Roadmap to NIST AI RMF & NIST AI 600-1 Conformance - DRAFT
Playbook Version: 0.1.11 | Last Reviewed: April 2026 Frameworks: NIST AI RMF 1.0 (Jan 2023) · NIST AI 600-1 GenAI Profile (Jul 2024)
Overview
Section titled “Overview”This page tracks RBA’s progress toward conformance with the NIST AI Risk Management Framework (AI RMF 1.0) and the NIST AI 600-1 Generative AI Profile. It summarizes current coverage scores, open gaps, and the phased remediation plan.
This playbook is strong in staff-facing training—particularly data privacy, prompt security, intellectual property, client disclosure, and (as of v0.1.14) bias and fairness. The primary conformance gap is structural: the playbook functions as a training manual but does not yet establish the organizational risk management machinery NIST requires at the enterprise level.
Current Coverage Scores
Section titled “Current Coverage Scores”NIST AI RMF 1.0 — Four Core Functions
Section titled “NIST AI RMF 1.0 — Four Core Functions”| Function | Coverage | Summary |
|---|---|---|
| GOVERN | ~45% | Code of conduct, roles, and training present. Risk governance structure (committee, risk appetite, decision log) absent. |
| MAP | ~20% | Pre-connection checklist exists. No AI asset inventory, no risk tiering, no use-case registry. |
| MEASURE | ~18% | Qualitative bias checklist added in v0.1.14. No TEVV protocol, no KRIs/KPIs, no continuous monitoring. |
| MANAGE | ~35% | Incident response and offboarding present. No risk register, no treatment plans, no incident SLAs. |
| Overall RMF | ~30% |
NIST AI 600-1 — 12 GenAI Risk Categories
Section titled “NIST AI 600-1 — 12 GenAI Risk Categories”| Risk Category | Coverage | Status |
|---|---|---|
| 1. CBRN Information | 0% | ⛔ Absent |
| 2. Confabulation | 40% | 🟡 Partial |
| 3. Dangerous / Violent / Hateful Content | 0% | ⛔ Absent |
| 4. Data Privacy | 80% | 🟢 Covered |
| 5. Environmental Impacts | — | ➖ N/A |
| 6. Harmful Bias / Homogenization | 45% | 🟡 Partial (added v0.1.14) |
| 7. Human-AI Configuration | 50% | 🟡 Partial |
| 8. Information Integrity | 40% | 🟡 Partial |
| 9. Information Security | 55% | 🟡 Partial |
| 10. Intellectual Property | 80% | 🟢 Covered |
| 11. Obscene / Degrading / Abusive Content | 0% | ⛔ Absent |
| 12. Value Chain / Component Integration | 35% | 🟡 Partial |
| Overall 600-1 | ~38% | 2 covered · 6 partial · 3 absent · 1 N/A (env) |
Key Strengths
Section titled “Key Strengths”- Data Privacy (M3): Comprehensive GDPR, HIPAA, DPA/BAA, data classification, and machine unlearning guidance
- Prompt Security (M2): Direct, indirect, and zero-click injection covered; shadow AI policy enforced
- Intellectual Property (M11): Human authorship spectrum, IP expectations, and platform terms clearly addressed
- Client Disclosure (M6): Four-point output review, framing guidance, and full Appendix B template suite
- Bias & Fairness (M7, added v0.1.14): Demographic stereotyping, accessibility, escalation path — resolves the GV-3.1 gap
Open Conformance Gaps
Section titled “Open Conformance Gaps”Critical (Block Conformance)
Section titled “Critical (Block Conformance)”These gaps prevent NIST conformance at any maturity level. They are structural—they require organizational artifacts, not training content.
