The NIST AI RMF for AAISM candidates

The NIST AI Risk Management Framework, AI RMF 1.0, is the most widely used vocabulary for managing AI risk, and an AI security manager will meet it constantly: its four functions, GOVERN, MAP, MEASURE and MANAGE, its seven characteristics of trustworthy AI, and its generative AI profile, NIST AI 600-1, which lists 12 risks specific to generative AI, information security among them. ISACA's AAISM exam content outline does not name the AI RMF, or any framework, but its first topic covers "Industry Frameworks", and the RMF is the framework most AI security work is mapped to. This guide explains the framework as NIST wrote it, what the generative AI profile adds for a security manager, and what is changing, because NIST says the framework is being revised.

The short answer

• What it is. A voluntary framework from NIST, released on January 26, 2023, for managing the risks of AI systems. It is "intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic".
• Seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
• Four functions: GOVERN, MAP, MEASURE and MANAGE, with 19 categories and 72 subcategories between them. GOVERN runs through the other three.
• A generative AI profile, NIST AI 600-1, naming 12 risks of generative AI and suggested actions keyed to the RMF.
• Changing. NIST's page says "The AI RMF 1.0 is being revised as part of the White House AI Action Plan."

Why an AAISM candidate needs the AI RMF

ISACA's outline leaves frameworks unnamed: topic 1A is "Stakeholder Considerations, Industry Frameworks, and Regulatory Requirements", and one of the 22 tasks asks candidates to "Ensure the responsible use of AI by utilizing leading practices, ethical principles, regulatory requirements, and industry frameworks." Which frameworks is left to the candidate.

In practice, the AI RMF is the one an AI security manager is most likely to be asked to align with, to map controls to, or to report against, so it is worth knowing in NIST's own terms rather than through a vendor's summary. The point is not to memorize the framework; it is to recognize what each part is for, so that a scenario about accountability, context, testing or response lands on the right function.

What the AI RMF is

NIST describes the framework's purpose plainly: it is meant to help organizations "manage the many risks of AI and promote trustworthy and responsible development and use of AI systems". Three features matter for a security manager:

• Voluntary. "The Framework is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic". It is guidance, not law; no one is fined for ignoring it, which is exactly why enterprises adopt it as their common language.
• Two parts. Part 1 frames AI risk and the characteristics of trustworthy AI; Part 2 is "the Core" of the framework, the four functions, and the profiles.
• A companion Playbook. NIST calls the AI RMF Playbook "An online companion resource to the AI RMF", which offers suggested actions, and adds that "Like the AI RMF, the Playbook is voluntary".

The seven characteristics of trustworthy AI

The RMF lists them in one sentence: "Characteristics of trustworthy AI systems include: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed." It also says that creating trustworthy AI "requires balancing each of these characteristics based on the AI system's context of use".

The one a security manager owns most directly is secure and resilient, and NIST separates the two halves. On security: "AI systems that can maintain confidentiality, integrity, and availability through protection mechanisms that prevent unauthorized access and use may be said to be secure." On resilience, systems "may be said to be resilient if they can withstand unexpected adverse events or unexpected changes in their environment or use". And: "Security and resilience are related but distinct characteristics."

The distinction matters in practice. A control that blocks unauthorized access serves security; a design that keeps an AI system running safely through an outage or a flood of bad inputs serves resilience. A program needs both, and a question that describes one should not be answered with the other.

The four functions

The RMF's Core organizes AI risk management into four functions:

Three sentences from NIST explain how they fit together:

• "GOVERN is a cross-cutting function that is infused throughout AI risk management and enables the other functions of the process."
• "After completing the MAP function, Framework users should have sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system."
• "The MANAGE function entails allocating risk resources to mapped and measured risks on a regular basis and as defined by the GOVERN function."

For MEASURE, NIST says the function "employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts."

The functions are not a checklist to run once. The RMF says that risk management "should be continuous, timely, and performed throughout the AI system lifecycle dimensions", and that the categories and subcategories do not "constitute a checklist, nor are they necessarily an ordered set of steps".

Profiles

The RMF also describes profiles, which apply the functions to a particular setting. NIST names use-case profiles and temporal profiles, and notes that cross-sectoral profiles "can also cover how to govern, map, measure, and manage risks for activities or business processes common across sectors such as the use of large language models, cloud-based services or acquisition." The framework "does not prescribe profile templates", which leaves each organization to build its own. NIST's best-known profile is the one for generative AI.

