Govern
Roles, accountability and policy recorded against controls, with the approval trail attached.
NIST AI RMF
Govern, Map, Measure, Manage.
Voluntary, and widely used anyway — particularly where a US counterparty asks how you manage AI risk. Its four functions map cleanly onto the evidence you are already gathering for the certifiable frameworks.
Coverage
What ships with the platform.
- 72
- Controls
- NIST AI RMF control library
- 19
- Document requirements
- Mapped to the controls they satisfy
- Yes
- Crosswalked
- Evidence credits equivalent controls in the other frameworks
- Not yet
- Document review
- Review currently covers the other three frameworks
In short
What it actually asks for.
The NIST AI Risk Management Framework organises practice into four functions. Govern covers culture, roles and accountability; Map establishes context and what could go wrong; Measure covers analysis and tracking; Manage covers prioritisation and response.
It is guidance rather than a certifiable standard, so there is no audit to pass. Its value is as a common vocabulary — and as a way to answer a risk questionnaire with something structured rather than prose.
Where the platform helps
The obligations that take the most work.
Map
Context and intended use captured per system, drawn from the inventory that connector scans build.
Measure
Coverage and effectiveness computed from evidence as it lands, not estimated at review time.
Manage
Gaps prioritised into risk entries with owners, and remediation tracked to close.
Crosswalk credit
Evidence gathered for ISO 42001 or the EU AI Act credits the equivalent NIST controls automatically.
Audit simulation
Run a scored dry run against a sample of NIST controls, the same as any other framework in the library.
Two honest limits: NIST AI RMF is included with every plan rather than sold separately, and document review currently grades against ISO 42001, ISO 27001 and the EU AI Act only.
Alongside
Rarely the only framework you run.
Evidence is credited across every framework that asks for the same proof, so overlapping programmes cost far less than running them separately.
Next / evaluate the platform
Bring your frameworks.
See the operating system.
We will walk through the platform against your own governance and compliance needs, and what getting to audit-ready would take.