AI RMF 1.0 (NIST AI 100-1)Final2023

Artificial Intelligence Risk Management Framework (AI RMF 1.0)

At a glanceA voluntary framework for managing the risks of designing, buying or using AI systems, organized as Govern, Map, Measure and Manage. It describes what makes AI trustworthy, such as being valid, safe, secure, fair, transparent and privacy-enhanced. Useful for districts writing AI guidance or evaluating AI tools.

Reading level: Practitioner
Length: 48 pages · about 45 min for the key parts
Best for: Superintendents and cabinet, Technology directors, Business officials
CSF 2.0: Govern, Identify

Read it on NIST DOI 10.6028/NIST.AI.100-1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Revision in progress. NIST's AI RMF page states the framework is being revised; no draft, number or date had been published at verification.

Key concepts

Part 1 frames AI risk and the characteristics of trustworthy AI and explains how AI risk differs from ordinary software risk. Part 2 is the Core: Govern (culture and policies), Map (context and risks), Measure (assess and track) and Manage (prioritize and act). An online Playbook suggests actions for each subcategory. NIST has said a revision is under way, with no draft yet.

How it is organized

Part 1: framing risk, audience, AI risks and trustworthiness
Part 2: the Core: Govern, Map, Measure, Manage
Profiles
Appendices: AI actor tasks, how AI risk differs from software risk, human-AI interaction
Online companion: AI RMF Playbook

What a school district should take from it

Most district AI risk comes from tools the district buys or staff adopt, so governance and procurement matter most.
Student data entered into AI tools raises privacy and contract questions as well as accuracy concerns.

How to use it in your district

Use Govern outcomes to draft a district AI use guideline for staff and students.
Map where AI is already in use (including features inside existing products) and what data it touches.
Add AI questions to vendor reviews and student data privacy agreements, such as whether student data trains models.
Use the Playbook to pick a few practical actions rather than adopting everything.

Common misconceptions

The AI RMF only applies to companies that build AI.: It addresses organizations that deploy or use AI as well as developers.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.POPolicy
GV.RMRisk Management Strategy
GV.SCCybersecurity Supply Chain Risk Management
ID.RARisk Assessment

Tools in the program portal

Policy BuilderDraft policy language tied to rubric categories
Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
Vendor RegistryKnow which vendors hold district data
Risk registerRecord gaps leadership formally accepts, with controls and review dates

Related publications

NIST AI 600-1Generative AI risk profile
Privacy Framework 1.0 (CSWP 10)NIST Privacy Framework

Citation and source

AI RMF 1.0 (NIST AI 100-1), Artificial Intelligence Risk Management Framework (AI RMF 1.0). National Institute of Standards and Technology. 2023. https://doi.org/10.6028/NIST.AI.100-1.

Topics: Artificial intelligence, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.