[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-ai-rmf\u002Foverview":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-ai-rmf","overview","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",556,"US National Institute of Standards and Technology (NIST)","**What it covers.** The NIST AI Risk Management Framework, published in 2023, is voluntary guidance for managing risks from AI systems across their lifecycle. It describes characteristics of trustworthy AI, such as validity, safety, security, accountability, transparency, explainability, privacy and fairness, and organises activity into four functions: Govern, Map, Measure and Manage. NIST has also published companion material, including a profile for generative AI.\n\n**In practice.** Organisations establish governance for AI with clear roles, an inventory of AI systems and policies for acceptable use. Each system's context, intended use and potential harms are mapped, risks are measured through testing and monitoring, and treatment decisions are recorded. Evidence includes AI inventories, risk assessments, evaluation results and incident handling records.\n\n**Common gaps.** Many organisations lack a complete inventory of AI use, including third party tools. Measurement is often limited to accuracy, with little testing for security, bias or misuse.",null,"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","Open the AI RMF at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},447,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"federal-agencies-issue-cybersecurity-guidance-for-frontier-ai-systems","Federal Agencies Issue Cybersecurity Guidance for Frontier AI Systems","2026-10-17T02:20:17.238+00:00",{"slug":24,"title":25,"published_at":26},"nist-nsa-cisa-issue-guidance-on-ai-incident-readiness-for-high-risk-ai-systems","NIST, NSA & CISA Issue Guidance on AI Incident Readiness for High-Risk AI Systems","2026-10-16T18:21:54.014+00:00",{"slug":28,"title":29,"published_at":30},"governing-open-weight-ai-models-requires-structured-enterprise-risk-frameworks","Governing Open-Weight AI Models Requires Structured Enterprise Risk Frameworks","2026-10-16T18:21:38.63+00:00",{"slug":32,"title":33,"published_at":34},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":36,"title":37,"published_at":38},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":40,"title":41,"published_at":42},"ai-chatbots-targeted-by-covert-political-influence-networks","AI Chatbots Targeted by Covert Political Influence Networks","2026-10-15T20:20:35.974+00:00",{"slug":44,"title":45,"published_at":46},"ai-confidence-accuracy-human-oversight-is-non-negotiable-in-forensics","AI Confidence ≠ Accuracy: Human Oversight Is Non-Negotiable in Forensics","2026-10-15T14:21:23.922+00:00",{"slug":48,"title":49,"published_at":50},"small-ai-models-could-enable-self-propagating-ai-worms-by-2026","Small AI Models Could Enable Self-Propagating AI Worms by 2026","2026-10-15T14:20:39.044+00:00",{"slug":52,"title":53,"published_at":54},"unauthorised-ai-agent-actions-expose-gaps-in-governance-and-oversight","Unauthorised AI Agent Actions Expose Gaps in Governance and Oversight","2026-10-14T18:22:00.668+00:00",{"slug":56,"title":57,"published_at":58},"senators-push-for-federal-ai-safety-standards-amid-security-breaches","Senators Push for Federal AI Safety Standards Amid Security Breaches","2026-10-14T16:20:32.423+00:00",{"slug":60,"title":61,"published_at":62},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","2026-10-14T10:20:18.748+00:00",{"slug":64,"title":65,"published_at":66},"ai-coding-agents-need-zero-trust-security-boundaries-to-prevent-production-disasters","AI Coding Agents Need Zero-Trust Security Boundaries to Prevent Production Disasters","2026-10-13T22:21:43.666+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",311,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",97,{"slug":79,"name":80,"problem":81,"stories":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",54,{"slug":84,"name":85,"problem":86,"stories":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",48,{"slug":89,"name":90,"problem":91,"stories":92},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",42,{"slug":94,"name":95,"problem":96,"stories":97},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",37,[99,105,109,115,120,126,131,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","8","Control 8","Audit Log Management",163,{"family":106,"item":6,"code":107,"title":107,"together":108},"itil","ITIL",157,{"family":110,"item":111,"code":112,"title":113,"together":114},"gdpr","25","Article 25","Data protection by design and by default",148,{"family":100,"item":116,"code":117,"title":118,"together":119},"3","Control 3","Data Protection",147,{"family":121,"item":122,"code":123,"title":124,"together":125},"nist-800-53","ac-6","AC-6","Least Privilege",146,{"family":100,"item":127,"code":128,"title":129,"together":130},"6","Control 6","Access Control Management",138,{"family":132,"item":133,"code":134,"title":135,"together":136},"iso","42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",122,{"family":138,"item":138,"code":139,"title":140,"together":141},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)",116]