwra" theme={null}
NIST-AIRMF-CTRL-<DOMAIN>-<SEQUENCE>
```

Examples:

```text id="inmy22" theme={null}
NIST-AIRMF-CTRL-GOV-001
NIST-AIRMF-CTRL-MAP-001
NIST-AIRMF-CTRL-MEA-001
NIST-AIRMF-CTRL-MAN-001
```

Where a control already exists in the AIGO Control Schema, the authoritative AIGO control identifier should be referenced rather than creating a duplicate operational control.

***

# 8. Control Domains

The initial mapping domains are:

```text id="ndw8gd" theme={null}
GOV     GOVERN
MAP     MAP
MEA     MEASURE
MAN     MANAGE
CTX     Context
STA     Stakeholders
RSK     Risk
IMP     Impact
DATA    Data
TEST    Testing
PERF    Performance
SAFE    Safety
SEC     Security
PRIV    Privacy
FAIR    Fairness / Bias
EXP     Explainability / Interpretability
TRN     Transparency
HUM     Human Oversight
EVD     Evidence
MON     Monitoring
INC     Incident
CHG     Change
TPG     Third-Party Governance
ASSR    Assurance
GOVR    Governance Review
RET     Retirement
```

***

# 9. GOVERN — Policy and Governance

## `NIST-AIRMF-CTRL-GOV-001`

**Name:** AI Risk Governance

**Objective:** Establish governance structures, accountability, and oversight for AI risk management.

**Mapped Function:** `GOVERN`

**Relationship:** `DIRECT`

**AIGO Components:**

* Governance;
* Management Review;
* Risk;
* Control;
* Assurance.

**Activities:**

* establish governance;
* assign accountability;
* define decision authority;
* establish escalation;
* monitor governance effectiveness;
* review governance changes.

**Evidence:**

* governance charter;
* role assignments;
* governance decisions;
* management-review records.

***

# 10. `NIST-AIRMF-CTRL-GOV-002`

**Name:** AI Governance Policy

**Objective:** Establish and maintain policies governing AI risk management.

**Mapped Areas:**

* GOVERN;
* policy-related governance outcomes.

**Relationship:** `DIRECT`

**Evidence:**

* AI policy;
* policy approval;
* version history;
* communication.

***

# 11. `NIST-AIRMF-CTRL-GOV-003`

**Name:** AI Governance Accountability

**Objective:** Assign accountable owners for material AI risks, systems, and governance outcomes.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* identify accountable owner;
* establish authority;
* define responsibility;
* maintain delegation;
* review accountability after change.

***

# 12. `NIST-AIRMF-CTRL-GOV-004`

**Name:** AI Governance Resource Management

**Objective:** Ensure resources are available to execute AI risk-management activities.

**Relationship:** `SUPPORTING`

**Resources may include:**

* personnel;
* technical infrastructure;
* evaluation capability;
* monitoring;
* assurance;
* security;
* incident response.

***

# 13. `NIST-AIRMF-CTRL-GOV-005`

**Name:** AI Risk Culture and Escalation

**Objective:** Promote an organizational environment in which AI risks can be identified, challenged, escalated, and addressed.

**Relationship:** `SUPPORTING`

**Evidence:**

* escalation records;
* governance training;
* incident reporting;
* management decisions;
* lessons learned.

***

# 14. `NIST-AIRMF-CTRL-GOV-006`

**Name:** Legal and Regulatory Requirements Register

**Objective:** Identify and maintain applicable legal, regulatory, standards, contractual, and organizational requirements relevant to AI risk.

**Relationship:** `DIRECT / CROSS-CUTTING`

**Activities:**

* identify source;
* assess applicability;
* map requirement;
* assign owner;
* monitor change;
* update controls.

This control supports NIST GOVERN outcomes concerning understanding and documenting legal and regulatory requirements.

***

# 15. `NIST-AIRMF-CTRL-GOV-007`

**Name:** AI Governance Competence

**Objective:** Ensure people performing AI risk-management activities possess appropriate competence.

**Relationship:** `DIRECT`

**Evidence:**

* competence profiles;
* training;
* qualifications;
* experience;
* assessments.

***

# 16. `NIST-AIRMF-CTRL-GOV-008`

**Name:** AI Governance Communication

**Objective:** Govern internal and external communication relevant to AI risk.

**Relationship:** `DIRECT`

***

# 17. MAP — AI System Context

## `NIST-AIRMF-CTRL-MAP-001`

**Name:** AI System Context Definition

**Objective:** Define the organizational, technical, operational, legal, and societal context relevant to an AI system.

**Mapped Function:** `MAP`

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* AI System Profile;
* context assessment;
* deployment environment;
* system dependencies;
* stakeholder analysis.

***

# 18. `NIST-AIRMF-CTRL-MAP-002`

**Name:** Intended Purpose Governance

**Objective:** Ensure the intended purpose and expected use of an AI system are documented and current.

**Relationship:** `DIRECT`

**Evidence:**

* intended-purpose statement;
* use-case definition;
* approved system profile.

***

# 19. `NIST-AIRMF-CTRL-MAP-003`

**Name:** AI System Boundary and Dependency Mapping

**Objective:** Identify system boundaries, interfaces, dependencies, external services, datasets, models, and infrastructure.

**Relationship:** `DIRECT`

**Evidence:**

* architecture;
* dependency inventory;
* supply-chain record;
* system map.

***

# 20. `NIST-AIRMF-CTRL-MAP-004`

**Name:** Stakeholder Identification

**Objective:** Identify relevant stakeholders and their interests, expectations, concerns, and possible impacts.

**Relationship:** `DIRECT`

**Evidence:**

* stakeholder register;
* consultations;
* governance records;
* requirements.

***

# 21. `NIST-AIRMF-CTRL-MAP-005`

**Name:** Affected-Person Identification

**Objective:** Identify individuals and groups that may be directly or indirectly affected by an AI system.

**Relationship:** `DIRECT / CONDITIONAL`

**Evidence:**

* affected-person analysis;
* impact assessment;
* user research;
* rights assessment.

***

# 22. `NIST-AIRMF-CTRL-MAP-006`

**Name:** AI Impact Assessment

**Objective:** Identify and evaluate potential impacts associated with AI-system use.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* identify impacts;
* assess severity;
* assess likelihood;
* identify affected groups;
* determine mitigation;
* document residual impact.

***

# 23. `NIST-AIRMF-CTRL-MAP-007`

**Name:** AI Lifecycle Context Assessment

**Objective:** Maintain awareness of how risk and impact context changes across the AI lifecycle.

**Relationship:** `INTEGRATED`

**Lifecycle:**

