ConsultingWorkbench-backed AI security engagements — map, attack, defend, and prove your AI systems.
Scope a Review
NIST

Labs / AI Control Crosswalk / NIST AI RMF

NIST AI Risk Management Framework

AI RMF

Govern. Map. Measure. Manage.

4Functions
72Playbook items
609Actions
490Evidence prompts

Playbook actions, evidence prompts, and scorecard mappings for the NIST AI Risk Management Framework.

NIST AI Risk Management
Public-safe

AI RMF

Playbook

Continuous cycle

Govern

Establish risk ownership and oversight.

Map

Map context and identify risk areas.

Measure

Measure, analyze, and prioritize AI risks.

Manage

Manage risks and implement controls.

Governance
Context
Measurement
Management

AI RMF Playbook

Govern / Map / Measure / Manage.

Search across the playbook, inspect evidence prompts, and align subcategories to the AI Trust Governance scorecard dimensions.

NIST AI RMF
GOVERN 1.1
playbook item
public-safe

GOVERN 1.1

AI systems may be subject to specific applicable legal and regulatory requirements. Some legal requirements can mandate (e.g., nondiscrimination, data privacy and security controls) documentation, disclosure, and increased AI system transparency. These requirements are complex and may not be applicable or differ across applications and contexts. For example, AI system testing processes for bias measurement, such as disparate impact, are not applied uniformly within the legal context. Disparate impact is broadly defined as a facially neutral policy or practice that disproportionately harms a group based on a protected trait. Notably, some modeling algorithms or debiasing techniques that rely on demographic information, could also come into tension with legal prohibitions on disparate treatment (i.e., intentional discrimination). Additionally, some intended users of AI systems may not have consistent or reliable access to fundamental internet technologies (a phenomenon widely described as the “digital divide”) or may experience difficulties interacting with AI systems due to disabilities or impairments. Such factors may mean different communities experience bias or other negative impacts when trying to access AI systems. Failure to address such design issues may pose legal risks, for example in employment related activities affecting persons with disabilities.

Scorecard dimensions

public surface
legal clarity
consistency

Public-safe boundary

Public framework metadata, derived crosswalks, cautious claim language. No restricted text or certification implication.

Private engagement

Turn framework mapping into governance evidence.

Use these NIST AI RMF playbook items to scope evidence prompts, maturity gaps, and remediation work. A governance evidence sprint translates framework gaps into artifacts your buyers and board can review.