How do CISOs use the NIST AI Risk Management Framework?

CISOs use the NIST AI Risk Management Framework as a voluntary operating model for AI risk, organizing work under four functions, Govern, Map, Measure and Manage, and plugging security requirements into each. NIST released AI RMF 1.0 on January 26, 2023, and added a Generative AI Profile, NIST AI 600-1, on July 26, 2024.

The framework is meant for any organization that designs, develops, deploys or uses AI, and nothing in it is mandatory. That makes it a vocabulary a security team can share with data science, legal and procurement rather than a compliance checklist imposed from outside.

What do the four functions cover?

Govern builds the policies, accountability and culture for AI risk; Map establishes the context of each system; Measure tests and tracks the risks found; Manage allocates resources to treat them and to respond when things go wrong. NIST treats governance as cross-cutting, so it informs the other three rather than coming first and stopping.

Under Govern, the first category asks that policies, processes and practices for mapping, measuring and managing AI risks be in place, transparent and implemented effectively.

Map is where a team decides whether a system should exist at all. NIST says that after completing it, users should know enough about impacts to make an initial go or no-go decision on designing, developing or deploying the system.

Measure covers testing. The framework says AI systems should be tested before deployment and regularly while in operation, and that independent review can improve testing and reduce internal bias and conflicts of interest.

Manage is the function a security operations team will recognize. Its risk treatment comprises plans to respond to, recover from and communicate about incidents or events.

Where does security fit inside the framework?

Security appears throughout the categories rather than in one place: supply chain under Govern and Map, security testing under Measure, and incident response under Manage. A CISO can claim ownership of those subcategories and leave fairness or societal impact work to the teams better placed to do it.

Govern 6 calls for policies on AI risks from third-party software, data and other supply chain issues, and Map 4 asks that risks be mapped for every component of a system, third-party pieces included.

Measure 2.7 is the explicit hook for red teams: it asks that AI system security and resilience be evaluated and documented. Under Manage 3, pre-trained models used in development must be monitored as part of regular maintenance.

Manage 4 requires documented and regularly monitored risk treatments, including response, recovery and communication plans. Manage 4.1 lists post-deployment monitoring mechanisms that include incident response, recovery, change management and decommissioning.

What does the Generative AI Profile add?

The Generative AI Profile applies the framework to generative systems, centering on a list of 12 risks and just over 200 suggested actions. One of those risks is a lowered barrier to entry for cybersecurity attacks, alongside harmful content and confabulated output.

For each risk the profile gives a matrix of mitigating actions mapped back to the AI RMF, so a team can file generative AI controls under the same four functions it already uses.

The profile was written under Executive Order 14110, which has since been revoked, yet NIST still lists it on its framework page. Security leaders can keep using it; its origin does not change its technical content.

Is the framework changing?

Yes. NIST states on its framework page that AI RMF 1.0 is being revised as part of the White House AI Action Plan, and on April 7, 2026 it published a concept note for a profile aimed at critical infrastructure operators.

A parallel effort sits closer to the security team. On December 16, 2025 NIST released a preliminary draft Cyber AI Profile built on Cybersecurity Framework 2.0, covering the security of AI systems, AI-enabled defense and AI-enabled attacks, and said it planned an initial public draft in 2026.

How should a CISO start using it?

Begin with Govern: name who owns AI risk decisions and write the policy that Govern 1 describes. Next, run Map on the handful of AI systems with the most sensitive data or the most automated authority, and record third-party components as Map 4 asks.

Then turn Measure 2.7 into a standing test plan, with red-team exercises before release and at a set interval afterward, and fold AI scenarios into existing incident runbooks to satisfy Manage 4. Teams already mapped to Cybersecurity Framework 2.0 should watch the Cyber AI Profile, which NIST says will provide mappings to other NIST resources, the AI RMF among them.

Revisit the mapping once NIST publishes the revised framework.