NIST AI RMF
Organize risk work around the four AI RMF functions: GOVERN, MAP, MEASURE, and MANAGE. The NIST AI RMF is voluntary; select the practices that fit your organization’s context.
VeriProof provides supporting records for selected practices. Your organization defines the profile, methods, owners, decisions, and acceptance criteria.
Evidence mapping
| Function | Supporting VeriProof records |
|---|---|
| GOVERN | Roles, policies, ownership, assignments, and decision history |
| MAP | Application context, use, risk fields, dependencies, and affected workflow records |
| MEASURE | Session evidence, configured measures, evaluations, trends, and evidence gaps |
| MANAGE | Exceptions, assigned work, decisions, remediation, and follow-up history |
The mapping identifies where product evidence may support a practice. It does not show that the practice is complete or effective.
Review a function
- Select the applications and review period.
- Confirm the applicable AI RMF profile and practice.
- Review the mapped records and their provenance.
- Record missing, partial, or out-of-scope evidence.
- Add customer-owned policies, risk analysis, decisions, and approvals.
Verify record integrity
Use the evidence manifest and configured proof provider to check exported content. Integrity verification does not measure AI trustworthiness or control effectiveness.
Related guidance
Last updated on