```text id="t7k49k" theme={null}
Design
 ↓
Development
 ↓
Testing
 ↓
Deployment
 ↓
Operation
 ↓
Change
 ↓
Retirement
```

***

# 24. `NIST-AIRMF-CTRL-MAP-008`

**Name:** Supply-Chain Context Assessment

**Objective:** Identify risks introduced by third-party models, datasets, software, infrastructure, and services.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 25. MAP — Risk Identification

## `NIST-AIRMF-CTRL-MAP-009`

**Name:** AI Risk Identification

**Objective:** Identify risks associated with an AI system, its context, and lifecycle.

**Relationship:** `DIRECT / CRITICAL`

**Risk domains may include:**

* safety;
* security;
* privacy;
* fairness;
* bias;
* reliability;
* robustness;
* explainability;
* transparency;
* operational;
* legal;
* social;
* reputational.

***

# 26. `NIST-AIRMF-CTRL-MAP-010`

**Name:** Risk Interdependency Mapping

**Objective:** Identify relationships among AI risks, controls, systems, stakeholders, and organizational objectives.

**Relationship:** `SUPPORTING`

***

# 27. MEASURE — Measurement Governance

## `NIST-AIRMF-CTRL-MEA-001`

**Name:** AI Risk Measurement Governance

**Objective:** Define measurement objectives, methods, metrics, thresholds, and evidence requirements for material AI risks.

**Mapped Function:** `MEASURE`

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* measurement plan;
* metrics;
* methodology;
* test records;
* results.

***

# 28. `NIST-AIRMF-CTRL-MEA-002`

**Name:** AI Evaluation Planning

**Objective:** Establish appropriate evaluation activities for identified AI risks and trustworthiness characteristics.

**Relationship:** `DIRECT`

**Activities:**

* define evaluation objective;
* define criteria;
* select method;
* identify data;
* identify system version;
* define reviewer.

***

# 29. `NIST-AIRMF-CTRL-MEA-003`

**Name:** Measurement Method Control

**Objective:** Ensure material measurements use documented and appropriate methods.

**Relationship:** `DIRECT`

**Evidence:**

* methodology;
* assumptions;
* test environment;
* data;
* calculation;
* limitations.

***

# 30. `NIST-AIRMF-CTRL-MEA-004`

**Name:** Measurement Data Quality

**Objective:** Ensure measurement results rely on sufficiently reliable data.

**Relationship:** `SUPPORTING`

**Activities:**

* source validation;
* completeness checks;
* representativeness;
* data quality;
* lineage.

***

# 31. MEASURE — Validity and Reliability

## `NIST-AIRMF-CTRL-MEA-005`

**Name:** AI Validity and Reliability Assessment

**Objective:** Assess whether the AI system performs as intended and whether measured results are sufficiently reliable for their intended use.

**Relationship:** `DIRECT`

**Evidence:**

* performance tests;
* validation;
* benchmarks;
* reliability analysis;
* limitations.

***

# 32. MEASURE — Safety

## `NIST-AIRMF-CTRL-SAFE-001`

**Name:** AI Safety Evaluation

**Objective:** Identify and evaluate safety risks associated with AI-system operation.

**Relationship:** `DIRECT / CONDITIONAL`

**Activities:**

* hazard analysis;
* failure modes;
* safety tests;
* safeguards;
* incident analysis.

***

# 33. `NIST-AIRMF-CTRL-SAFE-002`

**Name:** AI Safety Monitoring

**Objective:** Monitor safety performance after deployment.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 34. MEASURE — Security

## `NIST-AIRMF-CTRL-SEC-001`

**Name:** AI Security Risk Assessment

**Objective:** Assess security risks affecting AI systems, models, data, infrastructure, and dependencies.

**Relationship:** `DIRECT`

***

# 35. `NIST-AIRMF-CTRL-SEC-002`

**Name:** AI Security Testing

**Objective:** Conduct appropriate cybersecurity and adversarial testing.

**Relationship:** `DIRECT / CONDITIONAL`

**Evidence:**

* threat model;
* vulnerability assessment;
* penetration testing;
* adversarial testing;
* remediation.

***

# 36. `NIST-AIRMF-CTRL-SEC-003`

**Name:** AI Resilience and Recovery

**Objective:** Maintain resilience and recovery capability for material AI-system failures or attacks.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 37. MEASURE — Privacy

## `NIST-AIRMF-CTRL-PRIV-001`

**Name:** AI Privacy Risk Assessment

**Objective:** Identify and evaluate privacy risks arising from AI-system data and operation.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 38. `NIST-AIRMF-CTRL-PRIV-002`

**Name:** AI Privacy Control Assessment

**Objective:** Evaluate the effectiveness of controls addressing AI-related privacy risks.

**Relationship:** `SUPPORTING`

***

# 39. MEASURE — Fairness and Bias

## `NIST-AIRMF-CTRL-FAIR-001`

**Name:** AI Fairness Assessment

**Objective:** Evaluate fairness-related risks and harmful bias in AI-system outcomes and processes.

**Relationship:** `DIRECT / CONDITIONAL`

**Evidence:**

* fairness assessment;
* subgroup analysis;
* bias analysis;
* mitigation;
* retesting.

