Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

General RFI Topics (Use as many 

lines as you like)

Response # Responding 

organization

Responder's 

name

Paper 

Section (if 

applicable)

Responses to Specific Request for 

information (pages 11,12, 13 and 

14 of the RFI)

Comment Template for 

Responses to NIST 

Artifical Intelligence Risk 

Management Framework 

All comments will be made public as-is, with no edits 

information, otherwise sensitive or prote 

Please see item 10 below for suggested framework

Type: E - Editorial, G - General T - Technical 1 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

1. The greatest challenges in 

improving how AI actors manage 

AI-related risks – where “manage” 

means identify, assess, prioritize, 

respond to, or communicate 

those risks;

2. How organizations currently 

define and manage characteristics 

of AI trustworthiness and whether 

there are important 

characteristics which should be 

considered in the Framework 

besides: accuracy, explainability 

and interpretability, reliability, 

privacy, robustness, safety, 

security (resilience), and 

mitigation of harmful bias, or 

harmful outcomes from misuse of 

the AI; 

Type: E - Editorial, G - General T - Technical 2 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

3. How organizations currently 

define and manage principles of 

AI trustworthiness and whether 

there are important principles 

which should be considered in the 

Framework besides: transparency, 

fairness, and accountability;

4. The extent to which AI risks are 

incorporated into different 

organizations' overarching 

enterprise risk management – 

including, but not limited to, the 

management of risks related to 

cybersecurity, privacy, and safety;

5. Standards, frameworks, 

models, methodologies, tools, 

guidelines and best practices, and 

principles to identify, assess, 

prioritize, mitigate, or 

communicate AI risk and whether 

any currently meet the minimum 

attributes described above;

Type: E - Editorial, G - General T - Technical 3 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

6. How current regulatory or 

regulatory reporting requirements 

(e.g., local, state, national, 

international) relate to the use of 

AI standards, frameworks, 

models, methodologies, tools, 

guidelines and best practices, and 

principles;

7. AI risk management standards, 

frameworks, models, 

methodologies, tools, guidelines 

and best practices, principles, and 

practices which NIST should 

consider to ensure that the AI 

RMF aligns with and supports 

other efforts;

Type: E - Editorial, G - General T - Technical 4 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

8. How organizations take into 

account benefits and issues 

related to inclusiveness in AI 

design, development, use and 

evaluation – and how AI design 

and development may be carried 

out in a way that reduces or 

manages the risk of potential 

negative impact on individuals, 

groups, and society.

9. The appropriateness of the 

attributes NIST has developed for 

the AI Risk Management 

Framework. (See above, “AI RMF 

Development and Attributes”);

Type: E - Editorial, G - General T - Technical 5 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

10. Effective ways to structure the 

Framework to achieve the desired 

goals, including, but not limited 

to, integrating AI risk 

management processes with 

organizational processes for 

developing products and services 

for better outcomes in terms of 

trustworthiness and management 

of AI risks. Respondents are asked 

to identify any current models 

which would be effective. These 

could include – but are not 

limited to – the NIST 

Cybersecurity Framework or 

Privacy Framework, which focus 

on outcomes, functions, 

categories and subcategories and 

also offer options for developing 

profiles reflecting current and 

desired approaches as well as 

tiers to describe degree of 

framework implementation; and

1 JR3 Consulting, 

LLC

John Rice

Type: E - Editorial, G - General T - Technical 6 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

11. How the Framework could be 

developed to advance the 

recruitment, hiring, development, 

and retention of a knowledgeable 

and skilled workforce necessary 

to perform AI-related functions 

within organizations.

12. The extent to which the 

Framework should include 

governance issues, including but 

not limited to make up of design 

and development teams, 

monitoring and evaluation, and 

grievance and redress.

Type: E - Editorial, G - General T - Technical 7 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 8 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Submit comments by August 19, 2021: 

Response/Comment (Include 

rationale)

Suggested change

or redactions. Please be careful to not include confidential business or personal 

ected information, or any information you do not wish to be posted.

Type: E - Editorial, G - General T - Technical 9 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 10 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 11 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 12 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 13 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Suggestion for structuring the 

framework based on individual's 

novel risk management 

framework while supporting the 

Army, then NASA, and 

subsequently the DoD at large. 

Risk framework was topic of 

publication in DoD's Acquisition 

Research Journal, topic of invited 

presentation at the Defense 

Manufacturing Conference, and 

oft-reviewed and cited article at 

ResearchGate.net.

Recommend a cursory review of subject research 

for application to AI. It is provided as an email 

attachment with this template. Includes minor 

updates to the original 2010 publication. Figure 

4, in particular, is the subject of the paper and 

should summarize the topic.

Type: E - Editorial, G - General T - Technical 14 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 15 of 16
Comments template for Draft SP 800-207 Please respond by November 22, 2019 Submitted by: IDSA 

Date: 11/21/19

Type: E - Editorial, G - General T - Technical 16 of 16