NIST AI RMF Deep Dive : Making it Work for Your Organization

Govern: The Foundation Everything Else Rests On

Governance is the underlying "base" that makes the other three functions possible. Without solid governance, Map, Measure, and Manage become inconsistent, ad hoc exercises that vary based on who's doing the work.

Governance under the NIST AI RMF means establishing organizational policies, procedures, and accountability structures for AI risk management. Specifically: legal and regulatory requirements involving AI must be understood and documented (Govern 1.1); the characteristics of trustworthy AI must be integrated into organizational policies (Govern 1.2); there must be processes to determine the appropriate level of risk management activity based on risk tolerance (Govern 1.3); AI systems must be inventoried and that inventory maintained (Govern 1.6); and there must be defined processes for safely decommissioning AI systems (Govern 1.7).

From a TPRM perspective, Governance also means establishing roles and responsibilities for evaluating AI risk in your vendor ecosystem, and ensuring those responsibilities are clearly understood across the organization.

Map: Building the Risk Picture

The Map function is about identifying and prioritizing AI risks by gathering diverse perspectives, internal teams, external stakeholders, end users, and affected parties. The goal is a comprehensive, risk-ranked inventory of AI risks associated with each system or vendor.

Map asks: What is this AI system designed to do? Who are the stakeholders affected? What are the potential harms to individuals, the organization, and the broader ecosystem? What is the likelihood and magnitude of each harm?

Measure: Turning Risk into Data

Measure takes the risks identified through Map and applies analytical rigor to them. This includes testing AI systems before deployment and monitoring them continuously in operation. Risk tracking should integrate into the enterprise risk register, not exist in a siloed AI-specific spreadsheet.

This function also encompasses the seven characteristics of trustworthy AI that NIST identifies: validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy enhancement, and fairness with bias managed.

Manage: Responding to Risk

Manage is where the four standard risk response options (Avoidance, Reduction, Transfer, and Acceptance) are applied to the identified and measured AI risks. High risks may warrant avoidance. Controllable risks can be reduced through compensating controls. Insurance can transfer residual risk. Low risks may be accepted, but must be tracked in the risk register with defined re-evaluation dates.

Coming up next: Integrating AI risk into your TPRM governance and oversight phase.