***

# 40. `NIST-AIRMF-CTRL-FAIR-002`

**Name:** Harmful-Bias Monitoring

**Objective:** Monitor material bias indicators throughout the operational lifecycle.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 41. MEASURE — Explainability and Interpretability

## `NIST-AIRMF-CTRL-EXP-001`

**Name:** AI Explainability and Interpretability Assessment

**Objective:** Evaluate whether system behavior can be understood to the extent appropriate for the context and intended use.

**Relationship:** `DIRECT / CONDITIONAL`

**Evidence:**

* explanation methods;
* interpretability tests;
* user evaluations;
* limitations.

***

# 42. MEASURE — Transparency

## `NIST-AIRMF-CTRL-TRN-001`

**Name:** AI Transparency Assessment

**Objective:** Assess whether relevant information about AI systems, limitations, risks, and operation is appropriately available.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 43. MEASURE — Human Factors

## `NIST-AIRMF-CTRL-HUM-001`

**Name:** Human Oversight Assessment

**Objective:** Assess whether humans have appropriate information, authority, capability, and opportunity to oversee AI-system operation where required.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 44. `NIST-AIRMF-CTRL-HUM-002`

**Name:** Human-AI Interaction Assessment

**Objective:** Evaluate whether human interaction with AI systems creates material risks requiring mitigation.

**Relationship:** `SUPPORTING`

***

# 45. MEASURE — Testing and Evaluation

## `NIST-AIRMF-CTRL-TEST-001`

**Name:** AI Test Governance

**Objective:** Establish controlled testing throughout the AI lifecycle.

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* test plans;
* test datasets;
* test results;
* exceptions;
* approvals;
* version.

***

# 46. `NIST-AIRMF-CTRL-TEST-002`

**Name:** Independent AI Evaluation

**Objective:** Use sufficiently independent evaluation where risk, impact, or governance requirements justify it.

**Relationship:** `SUPPORTING / CONDITIONAL`

***

# 47. `NIST-AIRMF-CTRL-TEST-003`

**Name:** Evaluation Limitation Governance

**Objective:** Ensure limitations, assumptions, uncertainty, and unresolved gaps are documented.

**Relationship:** `DIRECT`

***

# 48. MEASURE — Monitoring

## `NIST-AIRMF-CTRL-MON-001`

**Name:** AI Risk Monitoring

**Objective:** Continuously or periodically monitor material AI risks according to system context and risk.

**Relationship:** `DIRECT / CRITICAL`

***

# 49. `NIST-AIRMF-CTRL-MON-002`

**Name:** AI Performance Monitoring

**Objective:** Monitor material performance and trustworthiness indicators after deployment.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 50. `NIST-AIRMF-CTRL-MON-003`

**Name:** AI Monitoring Thresholds and Escalation

**Objective:** Establish thresholds and escalation paths for significant deterioration or emerging risks.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 51. MANAGE — Risk Prioritization

## `NIST-AIRMF-CTRL-MAN-001`

**Name:** AI Risk Prioritization

**Objective:** Prioritize AI risks using contextually appropriate criteria.

**Mapped Function:** `MANAGE`

**Relationship:** `DIRECT / CRITICAL`

**Factors may include:**

* severity;
* likelihood;
* uncertainty;
* affected population;
* safety;
* rights;
* business impact;
* resource constraints.

***

# 52. `NIST-AIRMF-CTRL-MAN-002`

**Name:** Risk Treatment Planning

**Objective:** Establish risk responses and assign responsible owners.

**Relationship:** `DIRECT`

***

# 53. `NIST-AIRMF-CTRL-MAN-003`

**Name:** Risk Response Governance

**Objective:** Ensure selected risk responses are implemented, documented, monitored, and reassessed.

**Relationship:** `DIRECT / CRITICAL`

***

# 54. `NIST-AIRMF-CTRL-MAN-004`

**Name:** Residual-Risk Governance

**Objective:** Document and manage residual risk after treatment.

**Relationship:** `DIRECT`

**Evidence:**

* post-treatment assessment;
* residual risk;
* decision;
* approval;
* monitoring.

***

# 55. `NIST-AIRMF-CTRL-MAN-005`

**Name:** Risk Acceptance Governance

**Objective:** Control risk acceptance decisions where organizational policy and applicable law permit acceptance.

**Relationship:** `CONDITIONAL`

A risk acceptance process cannot authorize activity prohibited by applicable law.

***

# 56. MANAGE — Deployment Decisions

## `NIST-AIRMF-CTRL-MAN-006`

**Name:** AI Deployment Decision Gate

**Objective:** Ensure deployment decisions consider intended purpose, risk, measurement results, controls, unresolved issues, and accountability.

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* approval;
* risk assessment;
* testing;
* residual-risk decision;
* conditions.

***

# 57. `NIST-AIRMF-CTRL-MAN-007`

**Name:** AI Continuation Decision

**Objective:** Periodically evaluate whether an AI system should continue operating.

**Relationship:** `DIRECT / CONDITIONAL`

Potential outcomes:

