NIST AI RMF
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework published by the US National Institute of Standards and Technology for managing risks associated with AI systems across the full lifecycle.
How the NIST AI RMF Is Structured
The framework organizes AI risk management around four functions: Govern (establishing culture, structures, and processes for AI risk management), Map (identifying context and risks), Measure (assessing and analyzing risks), and Manage (allocating resources and responding to identified risks).
The Govern function is treated as foundational, applying continuously across the other three. This mirrors the elevation of Govern in NIST CSF 2.0, reflecting the shared view that governance underpins effective risk management.
Why NIST AI RMF Matters
Despite being voluntary, the NIST AI RMF has become a de facto reference standard in the United States. The Colorado AI Act (SB 205) draws on it explicitly. Federal agencies reference it in guidance. Enterprise customers and cyber insurers increasingly expect alignment with it.
See AI regulations and frameworks: preparing for compliance and resilience.
NIST AI RMF and Other Frameworks
The NIST AI RMF, ISO/IEC 42001, and the EU AI Act overlap heavily in concept while differing in specifics. Organizations building AI programs typically align to one primary framework and map their program to the others where required. NIST AI RMF is often chosen as the primary reference by US-based organizations because of its regulatory adoption.
How Kovrr Approaches NIST AI RMF
Kovrr's AI Security and Governance Platform operationalizes NIST AI RMF functions across discovered AI assets, mapping controls to the Govern, Map, Measure, and Manage functions and producing evidence for each.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
