NIST AI RMF 1.0 · NIST AI 600-1

AI RMF Manager

Build, evidence, and defend an AI governance posture against the NIST AI Risk Management Framework — with the honesty to show exactly where you stand.

72 subcategory outcomes · 12 generative-AI risks · OSCAL-aligned reports

How it works · lifecycle

From scope to a defensible demonstration

Scope
Define a Profile and inventory each AI system — purpose, data, human oversight, impact tier.
Map
Map the framework subcategories to reusable Controls and attach Evidence that tracks its freshness.
Measure
Record TEVV metrics and seed the 12-category generative-AI risk register, per system.
Manage
Treat risks through the operations layer; scheduled checks flag what is slipping before it bites.
Demonstrate
Score readiness, clear the go/no-go gate, and freeze hash-stamped, OSCAL-aligned reports.

Capabilities

What is inside

AI System Inventory
Each system is a first-class record: purpose, data sources, human-oversight model, and impact tier.
Controls & Evidence
Reusable controls mapped to the framework, with evidence that tracks its own freshness.
GAI Risk Register
All 12 generative-AI risk categories, seeded per system, each carrying a treatment plan.
Metrics / TEVV
Structured measurement with an honesty guard — no named evaluation dataset, no green status.
Readiness & Reports
Two-lens scoring, a go/no-go gate, and immutable, OSCAL-aligned assessor packets.
Multi-tenant & secure
Strict per-tenant isolation, role-based access, multi-factor auth, and signed backups.

Design principle

Honest about where you stand

The AI RMF is voluntary — there is no certification to earn. So the tool is built to stay honest: a claim cannot read as Evidenced without fresh evidence behind it, a metric with no evaluation dataset cannot show green, and every score carries a watermark. An inflated posture is worse than an honest one when someone finally checks.