```text id="1aw951" theme={null}
CONTINUE
CONTINUE_WITH_CONDITIONS
RESTRICT
REMEDIATE
SUSPEND
RETIRE
```

***

# 58. MANAGE — Incident Management

## `NIST-AIRMF-CTRL-INC-001`

**Name:** AI Risk Incident Management

**Objective:** Identify, manage, investigate, and learn from AI-related incidents.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* detection;
* classification;
* containment;
* investigation;
* notification analysis;
* recovery;
* corrective action.

***

# 59. `NIST-AIRMF-CTRL-INC-002`

**Name:** AI Incident Learning

**Objective:** Ensure incident lessons feed MAP, MEASURE, MANAGE, and governance activities.

**Relationship:** `INTEGRATED`

```text id="8iymmo" theme={null}
Incident
 ↓
Root Cause
 ↓
Risk Update
 ↓
Control Update
 ↓
Measurement Update
 ↓
Improvement
```

***

# 60. MANAGE — Change

## `NIST-AIRMF-CTRL-CHG-001`

**Name:** AI Risk Change Assessment

**Objective:** Determine whether changes affect AI risks, measurements, controls, or governance.

**Relationship:** `DIRECT / CRITICAL`

***

# 61. `NIST-AIRMF-CTRL-CHG-002`

**Name:** AI Change Approval

**Objective:** Ensure material AI changes are authorized before implementation.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 62. `NIST-AIRMF-CTRL-CHG-003`

**Name:** Post-Change Reassessment

**Objective:** Reassess material AI risks and trustworthiness characteristics following change.

**Relationship:** `DIRECT`

***

# 63. MANAGE — Third-Party Risk

## `NIST-AIRMF-CTRL-TPG-001`

**Name:** AI Third-Party Risk Governance

**Objective:** Identify and manage AI risks associated with suppliers and externally provided AI components.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 64. `NIST-AIRMF-CTRL-TPG-002`

**Name:** Third-Party AI Evidence Governance

**Objective:** Ensure supplier claims, testing, security evidence, documentation, and relevant assurances are appropriately reviewed.

**Relationship:** `SUPPORTING`

***

# 65. Cross-Cutting Evidence Controls

## `NIST-AIRMF-CTRL-EVD-001`

**Name:** NIST AI RMF Evidence Management

**Objective:** Maintain reliable evidence demonstrating implementation of selected AI RMF outcomes.

**Relationship:** `SUPPORTING / CROSS-CUTTING`

***

# 66. `NIST-AIRMF-CTRL-EVD-002`

**Name:** AI Risk Traceability

**Objective:** Maintain:

