Lion Cipher Lab
Govern an AI system with the NIST AI RMF
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every organisation shipping AI now faces the same question from a board, a customer or a regulator: 'how do you manage the risk of this thing?' In the United States there is no single AI law to point at the way Europe has the EU AI Act — so the answer most US organisations reach for is the NIST AI Risk Management Framework, the government's voluntary, widely-adopted playbook for building trustworthy AI. Being able to take a real AI system and walk it through the framework's four functions — GOVERN, MAP, MEASURE, MANAGE — and hand back a worksheet that names the risks, the evidence, and the…
What you'll learn
- NIST AI Risk Management Framework (AI RMF 1.0 / NIST AI 100-1) fundamentals
- walking the four functions: GOVERN, MAP, MEASURE, MANAGE
- GOVERN as the cross-cutting culture / policy / accountability function
- MAP: establishing context, intended use, actors and identifying AI risks
- the seven characteristics of trustworthy AI (valid & reliable, safe, secure & resilient, accountable & transparent, explainable & interpretable, privacy-enhanced, fair with harmful bias managed)
- MEASURE: assess, analyze, benchmark and track AI risks with metrics
- MANAGE: prioritize, respond to, resource and monitor AI risks
- using the AI RMF Playbook and the Generative AI Profile (NIST AI 600-1)
- distinguishing a voluntary, outcome-based, non-certifiable framework from a binding regulation (EU AI Act) and a certifiable standard (ISO/IEC 42001)
- producing an AI governance worksheet with identified risks, evidence and gaps
Steps in this lab
- What the AI RMF is — voluntary, outcome-based, and how it differs from the EU AI Act
- Set up your worksheet and pick an AI system to govern
- GOVERN — the cross-cutting culture, policy and accountability function
- MAP — establish context and identify risks against the seven trustworthy-AI characteristics
- MEASURE — assess, analyze and track the mapped risks with metrics
- MANAGE — prioritize, respond to, resource and monitor the risks
- The generative-AI layer — the Generative AI Profile (NIST AI 600-1)
- Do it right — voluntary vs regulation vs standard, and when to adopt which
- Write the one-page verdict and the prioritised risk-and-gap list