NIST AI RMF
Gamut supports assessment aligned to the NIST AI Risk Management Framework (AI RMF), using product-safe summaries and assessment prompts based on its public concepts.
The four functions
Section titled “The four functions”The NIST AI RMF organises AI risk management around four core functions. Gamut structures assessment around the same four, each broken into categories:
| Function | Purpose | Categories |
|---|---|---|
| GOVERN | Establish accountability, policy and culture for AI risk across the organisation. | 6 |
| MAP | Understand context, purpose and where risk arises. | 5 |
| MEASURE | Assess, analyse and track AI risk with evidence. | 4 |
| MANAGE | Prioritise, treat and act on AI risk over time. | 4 |
GOVERN is cross-cutting and informs the other three; MAP, MEASURE and MANAGE follow the arc of understanding, quantifying and then acting on risk. This maps naturally onto Gamut’s own governance lifecycle.
How you use it in Gamut
Section titled “How you use it in Gamut”- Register and run intake on the system.
- Start a NIST AI RMF assessment.
- Work through the functions and their categories, recording rationale and evidence.
- Raise findings and track remediation.
- Report on your risk posture across the four functions.
Crosswalk
Section titled “Crosswalk”Every GTSAF control carries NIST AI RMF anchors, and the NIST functions map to GTSAF domains: GOVERN aligns with the governance and accountability domains, MAP with intake and risk identification, MEASURE with monitoring and validation, and MANAGE with treatment, resilience and incident response. A single body of governance work therefore supports NIST AI RMF, GTSAF, the EU AI Act and ISO/IEC 42001 at once. See the GTSAF crosswalk table.
- Assessments & control testing, the assessment workflow.
- ISO/IEC 42001, a management-system aligned route.
- Frameworks overview, how routing and crosswalks work.