```text id="0xgkzp" theme={null}
NIST Outcome
 ↓
AIGO Control
 ↓
Evidence
 ↓
Measurement
 ↓
Management Decision
```

**Relationship:** `SUPPORTING / CRITICAL`

***

# 67. `NIST-AIRMF-CTRL-EVD-003`

**Name:** AI Evidence Version Governance

**Objective:** Associate evidence with AI-system, model, control, and mapping versions.

**Relationship:** `SUPPORTING`

***

# 68. `NIST-AIRMF-CTRL-EVD-004`

**Name:** AI Evidence Integrity

**Objective:** Protect material evidence against unauthorized modification or loss.

**Relationship:** `SUPPORTING`

***

# 69. Assurance Controls

## `NIST-AIRMF-CTRL-ASSR-001`

**Name:** NIST AI RMF Governance Assurance

**Objective:** Evaluate whether selected governance outcomes are appropriately implemented and evidenced.

**Relationship:** `SUPPORTING / CROSS-CUTTING`

***

# 70. `NIST-AIRMF-CTRL-ASSR-002`

**Name:** AI Risk-Control Effectiveness Assurance

**Objective:** Evaluate whether selected controls are appropriately designed, implemented, and operating effectively.

**Relationship:** `SUPPORTING / CRITICAL`

***

# 71. `NIST-AIRMF-CTRL-ASSR-003`

**Name:** AI Measurement Assurance

**Objective:** Assess the adequacy, consistency, and reliability of selected AI risk measurements.

**Relationship:** `SUPPORTING`

***

# 72. `NIST-AIRMF-CTRL-ASSR-004`

**Name:** AI Evidence Assurance

**Objective:** Assess evidence quality, traceability, currency, and integrity.

**Relationship:** `SUPPORTING`

***

# 73. `NIST-AIRMF-CTRL-ASSR-005`

**Name:** NIST Framework Readiness Assurance

**Objective:** Assess organizational readiness to demonstrate implementation of selected AI RMF outcomes.

**Relationship:** `SUPPORTING`

This is an AIGO assurance activity and not a NIST certification.

***

# 74. Governance Review Controls

## `NIST-AIRMF-CTRL-GOVR-001`

**Name:** AI Risk Management Review

**Objective:** Periodically review AI risk-management performance and material emerging issues.

**Relationship:** `SUPPORTING`

**Inputs:**

* risk trends;
* measurement;
* incidents;
* assurance;
* regulatory developments;
* stakeholder concerns;
* changes.

***

# 75. `NIST-AIRMF-CTRL-GOVR-002`

**Name:** AI Risk Management Improvement Review

**Objective:** Identify improvements to governance, controls, measurement, and risk treatment.

**Relationship:** `SUPPORTING / CROSS-CUTTING`

***

# 76. Improvement Controls

## `NIST-AIRMF-CTRL-IMP-001`

**Name:** AI Risk Corrective Action

**Objective:** Address identified failures, incidents, control weaknesses, and significant risks.

**Relationship:** `DIRECT`

***

# 77. `NIST-AIRMF-CTRL-IMP-002`

**Name:** AI Risk Continual Improvement

**Objective:** Improve AI governance based on evidence, monitoring, assurance, incidents, and lessons learned.

**Relationship:** `DIRECT / CRITICAL`

***

# 78. `NIST-AIRMF-CTRL-IMP-003`

**Name:** AI Risk Improvement Effectiveness

**Objective:** Verify that improvement actions achieve their intended results.

**Relationship:** `SUPPORTING`

***

# 79. Retirement Controls

## `NIST-AIRMF-CTRL-RET-001`

**Name:** AI Risk Retirement Governance

**Objective:** Ensure risks associated with retiring AI systems are managed and required records are retained.

**Relationship:** `DIRECT / CONDITIONAL`

***

# 80. `NIST-AIRMF-CTRL-RET-002`

**Name:** Retirement Lessons Learned

**Objective:** Capture lifecycle lessons from retired AI systems and feed them into future governance.

**Relationship:** `SUPPORTING`

***

# 81. Trustworthiness Control Crosswalk

| NIST Characteristic            | Primary AIGO Controls               |
| ------------------------------ | ----------------------------------- |
| Valid and Reliable             | MEA-001, MEA-005, TEST-001, MON-002 |
| Safe                           | SAFE-001, SAFE-002, INC-001         |
| Secure and Resilient           | SEC-001, SEC-002, SEC-003           |
| Accountable and Transparent    | GOV-001, GOV-003, TRN-001           |
| Explainable and Interpretable  | EXP-001, HUM-001                    |
| Privacy-Enhanced               | PRIV-001, PRIV-002                  |
| Fair with Harmful Bias Managed | FAIR-001, FAIR-002                  |

The relationship is contextual and may require additional controls.

***

# 82. NIST Function-to-Control Matrix

| Function | Principal AIGO Control Domains                             |
| -------- | ---------------------------------------------------------- |
| GOVERN   | GOV, TPG, EVD, GOVR                                        |
| MAP      | MAP, CTX, STA, IMP, RSK                                    |
| MEASURE  | MEA, TEST, PERF, SAFE, SEC, PRIV, FAIR, EXP, TRN, HUM, MON |
| MANAGE   | MAN, INC, CHG, TPG, IMP, RET                               |

***

# 83. NIST Function Interaction

The controls should support iterative movement:

```text id="m1knpv" theme={null}
GOVERN
   ↓
MAP
   ↓
MEASURE
   ↓
MANAGE
   ↓
MAP / MEASURE / GOVERN
```

This is an operational representation, not a mandatory sequence imposed by NIST.

***

# 84. Control Applicability

Each control should support:

```text id="t64z8p" theme={null}
APPLICABLE
CONDITIONAL
INTEGRATED
NOT_APPLICABLE
PLANNED
SUPERSEDED
```

Because AI RMF is voluntary and flexible, the organization may apply selected outcomes based on context and risk.

The selection rationale should be documented.

***

# 85. Control Priority

AIGO may assign:

```text id="x6oi0m" theme={null}
CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL
```

Priority should reflect:

* potential harm;
* system impact;
* rights;
* safety;
* regulatory significance;
* risk;
* uncertainty.

Priority does not come from NIST as a universal numerical rating.

***

# 86. Critical Controls

Controls that may frequently warrant critical treatment include:

```text id="vxrq5k" theme={null}
NIST-AIRMF-CTRL-GOV-003
NIST-AIRMF-CTRL-GOV-006
NIST-AIRMF-CTRL-MAP-001
NIST-AIRMF-CTRL-MAP-006
NIST-AIRMF-CTRL-MAP-009
NIST-AIRMF-CTRL-MEA-001
NIST-AIRMF-CTRL-TEST-001
NIST-AIRMF-CTRL-MON-001
NIST-AIRMF-CTRL-MAN-001
NIST-AIRMF-CTRL-MAN-003
NIST-AIRMF-CTRL-MAN-006
NIST-AIRMF-CTRL-INC-001
NIST-AIRMF-CTRL-CHG-001
NIST-AIRMF-CTRL-EVD-002
NIST-AIRMF-CTRL-ASSR-002
NIST-AIRMF-CTRL-IMP-002
```

Actual criticality is organization- and system-dependent.

***

# 87. Control Ownership

Each material control should identify:

```text id="s8nz22" theme={null}
CONTROL_OWNER
ACCOUNTABLE_OWNER
OPERATIONAL_OWNER
EVIDENCE_OWNER
ASSURANCE_OWNER
```

Assurance independence should be considered where the same person performs operational control activities.

***

# 88. Control Frequency

Possible frequencies:

```text id="9d1vq4" theme={null}
CONTINUOUS
PER_SYSTEM
PER_CHANGE
PER_TRANSACTION
MONTHLY
QUARTERLY
SEMI_ANNUAL
ANNUAL
EVENT_DRIVEN
```

The frequency should be risk-based.

***

# 89. Control Evidence

Each material control should define expected evidence.

Example:

