Blog Post
Four Questions That Make the NIST AI RMF Defensive
August 31, 2026
Explanations of the four functions in the NIST AI risk management framework are abundant and mostly accurate. Govern establishes accountability, Map identifies context and risk, Measure assesses and tracks, Manage prioritizes and treats. Read three of them and you will know what each function contains.
None of that tells you whether a system is defended, and the framework does not claim to. It is voluntary and deliberately non-prescriptive, so every function can be fully satisfied by an organization that gets breached next week. Turning it into something defensive is a matter of which question you ask inside each function.
Every Function Has a Documentary Answer and a Defensive One
The framework's subcategories are written as outcomes rather than instructions, which is what makes it adaptable and also what allows a program to satisfy them on paper. Each function accepts a documentary answer that is genuinely compliant and tells you nothing about exposure.
Govern accepts a policy document, an accountability matrix and a stated risk tolerance. Map accepts a documented context and a risk register. Measure accepts defined metrics and a test report. Manage accepts a prioritized treatment plan. Four artifacts, all real work, none of which constrains what happens when something goes wrong.
Govern: Not Whether a Policy Exists, But Who Can Stop Something
The documentary version of Govern produces a policy, a committee and an assigned owner per system. The defensive question is narrower and considerably harder. Who holds authority to halt a deployment, and has anyone ever exercised it.
An accountability structure where every reviewer can raise a concern and nobody can block a release satisfies the subcategories and functions as advisory. Recording refusals, and recording overrides where the business proceeded anyway, is what turns the governance function into evidence rather than organizational description. Accountability for a system's decisions is where that authority either exists or does not.
Risk Tolerance Needs a Number
The framework asks for risk tolerances to be established and does not specify a unit, so most programs state them qualitatively. A tolerance expressed as low appetite for unauthorized data disclosure cannot be breached, so it cannot be monitored. Expressed as a figure it becomes a threshold, and the difference decides whether Govern produces a control or a sentiment.
Map: Not What the Risks Are, But What the System Can Reach
Map asks for context to be established and risks identified, which is where most programs produce a list of concerns organized by category. The defensive version enumerates capability instead of concern.
Which systems, data stores and interfaces the AI system can reach. Which of its available actions cannot be undone. Whose identity it acts under. Those are facts rather than assessments, they bound what any failure can produce regardless of cause, and they are the inputs a serious incident response needs. A risk list describing prompt injection as a concern is Map satisfied. A list of what the system could do once injected is Map made useful, and treating injection as a standing condition follows from the second.
Pair Map With an Adversarial Taxonomy
The framework deliberately does not supply a threat list, so a program relying on it alone maps the risks its own team thought of. Running Map against a published adversarial taxonomy produces coverage the internal exercise misses, and the taxonomy categories become paths to a loss event rather than register entries in their own right, which chains of agents make more important as the estate grows.
Measure: Not What You Tested, But What You Would Not Have Caught
Measure invites a test report, and a test report describes behavior on tested inputs. The defensive question inverts it and asks what the testing would have missed.
Three sub-questions make it concrete. Whether anything was tested that the system was not expected to handle, since testing the expected cases confirms the design rather than probing it. Whether the model version and date are recorded against each result, because a passing result describes one version on one day. Whether the same suite has been re-run after a provider changed the model completes it, since that is the moment a previously blocked technique can start working.
Measure Is Where Programs Score Worst
Assessments against the framework consistently show Measure and Manage weaker than Govern and Map, which follows from what each demands. Govern and Map are largely establishing things once. Measure and Manage require doing something repeatedly, and repeated work decays without a trigger. Periodic testing is precisely the interval this weakness lives in.
Manage: Not Whether It Is Planned, But What the Delay Costs
Manage asks for risks to be prioritized and treated, and a prioritized plan satisfies it. The defensive question is what the organization is paying while each item sits on that plan.
An item ranked third on a treatment plan has an exposure accruing until it is closed, and expressing that as a monthly figure changes both the ordering and the argument for resourcing. It also converts an accepted risk from a status into a decision with a price, which is the form that survives a later question about why something waited. Pricing the interval rather than the fix is the mechanism.
Severity Bands Cannot Produce an Order
Forty items rated high provide no sequence, so Manage performed with severity ratings alone produces a plan whose order was set by whoever argued most persuasively. Ranking by the exposure each item removes gives the same plan a defensible sequence, and gives a reviewer something to disagree with on specifics rather than on judgment.
Build a Profile Before Working the Functions
The framework supports use-case profiles and almost nobody builds one, which is the largest single missed opportunity in how it gets applied.
A profile states which subcategories apply to a specific system type and what evidence satisfies each. Without one, a program answers all subcategories generically for every system, which produces volume rather than coverage and makes the result impossible to check. With one, a customer-facing agent and an internal summarization tool are assessed against different subsets, and the difference is defensible because somebody decided it in advance. The framework is explicit that it is meant to be tailored, and tailoring is the step usually skipped.
Current and Target Profiles Make Movement Visible
Recording where a system stands now against where it should be turns an assessment into a shortfall list with an owner. It also means the next assessment measures movement rather than repeating the exercise, which is the difference between an annual document and a program.
What the Framework Cannot Do
Two limits are worth naming because programs expect the framework to cover them and it does not.
- It Does Not Supply Thresholds: No subcategory tells you how much residual risk is acceptable, which remains an organizational decision.
- It Does Not Discharge Obligations: Alignment evidences diligence and satisfies no statutory requirement on its own.
The second matters increasingly, since some regulatory regimes reference adherence to a recognized risk management framework in safe harbor provisions without treating it as compliance. Building to the framework and building to an applicable regulation are overlapping exercises rather than one exercise, which the absence of cited standards makes more consequential rather than less.
The Framework Is a Set of Questions
Every function in the framework accepts an answer that is compliant and inert. Govern accepts a policy where the defensive question is who can halt a release. Map accepts a risk list where the question is what the system can reach. Measure accepts a test report where the question is what testing would have missed. Manage accepts a plan where the question is what the delay costs. Tailoring through a profile, and expressing tolerance and treatment in a unit that can be breached and compared, is what separates a program that could defend a system from one that could describe it. Kovrr's AI Security and Governance Platform assesses against the framework while attaching exposure figures to each finding, which is what makes the Manage function produce a sequence.
To see a framework assessment where each finding carries the loss it represents, book a demo mapped to your own estate.
NIST AI RMF FAQs
Speak to an ExpertWhy isn't the NIST AI RMF enough to defend a system?
What is the defensive question inside Govern?
How should Map be done differently?
What makes Measure useful rather than documentary?
Why do programs score worst on Measure and Manage?
What is a use-case profile and why does it matter?
Does framework alignment satisfy regulatory obligations?