| Gap | NIST Requirement |
|---|---|
| No AI asset / system inventory | MAP-1.1, GV-6.1 |
| No risk tiering scheme (Low / Medium / High / Critical) | MAP-2.1, GV-1.2 |
| No TEVV (Test, Evaluate, Validate, Verify) protocol | MEASURE-2.1, MEASURE-2.2 |
| No risk register or treatment plans | MANAGE-1.1, MANAGE-2.4 |
| No AI Governance Committee or executive sponsor | GV-1.4 |
| No risk appetite statement | GV-1.1 |
High Priority
Section titled “High Priority”| Gap | NIST Requirement |
|---|---|
| Bias/fairness metrics and demographic testing protocol (M7 checklist is qualitative only) | MEASURE-2.6, 600-1 Risk #6 |
| Content safety policy (CBRN, hateful/violent content, deepfakes, CSAM/NCII) | 600-1 GV-1.4 (Risks 1, 3, 8, 11) |
| Formal vendor risk assessment process; tool registry is still a placeholder skeleton | GV-6.1 |
| Content provenance policy (watermarking, metadata, attribution logging) | 600-1 MS-1.1 |
| Continuous monitoring and drift detection for live AI systems | MEASURE-3.1 |
| Incident response SLAs by severity level | MANAGE-4.1 |
Medium Priority
Section titled “Medium Priority”| Gap | NIST Requirement |
|---|---|
| WCAG 2.1 AA / Section 508 reference in M7 accessibility checklist | GV-3.1 |
| Modules 10 and 11 missing from Appendix A onboarding track (gap introduced in v0.1.14 renumbering) | GV-2.2 |
| Data poisoning controls | 600-1 Risk #9 |
| Offboarding manager sign-off and completion attestation (M10) | MANAGE-4.1 |
| M9 incident notification placeholder and undefined SLAs | MANAGE-4.1 |
| ”Sanitized data” undefined in M1 tool table | GV-1.2, M3 consistency |
Phased Remediation Roadmap
Section titled “Phased Remediation Roadmap”Phase 1 — Fix What Exists (0–30 days)
Section titled “Phase 1 — Fix What Exists (0–30 days)”Low-effort edits; high compliance impact.
- Appendix A: Add Modules 10 and 11 to the onboarding track (Week 4 or add a Week 5)
- M9: Replace “Project Lead (or project lead)” placeholder; add severity-tiered SLA targets
- M3: Add a definition of “sanitized data” (pseudonymization, de-identification, aggregation thresholds); link from M1 tool table
- M7: Add WCAG 2.1 AA and Section 508 as reference standards for the accessibility checklist
- M10: Add manager sign-off and completion confirmation to mirror Appendix A onboarding attestation
Phase 2 — Structural Governance (30–90 days)
Section titled “Phase 2 — Structural Governance (30–90 days)”Establishes the organizational backbone NIST requires.
- AI Tool Registry: Populate with actual approved tools, data permissions, and vendor contract status — this is the enforcement backbone for M1–M3
- Risk Tiering Scheme: Define Low/Medium/High/Critical tiers keyed to data sensitivity and action capability; embed in M1 and M5
- AI Governance Committee: Establish a lightweight structure (AI Gov Lead + Legal + IT Security + senior consultant) with a decision log
- M5 HITL Criteria: Replace “define what needs approval” with org-defined thresholds keyed to risk tier
Phase 3 — Fill 600-1 Content Gaps (90–180 days)
Section titled “Phase 3 — Fill 600-1 Content Gaps (90–180 days)”Adds the four absent GenAI risk categories and strengthens partials.
- Content Safety Policy: Prohibit CBRN, dangerous/violent/hateful content, CSAM/NCII, and non-consensual synthetic media (Risks 1, 3, 8, 11)
- TEVV Checklist: Define minimum pre-deployment evaluation requirements for any new AI tool (confabulation spot-check, bias test, security review, vendor contract status)
- M7 Bias Metrics: Define measurable evaluation criteria (e.g., demographic parity checks for AI-assisted hiring or resource allocation outputs) to satisfy MEASURE-2.6
- Data Poisoning Controls: Add to M2 or M5; link to M3 for training data integrity
Phase 4 — Ongoing Maturity
Section titled “Phase 4 — Ongoing Maturity”Sustains and matures the framework over time.
- AI Asset Inventory: Rolling register of AI systems, data flows, third-party dependencies, and owners (MAP-1.1)
- Risk Appetite Statement: Executive-level document anchoring GV-1.1
- Content Provenance Guidance: Logging, metadata, and attribution practices for AI-assisted deliverables (600-1 MS-1.1)
- Cross-Module Links: Add “see also” references between M2 (Security), M3 (Privacy), and M11 (IP) for compound risk scenarios
- Continuous Monitoring Plan: Specify monitoring requirements for live AI agents and integrations (MEASURE-3.1)
Progress Tracker
Section titled “Progress Tracker”| Phase | Items | Status |
|---|---|---|
| Phase 1 — Fix What Exists | 5 items | 🔲 Not started |
| Phase 2 — Structural Governance | 4 items | 🔲 Not started |
| Phase 3 — 600-1 Content Gaps | 4 items | 🔲 Not started |
| Phase 4 — Ongoing Maturity | 5 items | 🔲 Not started |
Update this table as items are completed. Link to relevant module diffs or commit history where applicable.