```text id="2o6h6c" theme={null}
Control:
NIST-AIRMF-CTRL-MAN-003

Evidence:
- Risk treatment plan
- Treatment implementation
- Residual-risk assessment
- Monitoring
- Management decision
```

***

# 90. Control Monitoring

Material controls should have monitoring where appropriate.

Example:

```text id="3vfz7e" theme={null}
Control:
NIST-AIRMF-CTRL-MON-001

Indicators:
- open high-priority risks
- overdue treatments
- emerging risk events
- monitoring exceptions
- reassessment status
```

***

# 91. Control Assurance

The preferred assurance chain is:

```text id="o5l7x7" theme={null}
Control
 ↓
Evidence
 ↓
Test
 ↓
Finding
 ↓
Corrective Action
 ↓
Verification
```

***

# 92. Control Failure

A control failure should create an appropriate AIGO finding, incident, or improvement record.

Example:

```text id="9q4mks" theme={null}
Control Failure
 ↓
Risk
 ↓
Incident / Finding
 ↓
Corrective Action
 ↓
Change
 ↓
Retest
```

***

# 93. Exceptions

An exception record should include:

* control;
* reason;
* risk;
* authority;
* compensating control;
* expiry;
* review.

Because NIST AI RMF is voluntary, organizations may tailor application. However, once an organization has formally adopted an AIGO/NIST control commitment, the exception should be governed through the organization's approved process.

***

# 94. Cross-Control Dependencies

Key dependencies include:

```text id="1a4jhm" theme={null}
GOV
 ↓
MAP
 ↓
Risk
 ↓
MEASURE
 ↓
MANAGE
 ↓
MONITOR
 ↓
ASSURANCE
 ↓
IMPROVEMENT
```

Dependencies should be represented in the registry where practical.

***

# 95. Shared-Control Architecture

The same AIGO operational control may support multiple frameworks:

```text id="w2l4r4" theme={null}
AIGO Control
   ├── NIST AI RMF
   ├── ISO/IEC 42001
   └── EU AI Act
```

Each relationship remains separate.

***

# 96. Shared-Evidence Architecture

A single evidence record may support several mappings where:

* system scope matches;
* evidence is current;
* version is compatible;
* criteria are satisfied.

The evidence registry should preserve all relationships.

***

# 97. Shared-Assurance Architecture

One assurance activity may support several framework relationships when:

* criteria are explicit;
* scope is sufficient;
* reviewer competence is adequate;
* conclusions remain separately traceable.

***

# 98. Cross-Framework Conflict Rule

Where NIST, ISO/IEC 42001, and EU AI Act requirements differ:

```text id="7uyt1y" theme={null}
Framework A Requirement
Framework B Requirement
Framework C Requirement
        ↓
AIGO Shared Control
        ↓
Separate Traceability
```

The control may implement the most demanding operational approach, but the sources must remain distinct.

***

# 99. NIST Playbook Boundary

The NIST AI RMF Playbook provides suggested actions rather than mandatory control requirements. NIST states that it is voluntary, flexible, and not intended to be used as a checklist.

Therefore this control mapping should not convert every Playbook action into a mandatory AIGO control.

Where the organization voluntarily adopts a Playbook action, the action should be recorded as an implementation choice.

***

# 100. Generative AI Profile Boundary

NIST AI 600-1 is a companion Generative AI Profile to AI RMF 1.0. It should be represented as a profile relationship rather than as a replacement for the Core framework.

Potential profile relationship:

```text id="8j16ie" theme={null}
NIST AI RMF 1.0
      ↓
Generative AI Profile
      ↓
Additional Context-Specific Controls
```

A future dedicated profile mapping may extend the control set where needed.

***

# 101. Future NIST Revision

NIST's current AI RMF resources indicate that AI RMF 1.0 is being revised. The mapping must therefore preserve version control.

The future workflow is:

```text id="7c9hbs" theme={null}
New NIST Framework
      ↓
Requirement Comparison
      ↓
Control Impact
      ↓
Evidence Impact
      ↓
Assurance Impact
      ↓
Registry Update
```

Existing AI RMF 1.0 control mappings should remain historically identifiable.

***

# 102. Draft NIST Material

Draft or concept material should not silently modify the current control baseline.

The registry should identify draft material as:

```text id="faig4k" theme={null}
DRAFT
CONCEPT
FUTURE
```

rather than:

`CURRENT_BASELINE`.

***

# 103. Control Versioning

Each control should preserve:

* control ID;
* control version;
* mapping version;
* source framework version;
* effective date;
* status.

***

# 104. Control Review

Controls should be reviewed:

* annually;
* following NIST framework revisions;
* after significant AI-system changes;
* after major incidents;
* after material assurance findings;
* after relevant regulatory changes.

***

# 105. Regulatory Integration

Where a NIST control also supports a legal requirement:

```text id="t1l4cz" theme={null}
NIST Outcome
    ↓
AIGO Control
    ↓
EU AI Act Requirement
```

the legal relationship must remain separately documented.

***

# 106. Management Review

Material NIST control results should feed AIGO Management Review.

Potential inputs:

* risk trends;
* measurement results;
* incidents;
* assurance findings;
* control failures;
* emerging technology;
* regulatory changes;
* NIST framework developments.

***

# 107. Improvement

The improvement loop is:

