NIST AI Risk Management Framework Compliance Checklist

A practical guide to AI governance alignment

23 Subcategories Covered

promptfence.io

GOVERN Function

GOVERN

The GOVERN function establishes the culture, policies, and accountability structures needed for responsible AI development and deployment.

Code	Requirement	PromptFence
GV-1.1	Legal and regulatory requirements documented and integrated into AI policies	✓
GV-1.2	Trustworthy AI characteristics incorporated into organizational policies	✓
GV-1.3	Risk tolerance framework defined for AI systems	✓
GV-1.4	Risk management documentation and audit trails maintained	✓
GV-1.5	Ongoing monitoring and periodic review processes established	✓
GV-1.6	AI system inventory and usage tracking implemented	✓
GV-2.2	Personnel trained on AI risks and responsible use	✓
GV-4.3	Incident identification, documentation, and reporting processes	✓
GV-6.1	Third-party AI risk policies and procedures established	✓
GV-6.2	Contingency processes for third-party AI failures	✓

MANAGE Function

MANAGE

The MANAGE function focuses on allocating risk management resources and establishing, implementing, and maintaining processes to manage AI risks.

Code	Requirement	PromptFence
MG-1.2	Risk prioritization based on data type and sensitivity	✓
MG-1.3	Risk response planning with pre-configured actions	✓
MG-1.4	Residual risk documentation and acceptance tracking	✓
MG-2.2	Mechanisms to sustain value of deployed AI systems	✓
MG-2.4	Ability to bypass, deactivate, or disengage AI systems	✓
MG-3.1	Third-party AI system monitoring and oversight	✓
MG-4.1	Post-deployment AI system monitoring established	✓
MG-4.3	Incident tracking, communication, and response processes	✓

MEASURE Function

MEASURE

The MEASURE function employs quantitative and qualitative methods to analyze, assess, benchmark, and monitor AI risk and related impacts.

Code	Requirement	PromptFence
MS-2.4	AI systems monitored in production environment	✓
MS-2.8	Transparency and accountability audit trails maintained	✓
MS-2.10	Privacy risk controls implemented (PII detection, redaction)	✓

MAP Function

MAP

The MAP function establishes the context to frame risks related to an AI system, identifying and prioritizing potential AI risks.

Done	Code	Requirement	PromptFence
	MP-1.5	Organizational risk tolerance defined and documented	✓
	MP-4.1	Technology risks identified and documented	✓

Additional Considerations

REFERENCE

The following subcategories are part of the full NIST AI RMF but require organizational processes beyond technical tooling.

Code	Requirement	PromptFence
GV-2.1	Roles and responsibilities assigned for AI risk management	—
GV-3.1	Decision-making processes documented and followed	—
GV-3.2	Policies and procedures aligned with organizational values	—
GV-4.1	Organizational culture supports AI risk management	—
GV-4.2	AI risk awareness integrated into organizational culture	—
GV-5.1	Feedback mechanisms established for continuous improvement	—
MP-1.1	Intended purposes for AI systems documented	—
MP-2.1	Target users and stakeholders identified	—
MP-3.1	AI system benefits and costs assessed	—
MS-1.1	Methods for measuring AI risks appropriate for context	—

Summary & Next Steps

23

NIST AI RMF subcategories addressed by PromptFence

PromptFence provides the technical controls, monitoring, and enforcement capabilities to help your organization achieve practical NIST AI RMF alignment.

Ready to get started?

1. Generate your free AI policy:

promptfence.io/policy-generator

2. See the full NIST AI RMF mapping:

promptfence.io/nist-ai-rmf

3. Start your free trial:

promptfence.io/pricing

NIST AI RMF Compliance Checklist

What's Included

Your Download is Ready!