ezesecops/rmf-ato-core huggingface dataset:
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Govern > GOVERN 1.1

GOVERN 1.1: Legal and regulatory requirements involving AI are understood, managed, and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Govern > GOVERN 1.2

GOVERN 1.2: The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Govern > GOVERN 1.3

GOVERN 1.3: Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Govern > GOVERN 1.4

GOVERN 1.4: The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities. Categories Subcategories Continued on next page Table 1: Categories and subcategories for the GOVERN function. (Continued)
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 1.5

GOVERN 1.5: Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 1.6

GOVERN 1.6: Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 1.7

GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness. GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 2.1

GOVERN 2.1: Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 2.2

GOVERN 2.2: The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 2.3

GOVERN 2.3: Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment. GOVERN 3: Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 3.1

GOVERN 3.1: Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 3.2

GOVERN 3.2: Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems. GOVERN 4: Organizational teams are committed to a culture
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 4.1

GOVERN 4.1: Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts. Categories Subcategories Continued on next page Table 1: Categories and subcategories for the GOVERN function. (Continued) that considers and communicates AI risk.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 4.2

GOVERN 4.2: Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 4.3

GOVERN 4.3: Organizational practices are in place to enable AI testing, identification of incidents, and information sharing. GOVERN 5: Processes are in place for robust engagement with relevant AI actors.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 5.1

GOVERN 5.1: Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 5.2

GOVERN 5.2: Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation. GOVERN 6: Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > GOVERN 6.1

GOVERN 6.1: Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 1.1

MANAGE 1.1: A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 1.2

MANAGE 1.2: Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 1.3

MANAGE 1.3: Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 1.4

MANAGE 1.4: Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented. MANAGE 2: Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 2.1

MANAGE 2.1: Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 2.2

MANAGE 2.2: Mechanisms are in place and applied to sustain the value of deployed AI systems.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 2.3

MANAGE 2.3: Procedures are followed to respond to and recover from a previously unknown risk when it is identified.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 2.4

MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use. MANAGE 3: AI risks and benefits from third-party entities are managed.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 3.1

MANAGE 3.1: AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Manage > MANAGE 3.2

MANAGE 3.2: Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance. Categories Subcategories Continued on next page Table 4: Categories and subcategories for the MANAGE function. (Continued) MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MANAGE 4.1

MANAGE 4.1: Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MANAGE 4.2

MANAGE 4.2: Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MANAGE 4.3

MANAGE 4.3: Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented. Categories Subcategories 6.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 1.1

MAP 1.1: Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 1.2

MAP 1.2: Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 1.3

MAP 1.3: The organization's mission and relevant goals for AI technology are understood and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 1.4

MAP 1.4: The business value or context of business use has been clearly defined or - in the case of assessing existing AI systems - re-evaluated.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 1.6

MAP 1.6: System requirements (e.g., "the system shall respect the privacy of its users") are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks. MAP 2: Categorization of the AI system is performed.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 2.1

MAP 2.1: The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Map > MAP 2.2

MAP 2.2: Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions. Categories Subcategories Continued on next page Table 2: Categories and subcategories for the MAP function. (Continued)
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 2.3

MAP 2.3: Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation. MAP 3: AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 3.1

MAP 3.1: Potential benefits of intended AI system functionality and performance are examined and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 3.2

MAP 3.2: Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 3.3

MAP 3.3: Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 3.4

MAP 3.4: Processes for operator and practitioner proficiency with AI system performance and trustworthiness - and relevant technical standards and certifications - are defined, assessed, and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 3.5

MAP 3.5: Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function. MAP 4: Risks and benefits are mapped for all components of the AI system including third-party software and data.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 4.1

MAP 4.1: Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 4.2

MAP 4.2: Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented. MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 5.1

MAP 5.1: Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented. Categories Subcategories Continued on next page Table 2: Categories and subcategories for the MAP function. (Continued)
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MAP 5.2

MAP 5.2: Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented. Categories Subcategories 5.3 Measure The MEASURE function employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts. It uses knowledge relevant to AI risks identified in the MAP function and informs the MANAGE function. AI systems should be tested before their deployment and regularly while in operation. AI risk measurements include documenting aspects of systems' functionality and trustworthiness. Measuring AI risks includes tracking metrics for trustworthy characteristics, social impact, and human-AI configurations. Processes developed or adopted in the MEASURE function should include rigorous software testing and performance assessment methodologies with associated measures of uncertainty, comparisons to performance benchmarks, and formalized reporting and documentation of results. Processes for independent review can improve the effectiveness of testing and can mitigate internal biases and potential conflicts of interest. Where tradeoffs among the trustworthy characteristics arise, measurement provides a traceable basis to inform management decisions. Options may include recalibration, impact mitigation, or removal of the system from design, development, production, or use, as well as a range of compensating, detective, deterrent, directive, and recovery controls. After completing the MEASURE function, objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented. Metrics and measurement methodologies should adhere to scientific, legal, and ethical norms and be carried out in an open and transparent process. New types of measurement, qualitative and quantitative, may need to be developed. The degree to which each measurement type provides unique and meaningful information to the assessment of AI risks should be considered. Framework users will enhance their capacity to comprehensively evaluate system trustworthiness, identify and track existing and emergent risks, and verify efficacy of the metrics. Measurement outcomes will be utilized in the MANAGE function to assist risk monitoring and response efforts. It is incumbent on Framework users to continue applying the MEASURE function to AI systems as knowledge, methodologies, risks, and impacts evolve over time. Practices related to measuring AI risks are described in the NIST AI RMF Playbook. Table 3 lists the MEASURE function's categories and subcategories. Table 3: Categories and subcategories for the MEASURE function. MEASURE 1: Appropriate methods and metrics are identified and applied.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 1.1

MEASURE 1.1: Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 1.2

MEASURE 1.2: Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 1.3

MEASURE 1.3: Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance. MEASURE 2: AI systems are evaluated for trustworthy characteristics.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 2.1

MEASURE 2.1: Test sets, metrics, and details about the tools used during TEVV are documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.10

MEASURE 2.10: Privacy risk of the AI system - as identified in the MAP function - is examined and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.11

MEASURE 2.11: Fairness and bias - as identified in the MAP function - are evaluated and results are documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.12

MEASURE 2.12: Environmental impact and sustainability of AI model training and management activities - as identified in the MAP function - are assessed and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.13

MEASURE 2.13: Effectiveness of the employed TEVV metrics and processes in the MEASURE function are evaluated and documented. MEASURE 3: Mechanisms for tracking identified AI risks over time are in place.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 2.2

MEASURE 2.2: Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 2.3

MEASURE 2.3: AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 2.4

MEASURE 2.4: The functionality and behavior of the AI system and its components - as identified in the MAP function - are monitored when in production.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Measure > MEASURE 2.5

MEASURE 2.5: The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented. Categories Subcategories Continued on next page Table 3: Categories and subcategories for the MEASURE function. (Continued)
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.6

MEASURE 2.6: The AI system is evaluated regularly for safety risks - as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.7

MEASURE 2.7: AI system security and resilience - as identified in the MAP function - are evaluated and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.8

MEASURE 2.8: Risks associated with transparency and accountability - as identified in the MAP function - are examined and documented.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 2.9

MEASURE 2.9: The AI model is explained, validated, and documented, and AI system output is interpreted within its context - as identified in the MAP function - to inform responsible use and governance.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Subcategories > MEASURE 3.1

MEASURE 3.1: Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.