```text id="2qsm8p" theme={null}
Measurement
 ↓
Risk Management
 ↓
Assurance
 ↓
Finding
 ↓
Improvement
 ↓
Control Change
 ↓
Reassessment
```

***

# 108. Retirement

Controls may be retired when:

* superseded;
* no longer relevant;
* replaced by a more integrated control;
* framework relationship is retired.

Historical mapping relationships should remain available.

***

# 109. Control Retirement and NIST Revision

When a NIST version is superseded, AIGO should not delete the old mappings.

Instead:

```text id="w74xoy" theme={null}
AI RMF 1.0 Control Mapping
        ↓
SUPERSEDED
        ↓
AI RMF New-Version Mapping
```

This preserves auditability and historical traceability.

***

# 110. Control Coverage

The Control Coverage Validator should calculate:

```text id="o3esn6" theme={null}
NIST Outcomes
      ↓
Mapped Controls
      ↓
Applicable Controls
      ↓
Implemented Controls
      ↓
Control Gaps
```

***

# 111. Evidence Coverage

The Evidence Coverage Validator should calculate:

```text id="lvd7zz" theme={null}
NIST Outcome
      ↓
Control
      ↓
Evidence Required
      ↓
Evidence Available
      ↓
Evidence Validated
```

***

# 112. Assurance Coverage

The assurance coverage should calculate:

```text id="h8pasy" theme={null}
NIST Outcome
      ↓
Control
      ↓
Evidence
      ↓
Assurance Plan
      ↓
Assurance Completed
      ↓
Finding Resolution
```

***

# 113. Traceability Validation

The Traceability Validator should be able to reconstruct:

```text id="r99g8p" theme={null}
Function
 ↓
Category
 ↓
Subcategory
 ↓
AIGO Control
 ↓
Evidence
 ↓
Assurance
```

Broken chains should generate findings.

***

# 114. Reference Validation

The Reference Validator should verify:

* NIST function IDs;
* category identifiers;
* control IDs;
* schema references;
* template references;
* related mapping references.

***

# 115. Framework Consistency Validation

The Framework Consistency Checker should detect:

* duplicate control IDs;
* inconsistent terminology;
* conflicting NIST versions;
* profile/core confusion;
* conflicting applicability;
* contradictory cross-framework relationships.

***

# 116. Document Integrity Validation

The Document Integrity Checker should verify:

* file existence;
* metadata;
* status;
* version;
* internal references;
* required sections.

***

# 117. Repository Health

Repository Health should aggregate:

```text id="u6y3cp" theme={null}
Mapping Coverage
+
Control Coverage
+
Evidence Coverage
+
Assurance Coverage
+
Version Currency
+
Reference Integrity
```

***

# 118. Findings

Potential NIST control-mapping findings include:

```text id="s0c2or" theme={null}
NIST_OUTCOME_UNMAPPED
NIST_CONTROL_MISSING
NIST_CONTROL_OWNER_MISSING
NIST_CONTROL_APPLICABILITY_UNRESOLVED
NIST_CONTROL_EVIDENCE_MISSING
NIST_CONTROL_ASSURANCE_MISSING
NIST_CONTROL_DEPENDENCY_BROKEN
NIST_CONTROL_VERSION_CONFLICT
NIST_SOURCE_VERSION_GAP
NIST_PROFILE_MAPPING_GAP
NIST_CROSSFRAMEWORK_MAPPING_GAP
```

***

# 119. Critical Control Findings

Potential critical findings include:

* high-impact AI risk has no mapped control;
* material risk treatment is absent;
* risk monitoring is absent;
* critical measurement has no evidence;
* incident lessons are not integrated;
* material change does not trigger reassessment;
* control effectiveness cannot be demonstrated.

***

# 120. Control Maturity

AIGO may optionally represent:

```text id="cpl9yz" theme={null}
0 — NOT_ESTABLISHED
1 — INITIAL
2 — DEFINED
3 — IMPLEMENTED
4 — MANAGED
5 — OPTIMIZED
```

This is an internal AIGO maturity model, not a NIST maturity scale.

***

# 121. Certification Boundary

NIST AI RMF has no NIST certification scheme associated with AI RMF 1.0.

Therefore:

```text id="qku2ht" theme={null}
AIGO NIST Mapping
       ≠
NIST Certification
```

AIGO may provide readiness or assurance statements limited to the selected scope and criteria.

***

# 122. NIST Framework Source Currency

The mapping should monitor:

* AI RMF revisions;
* official NIST AI RMF resources;
* Playbook changes;
* published profiles;
* major crosswalks;
* relevant NIST technical publications.

NIST's current AI RMF resource page indicates an update to AI RMF 1.0 is underway.

***

# 123. Machine-Readable Control Registry

A future registry record may look conceptually like:

