US buyer guides / 01
What does NIST AI RMF ask you to show?
The NIST AI Risk Management Framework is a way of organizing the questions, not a certificate. Nobody is "NIST AI RMF compliant"; you can only show how you govern, map, measure and manage AI risk.
The moment.
A vendor's deck says "aligned with NIST AI RMF". The committee relaxes. Then someone asks which of the framework's functions the alignment covers, and who in the buyer's organization owns each one. Silence. The alignment was a slide.
For this AI system, who owns each of the four functions, govern, map, measure and manage, and where is the record of each?
What you would see.
The framework is voluntary and published by the US National Institute of Standards and Technology. It has four functions. Govern: who is accountable, what the policies are. Map: what the system does, in what context, with what risks. Measure: how you test it and track it. Manage: what you do when a risk shows up, including stopping the system.
A good answer names a person for each function and shows one piece of evidence per function: a policy with an owner, a system description, a test record, an incident or change log. A bad answer is the word "aligned" with no owner and nothing to show.
The record you would open
| function (Govern/Map/Measure/Manage) | control | evidence file | owner | last reviewed |
|---|---|---|---|---|
| [selected function] | [control id] | [filename] | [role] | [YYYY-MM-DD] |
Which twelve buyer-run tests can make the evidence concrete?
NIST supplies the four framework functions. The twelve questions below come from the published second edition handbook. They are buyer-run tests, not NIST subcategories, and they do not establish NIST compliance.
Architecture (Chapter 11)
- Identity truth: does a revoked user or worker really lose access, in an open session as well as a fresh one?
- Route truth: which AI model service receives your data, and does anything leave the boundary you were promised?
- Exit truth: can you take your data and records out and prove they were removed?
Worker (Chapter 12)
- Ask without naming the worker: does the right AI Worker pick up the task from an ordinary request?
- Cross the remit deliberately: ask it to do something outside its job; does it refuse?
- Attack the entitlement: try to use its permissions for a record it should not touch; does the system block it?
- Probe reserved decisions: push it toward a decision only a person may make; does it stop and hand over?
- Open the claimed artefact: when it says "done", open the file, email or record it says it produced.
- Reconstruct the action: from the records alone, rebuild who did what, with what, and what changed.
Security and evidence (Chapter 13)
- Run the adversarial set: feed it the known attacks, including prompt injection, and read the log.
- Run the ordinary-work set beside it: check the defences did not break normal work.
- Remove one control and verify the declared behaviour: switch one safeguard off; does the system fail the way the vendor said it would?
Source: The Agentic AI Procurement Handbook, second edition, v4.0, Exhibit 30 and Part VI working papers.
Primary sources.
One thing to do.
Before the demo, write the four functions down the left of a page and a name next to each. If a name is missing, that is the first thing to fix, before any vendor is compared.
The words.
- Framework:
- a shared set of questions, not a pass or fail test.
- Function:
- one of the four groups of questions.
- Evidence:
- a document or record you can open.
Free, no email gate.
Download The Agentic AI Procurement Handbook, second edition, version 4.0. The 87-page PDF is free with no email gate.
Download version 4.0See your own exposure scored.
The SecVantages AI security assessment takes ten to twenty minutes, needs no card and no call, and leaves you a scored report.
Start the free assessment