Toolkit
NIST AI RMF readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation designing, developing, deploying, evaluating or using AI systems that wants a voluntary, flexible way to manage AI risk — including teams not ready for a certifiable standard.
Scope
- Non-sector-specific and use-case agnostic — suits a small team experimenting with AI as well as a large enterprise
- Entirely voluntary: no conformity assessment and no certification, though policy or contracts may reference it
- A Generative AI Profile (NIST AI 600-1) adds risks specific to generative AI
Key requirements
- Establish governance: policies, accountable roles and a stated risk tolerance for AI (Govern)
- Map context for each AI system: its purpose, users, benefits and potential impacts (Map)
- Choose measures: quantitative and qualitative methods to assess and monitor trustworthiness (Measure)
- Manage: prioritise, respond to and communicate about the risks that were mapped and measured (Manage)
- Balance the seven trustworthy-AI characteristics against each other rather than treating them as a checklist: valid/reliable, safe, secure/resilient, accountable/transparent, explainable, privacy-enhanced, and fair
- Build a current profile and a target profile, and revisit them as systems and context change
Evidence to gather
- AI system inventory with owners and intended uses
- Context and impact documentation from the Map function
- Test, evaluation, verification and validation plans and results, including red-teaming where relevant
- Risk registers and treatment decisions
- Monitoring records, incident logs and decommissioning decisions
- Records of stakeholder engagement and feedback
Common gaps
- Treating the subcategories as mandatory controls rather than outcomes to consider
- Measuring before mapping, which tends to measure the wrong things
- Treating it only as a security framework when it also covers fairness, explainability and privacy
- A one-off assessment that goes stale instead of a repeated Map-Measure-Manage cycle
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full NIST AI RMF guide, the official text, or a qualified adviser.