```json id="1dszjv" theme={null}
{
  "mappingId": "NIST-AIRMF-CTRL-MAN-003",
  "framework": "NIST AI RMF 1.0",
  "function": "MANAGE",
  "aigoControlId": "AIGO-CTRL-...",
  "relationship": "DIRECT",
  "priority": "CRITICAL",
  "applicability": "CONDITIONAL",
  "evidence": [],
  "assurance": [],
  "status": "MAPPED"
}
```

The actual machine-readable structure should remain aligned with the existing AIGO Control Schema and NIST mapping registry.

***

# 124. Existing AIGO Schema Relationship

| Control Area      | Primary AIGO Schema |
| ----------------- | ------------------- |
| AI System         | AI System           |
| Risk              | Risk                |
| Control           | Control             |
| Assessment        | Assessment          |
| Approval          | Approval            |
| Monitoring        | Monitoring          |
| Incident          | Incident            |
| Change            | Change              |
| Evidence          | Evidence            |
| Assurance         | Assurance           |
| Management Review | Management Review   |
| Improvement       | Improvement         |
| Retirement        | Retirement          |
| Governance        | Governance          |

***

# 125. Existing AIGO Template Relationship

Relevant templates include:

* AI System Registration;
* AI System Profile;
* AI Risk Assessment;
* AI Approval;
* AI Monitoring;
* AI Incident;
* AI Change Management;
* AI Assurance;
* AI Management Review;
* AI Continuous Improvement;
* AI Retirement;
* AI Evidence Record.

***

# 126. Relationship to NIST Mapping Files

| File                                                 | Control Mapping Relationship  |
| ---------------------------------------------------- | ----------------------------- |
| `01-AIGO-NIST-AI-RMF-Mapping-v0.1.md`                | Master framework relationship |
| `02-AIGO-NIST-AI-RMF-Functions-Mapping-v0.1.md`      | Function criteria             |
| `03-AIGO-NIST-AI-RMF-Categories-Mapping-v0.1.md`     | Category/subcategory criteria |
| `04-AIGO-NIST-AI-RMF-Lifecycle-Mapping-v0.1.md`      | Lifecycle context             |
| `05-AIGO-NIST-AI-RMF-Risk-Mapping-v0.1.md`           | Risk architecture             |
| `06-AIGO-NIST-AI-RMF-Governance-Mapping-v0.1.md`     | Governance                    |
| `07-AIGO-NIST-AI-RMF-Evidence-Mapping-v0.1.md`       | Evidence                      |
| `08-AIGO-NIST-AI-RMF-Implementation-Mapping-v0.1.md` | Implementation                |
| `09-AIGO-NIST-AI-RMF-Assurance-Mapping-v0.1.md`      | Assurance                     |

***

# 127. Registry Relationship

The mapping registry should contain:

* document references;
* NIST functions;
* categories;
* profiles;
* relationships;
* control domains;
* source version;
* validation requirements.

This control mapping should remain consistent with the registry.

***

# 128. Release Validation

Before this document is marked validated:

```text id="w0m0e1" theme={null}
NIST AI RMF Version Verified
NIST Functions Verified
Category References Verified
AIGO Control IDs Verified
Schema References Verified
Template References Verified
Evidence Relationships Defined
Assurance Relationships Defined
Cross-Framework Relationships Checked
Registry Synchronized
```

***

# 129. Package-Level Validation

The complete NIST mapping package should pass:

* structural validation;
* NIST function coverage;
* category coverage;
* control coverage;
* evidence coverage;
* traceability;
* assurance coverage;
* framework consistency;
* document integrity;
* repository health.

***

# 130. Limitations

This mapping cannot independently establish:

* that an organization has implemented the AI RMF;
* that all NIST outcomes have been appropriately satisfied;
* that AI risks are acceptable;
* that measurements are technically adequate in every context;
* that an AI system is safe;
* that legal requirements are satisfied;
* that NIST endorses AIGO.

The actual assurance result depends on system context, selected AI RMF scope, controls, evidence, and review criteria.

***

# 131. Final Control Architecture

The complete relationship is:

```text id="q5ffix" theme={null}
NIST AI RMF
      ↓
GOVERN / MAP / MEASURE / MANAGE
      ↓
Category
      ↓
Subcategory / Outcome
      ↓
AIGO Governance Objective
      ↓
AIGO Control
      ↓
AIGO Schema
      ↓
AIGO Process
      ↓
Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Finding
      ↓
Corrective Action
      ↓
Continual Improvement
```

This creates a reusable control layer that can support NIST AI RMF together with ISO/IEC 42001, EU AI Act requirements, and other AIGO mapping packages.

***

# 132. Document Control

| Field               | Value                                  |
| ------------------- | -------------------------------------- |
| Document            | AIGO NIST AI RMF AIGO Control Mapping  |
| Version             | 0.1                                    |
| Status              | Draft                                  |
| Document Identifier | `AIGO-MAP-NIST-AIRMF-010`              |
| Document Type       | AI Risk Management Framework Mapping   |
| Primary Framework   | NIST AI RMF 1.0                        |
| Primary Publication | NIST AI 100-1                          |
| Primary Purpose     | NIST outcome-to-AIGO-control crosswalk |
| Owner               |                                        |
| Framework Reviewer  |                                        |
| Governance Reviewer |                                        |
| Risk Reviewer       |                                        |
| Control Reviewer    |                                        |
| Evidence Reviewer   |                                        |
| Assurance Reviewer  |                                        |
| Framework Architect |                                        |
| Approved By         |                                        |
| Effective Date      |                                        |
| Next Review Date    |                                        |

***

# 133. Document Status

**Document:** AIGO — NIST AI RMF AIGO Control Mapping

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-MAP-NIST-AIRMF-010`

**Document Type:** AI Risk Management Framework Mapping

This document establishes the detailed NIST AI RMF-to-AIGO control crosswalk, connecting GOVERN, MAP, MEASURE, and MANAGE outcomes to reusable AIGO controls, evidence, monitoring, assurance, incident management, change management, risk treatment, and continual improvement while preserving the voluntary status of NIST AI RMF 1.0 and the distinction between the core framework, profiles, implementation guidance, and binding legal requirements.

End of Document