Skip to main content
INFORMATIVEDRAFTDocumentation Governance
Truth Source: Repository schemas and tests are authoritative.

NIST AI RMF Mapping

Normative Status​

[!IMPORTANT] Informative Only This document is informative and non-normative. All mappings are illustrative only and do not imply certification, endorsement, or compliance with any external standard.

Scope Limitation​

[!WARNING] No Automatic Conformance Conformance with MPLP does not automatically guarantee Conformance with NIST AI RMF. Organizations must independently verify their Conformance with NIST requirements.

1. Overview​

NIST AI RMF 1.0 is a voluntary framework to better manage risks to individuals, organizations, and society associated with artificial intelligence. This mapping shows how MPLP capabilities support the four core functions of the NIST AI RMF: GOVERN, MAP, MEASURE, and MANAGE.

StandardFull TitleScope
NIST AI 100-1AI Risk Management Framework (AI RMF 1.0)Guidelines for managing risks throughout the AI lifecycle

2. MPLP to NIST AI RMF Mapping​

2.1 GOVERN (Culture of Risk Management)​

NIST Goal: Cultivate a culture of risk management.

NIST FunctionMPLP SupportMPLP Component
GOVERN 1Policies and processesProtocol governance defines policies
GOVERN 2Accountability structuresConfirm module ensures oversight
GOVERN 3Workforce diversity/equityRole module defines capabilities

MPLP Implementation:

  • Protocol-Level Governance: The Confirm module ensures that governance is not an afterthought but a blocking step in the execution loop.
  • Policy-as-Code: Governance policies are defined in Context and enforced by Confirm.

2.2 MAP (Context Recognition)​

NIST Goal: Context is recognized and risks are identified.

NIST FunctionMPLP SupportMPLP Component
MAP 1Context establishmentContext schema defines boundaries
MAP 2CategorizationRole module maps capabilities
MAP 3Risk identificationImpact analysis events

MPLP Implementation:

  • Context Module: Explicitly defines the operational context, boundaries, and objectives of the agent.
  • Role Module: Defines capabilities and limitations, mapping agent potential to specific risks.

2.3 MEASURE (Risk Assessment)​

NIST Goal: Risks are assessed, analyzed, and tracked.

NIST FunctionMPLP SupportMPLP Component
MEASURE 1Methods and metricsObservability standards
MEASURE 2System evaluationTrace replay & verification
MEASURE 3Feedback mechanismsLearning module

MPLP Implementation:

  • Trace Module: Provides immutable, replayable logs for measurement and audit.
  • Drift Detection: Continuously measures deviation from the Plan, providing a quantitative metric for "agent drift".

2.4 MANAGE (Risk Prioritization)​

NIST Goal: Risks are prioritized and acted upon.

NIST FunctionMPLP SupportMPLP Component
MANAGE 1Risk prioritizationPlan objectives & constraints
MANAGE 2Risk treatmentIntervention via Confirm
MANAGE 3Response and recoveryPlan correction & rollback

MPLP Implementation:

  • Plan Module: Allows for the insertion of mitigation steps into the agent's reasoning process.
  • Governance Shells: Can halt execution (Manage) if risks exceed thresholds defined in Confirm.

3. Specific Function Alignment​

NIST IDFunctionMPLP Mechanism
MAP 1.1Context establishedContext Module (Required)
MEASURE 2.2System evaluationTrace Replay & Drift Metrics
MANAGE 2.3Incident responseConfirm (Intervention) & Plan (Correction)

4. Disclaimer​

This mapping is provided for informational purposes only. It does not constitute legal advice or certification.

Organizations seeking NIST AI RMF alignment should:

  1. Consult with risk management professionals
  2. Conduct independent risk assessments
  3. Implement additional controls as required

Related Standards: NIST AI RMF 1.0
See Also: ISO 42001 Mapping