The generative AI profile: NIST AI 600-1

NIST AI 600-1 calls itself "a cross-sectoral profile of and companion resource for the AI Risk Management Framework (AI RMF 1.0) for Generative AI". It does two things a security manager uses directly: it names the risks that are unique to or made worse by generative AI, and it lists suggested actions against the RMF's subcategories.

The 12 risks

The profile's 12 risks, in its own names:

1. CBRN Information or Capabilities
2. Confabulation
3. Dangerous, Violent, or Hateful Content
4. Data Privacy
5. Environmental Impacts
6. Harmful Bias or Homogenization
7. Human-AI Configuration
8. Information Integrity
9. Information Security
10. Intellectual Property
11. Obscene, Degrading, and/or Abusive Content
12. Value Chain and Component Integration

Confabulation is the profile's word for what most people call hallucination: "The production of confidently stated but erroneous or false content (known colloquially as "hallucinations" or "fabrications") by which users may be misled or deceived."

Information security, in NIST's words

For a security manager, the ninth risk is the core of the profile, and NIST describes it from both sides. Generative AI can help attackers, "Lowered barriers for offensive cyber capabilities", and at the same time it "expands the available attack surface, as GAI itself is vulnerable to attacks like prompt injection or data poisoning."

The profile defines both attacks:

• Prompt injection "involves modifying what input is provided to a GAI system so that it behaves in unintended ways."
• Data poisoning is an attack "in which an adversary compromises a training dataset used by a model to manipulate its outputs or operation."

The twelfth risk, value chain and component integration, is the supply-chain view: "Non-transparent or untraceable integration of upstream third-party components", including data "improperly obtained or not processed and cleaned", and "improper supplier vetting across the AI lifecycle".

Suggested actions

The profile's suggested actions are numbered by function and subcategory, so each one can be traced back to the RMF. MS-2.7-008, for example, under MEASURE 2.7, reads: "Verify fine-tuning does not compromise safety and security controls." NIST is clear that the coverage is partial: "Suggested actions are listed for only some subcategories."

The actions concentrate on four primary considerations, which NIST names as "Governance, Pre-Deployment Testing, Content Provenance, and Incident Disclosure". For a security manager, pre-deployment testing and incident disclosure are the most familiar ground.

Three confusions to avoid

1. Characteristics are not functions. The seven characteristics describe what trustworthy AI looks like; the four functions organize the work of getting there. A question about accountability for AI risk points to GOVERN, not to the "accountable and transparent" characteristic.
2. Secure is not the same as resilient. Security is about protection against "unauthorized access and use"; resilience is about withstanding "unexpected adverse events or unexpected changes". NIST calls them "related but distinct characteristics", and so should you.
3. The profile is not a second framework. AI 600-1 applies the AI RMF to generative AI; it does not replace it. Its actions are keyed to the RMF's subcategories, and like the Playbook it is voluntary guidance.

What is changing

The AI RMF is not standing still. NIST's own page says that "The AI RMF 1.0 is being revised as part of the White House AI Action Plan", and that on April 7, 2026, NIST "released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure". Until a revised framework is published, AI RMF 1.0 and the generative AI profile are the current documents, and they are what this guide describes. When NIST publishes the revision, we will update this page.

How the RMF meets the AAISM

ISACA does not map its outline to the RMF, so any mapping is a reading, not a fact about the exam. Ours: GOVERN's policies, roles and accountability are the territory of the AAISM's Domain 1, AI Governance and Program Management; MAP and MEASURE line up with Domain 2's risk assessment and threat and vulnerability management; and MANAGE, with its controls and responses, with Domain 3, AI Technologies and Controls. The generative AI profile's information security and value chain risks are the subject of topics 2B, threats and vulnerabilities, and 2C, vendors and the supply chain.

Use that mapping as a study aid, not as an answer key: the AAISM asks what a security manager should do, and the RMF is one of the vocabularies the right answer is usually phrased in.

Learning the RMF with QualExam

Our AAISM course teaches the AI RMF where a security manager needs it: it appears in 20 of the 63 lessons, and lesson 1A/03, on the NIST AI RMF and ISO/IEC 42001, sits in the first topic, AI governance and regulation, which a free account opens in full. The generative AI profile is taught in three lessons, from governance to trust and safety controls. For how the frameworks fit the exam as a whole, see the AAISM exam content outline explained, and for a week-by-week plan, how to study for the AAISM. Full access is a single payment, with nothing to renew.