NIST AI RMF

Gamut supports system-specific assessment against the NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0. The module helps an assessor connect the framework’s four Core functions to a named AI system, record a Current Profile, define a Target Profile, collect evidence, test relevant practices, manage findings and document an accountable conclusion.

The central question is:

For this AI system and operating context, which NIST AI RMF outcomes are currently achieved, what target state is required, what evidence supports the assessment, and what actions remain?

Start here

If you need to…	Read
Explain the difference between the Core, Current Profile, Target Profile and Playbook	Core, Profiles and Playbook
See all 4 functions, 19 categories and 72 outcomes	Functions and outcome catalogue
Explain why every system is available and why some outcomes receive more attention	System scope and prioritisation
Complete an assessment from intake to accountable conclusion	Assessment workflow
Explain Current outcome, Target outcome, assurance depth and confirmation	Outcomes, assurance and conclusions
Know what evidence to request, how to test and when to raise findings	Evidence, testing and findings
Assess a generative AI system using NIST AI 600-1	Generative AI Profile
Use AI assistance responsibly and understand what it can consider	AI-assisted assessment
Produce and explain system or portfolio reporting	Reporting and governance
Follow a realistic assessment example	Worked example
Look up labels, terms and safe explanatory language	Reference and glossary

At a glance

Property	Gamut assessment
Authoritative framework	NIST AI RMF 1.0, NIST AI 100-1
Nature	Voluntary AI risk-management framework
Primary scope	One selected AI system and its operating context
Core functions	GOVERN, MAP, MEASURE and MANAGE
Categories	19
Core subcategories/outcomes	72
Assessment structure	Current Profile plus Target Profile
Current outcome labels	Not assessed, Not achieved, Partially achieved, Achieved
Assurance depth	Unverified, Documented, Implemented, Assured
Generative AI companion	NIST AI 600-1 when generative-AI characteristics are present
Evidence boundary	Evidence, tests and findings linked to the selected system and outcome
AI support	Whole-system or single-outcome advisory analysis
Human accountability	The assessor owns final outcomes, risk decisions and conclusions

The four functions

Function	Purpose	Categories	Outcomes
GOVERN	Establish policies, accountability, culture and organisation-wide risk-management conditions.	6	19
MAP	Establish context and identify intended purpose, actors, impacts, benefits, costs and risks.	5	18
MEASURE	Evaluate, test, monitor and track AI risks and trustworthy characteristics.	4	22
MANAGE	Prioritise and treat risks, make proceed decisions, respond to incidents and improve controls.	4	13

GOVERN is cross-cutting. MAP, MEASURE and MANAGE are iterative rather than a one-time linear sequence. The framework should be revisited as the system, context, evidence, risks and stakeholder expectations change.

How Gamut operationalises the framework

Named AI system and context
  → NIST AI RMF Core available
  → context-based assessment priorities
  → Current Profile outcome for each Core subcategory
  → assurance depth, evidence, testing and findings
  → Target Profile outcome
  → treatment, monitoring and reassessment
  → accountable human conclusion

The Current Profile describes the system’s assessed present position. The Target Profile describes the intended risk-management outcome. The gap between them is the improvement plan.

The trustworthiness characteristics

NIST describes trustworthy AI through connected characteristics:

Valid and reliable.
Safe.
Secure and resilient.
Accountable and transparent.
Explainable and interpretable.
Privacy-enhanced.
Fair, with harmful bias managed.

These characteristics interact and may involve trade-offs. A system is not trustworthy merely because one metric is strong. For example, high predictive performance does not by itself establish safety, fairness, privacy, transparency or appropriate human oversight.

What a defensible assessment contains

A well-supported record should include:

The correct named system, version, purpose, lifecycle stage and deployment context.
Relevant users, affected people, data, suppliers and system boundaries.
A Current Profile outcome for every considered Core subcategory.
A Target Profile outcome appropriate to risk tolerance and intended use.
System-specific rationale rather than generic policy statements.
Evidence showing design and operation.
Test results and defined pass criteria where effectiveness is claimed.
Findings for gaps, failed tests, unsupported assumptions or adverse evidence.
Owners, treatment decisions, residual risk and monitoring.
A review date and material reassessment triggers.
A clear human-authored conclusion.

What the assessment does not prove

It does not by itself prove:

Legal compliance.
Certification.
NIST approval or endorsement.
That every risk has been eliminated.
That a policy operates effectively.
That another system inherits the same outcome.
That a mapped control automatically satisfies a NIST outcome.
That AI-generated advice is correct or approved.