NIST AI RMF Audit Learning Framework

📋 AI System Lifecycle

🔬

Plan & Design

Phase 1

🛠️

Develop & Train

Phase 2

🧪

Evaluate & Verify

Phase 3

🚀

Deploy & Use

Phase 4

📊

Monitor & Maintain

Phase 5

🔄

Retire & Decommission

Phase 6

🔷 The Four Core Functions

🏛️ GOVERN

Cultivates organizational culture and policies for AI risk management. Establishes accountability, roles, processes, and transparency across all other functions. It is the foundation — all other functions are informed by GOVERN.

GOVERN 1 · Policies GOVERN 2 · Accountability GOVERN 3 · DEIA GOVERN 4 · Culture GOVERN 5 · Stakeholders GOVERN 6 · Supply Chain

🗺️ MAP

Establishes context for AI system risks. Identifies intended uses, stakeholders, potential harms, and environmental factors. Contextual discovery enables meaningful risk identification and framing before assessment begins.

MAP 1 · Context MAP 2 · Stakeholders MAP 3 · Harms MAP 4 · Benefits MAP 5 · Impacts

📐 MEASURE

Quantifies and qualifies identified AI risks using metrics, benchmarks, and testing methods. Evaluates performance, fairness, safety, and security through structured TEVV (Test, Evaluate, Verify, Validate) activities.

MEASURE 1 · Methods MEASURE 2 · Testing MEASURE 3 · Tracking MEASURE 4 · Feedback

⚙️ MANAGE

Implements controls and mitigation strategies for prioritized AI risks. Plans responses, monitors outcomes, and drives continuous improvement. Includes incident response, decommissioning, and ongoing operational risk oversight.

MANAGE 1 · Prioritize MANAGE 2 · Strategies MANAGE 3 · Responses MANAGE 4 · Monitoring

✅ Trustworthy AI Characteristics (NIST AI 100-1, Part 1)

✔️

Valid & Reliable

The AI system performs accurately for its intended purpose and functions consistently under expected operating conditions. This is the foundation for all other trustworthy characteristics.

🛡️

Safe

The system does not, under defined conditions, cause physical, digital, psychological, financial, or societal harm to people or the environment. Safety is the primary risk consideration.

🔒

Secure & Resilient

Protected against malicious manipulation and unauthorized access (security) and capable of withstanding or recovering from adverse events, disruptions, or attacks (resilience).

📢

Accountable & Transparent

Responsibility for system outcomes is clearly assigned to appropriate actors (accountability). Adequate information about the system is disclosed to relevant stakeholders (transparency).

💡

Explainable & Interpretable

System outputs and the underlying reasoning are understandable to humans. Explainability supports informed decision-making and meaningful human oversight of AI systems.

🔐

Privacy-Enhanced

Protections for personal and sensitive data are embedded throughout the AI system lifecycle, from design through decommissioning, consistent with applicable privacy laws and regulations.

⚖️

Fair with Bias Managed

Outputs are equitable and efforts are made to identify, assess, and mitigate unjustified disparate impacts, discrimination, or harmful bias across groups and individuals.

🏛️

Core Function

GOVERN

Cultivates a culture of risk management. Establishes organizational policies, processes, accountability structures, and transparency practices. GOVERN is a cross-cutting function that underpins and informs all other RMF functions throughout the AI lifecycle.

🗺️

Core Function

MAP

Identifies and contextualizes AI risks. Involves understanding the system's intended purpose, stakeholders, deployment environment, and potential failure modes or harms. MAP enables meaningful risk framing and prioritization for downstream assessment.

📐

Core Function

MEASURE

Evaluates and analyzes AI risks using quantitative and qualitative methods. Focuses on Test, Evaluate, Verify, and Validate (TEVV) activities covering performance, fairness, safety, and security metrics, enabling evidence-based risk decisions.

⚙️

Core Function

MANAGE

Prioritizes and acts on AI risks identified during MAP and MEASURE phases. Implements controls, mitigation strategies, and incident response plans. Drives continuous improvement through monitoring, feedback loops, and decommissioning processes.

🧠

Knowledge Assessment

Test your understanding of NIST AI RMF concepts and audit procedures

📝 25 Questions ⏱️ ~15 min 🎯 All 4 Functions 📚 NIST AI 100-1

--

of 25

--

GOVERN

--

MAP

--

MEASURE

Score: 0 / 0