The NIST AI Risk Management Framework is a free, voluntary framework for managing the risks AI creates for people, organisations and society. It is fast becoming the common language enterprise customers, insurers and auditors use when they ask how you control AI.
Every client we have taken through an accreditation has achieved it - and kept it at every renewal.
We submit ourselves to independent third-party testing. Certification is always issued by an independent body, never by us.
We prove each control works on your real devices and services. Questionnaire answers can be inaccurate or optimistic; tests cannot.
We will look at your current position for free and tell you exactly which controls you need - with no obligation.
NIST AI RMF 1.0 (NIST AI 100-1) was published by the US National Institute of Standards and Technology on 26 January 2023. It organises AI risk management into four functions: Govern, Map, Measure and Manage. Govern runs through everything; Map, Measure and Manage apply to each AI system across its life cycle.
It describes what trustworthy AI looks like: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. A companion Playbook suggests practical actions for each part, and the Generative AI Profile (NIST AI 600-1, July 2024) adds risks and actions specific to generative AI such as Copilot and ChatGPT.
Unlike ISO 42001 there is no certificate. The framework is used to structure your AI governance and to answer customer and tender questions with evidence. NIST is revising AI RMF 1.0, so we keep your controls aligned with the current version.
AI policy, named owners and accountability, staff training and an AI risk appetite the board has agreed.
An inventory of every AI tool and use case, its purpose, the data it touches and who could be affected.
Testing and monitoring of AI for accuracy, security, privacy and bias, with results recorded against each system.
Risks prioritised and treated, incidents handled, suppliers checked and AI switched off when it is not safe.
Data kept out of public models, prompt and output monitoring, and self-connected AI apps blocked until approved.
Policies, registers and test results ready to share when a customer or tender asks how you manage AI risk.
Govern runs through everything. Map, Measure and Manage are repeated for every AI tool you use, from Copilot to private AI on your own hardware.
Culture, policy and accountability
Context and use cases
Test and monitor
Treat and respond
One set of controls serves both frameworks. Start with NIST, certify to ISO 42001 when a customer asks.
| NIST function | What Total Group provides | Closest ISO 42001 area |
|---|---|---|
| Govern | AI policy templates, named owners, board reporting and staff training | Clauses 5 to 7, Annex A AI policy and roles |
| Map | The AI register, data mapping and AI supplier reviews | Clauses 4 and 6, impact assessment, AI resources |
| Measure | Penetration testing, M365 and Copilot security scans, 24/7 SIEM and SOC monitoring | Clause 9, AI system life cycle |
| Manage | Total MFA and conditional access, app blocking, backup and incident response | Clauses 8 and 10, responsible use |
NIST AI RMF is published by the US National Institute of Standards and Technology. Total Group is not affiliated with NIST; the framework is free to use. Source: nist.gov/itl/ai-risk-management-framework.
Related: ISO 42001 · free AI Readiness review · Total MFA · private AI hardware
We review your devices, cloud services and processes against NIST AI RMF and show you where you stand.
We fix or guide you through every control that would fail, in priority order.
We prove each control works - scans, patch checks, malware tests, restores and MFA checks - before anyone else looks.
Policies, registers and test results packaged for customers, insurers and auditors, and ready for ISO 42001 certification if you need it.
We monitor your controls in real time and fix drift as it happens, so renewal is a normal day, not a cliff edge.
Our own intellectual property is how we run compliance: we monitor the major NIST AI RMF controls in real time using the leading enterprise SaaS tools. That lets us map gaps and bridge controls quickly and accurately while you work towards accreditation - and then keep standards up, and risk down, every day after it.
We watch the major controls continuously using leading enterprise SaaS security and compliance tools - not once a year with a questionnaire.
Live data shows exactly which controls are missing or drifting, so we can map the gaps and bridge them quickly and accurately.
Every change to your systems follows a compliant change process, so an upgrade or a new starter never quietly breaks a control.
Issues are picked up and fixed as they happen. Your risk goes down over the year instead of creeping up until the next audit.
Annual review is not viable in the current threat landscape. Attackers do not wait twelve months - so neither do we.
Certification is a snapshot. Our compliance plans keep the controls tested, the evidence current and renewals handled - Level 1 demonstrates, Level 2 practises and Level 3 proves compliance continuously.
CE and Digital GDPR Controls - Our consultants will complete the CE submission with input from your staff.
CE, CE+ and Digital GDPR Controls -Monitoring & Submission as a Service (Submission following Quarter)
CE, CE+, GDPR Governance, Supply Chain Audits, Pen Testing, Vulnerability Scanning, (Real-time Maintained) Compliance As A Service
No. It is a voluntary US framework, but it is widely used internationally and many enterprise and US customers now ask suppliers to show they follow it or something equivalent.
No. There is no NIST AI RMF certificate. If you need a certificate, ISO 42001 is the certifiable AI management standard, and the two map closely so the same controls serve both.
NIST AI RMF tells you what good AI risk management looks like; ISO 42001 turns that into an auditable management system. Many businesses use NIST to get the controls in place, then certify to ISO 42001 when a customer asks.
Yes. The framework covers using AI as well as building it, and the Generative AI Profile was written for exactly these tools.
For a small or medium business, the core Govern and Map work typically takes a few weeks. Measure and Manage then run as ongoing controls, which we operate for you.
We monitor the major controls in real time using leading enterprise SaaS tools, with compliant change management behind every change. Gaps are found and bridged quickly, standards are maintained every day, and accreditation stops being a fraught cliff edge - you can say you were compliant yesterday, not a year ago.
Controls drift: devices miss patches, accounts change, new services appear. With an annual review that drift goes unnoticed for months while risk rises. Real-time monitoring catches it as it happens, so issues are fixed quickly and your compliance improves rather than decays.
Book a free, no-obligation NIST AI RMF assessment. We will show you which controls you already meet, which you need, and the quickest route to a framework you can evidence.
Loading secure payment form...
Secure payment by Stripe. Change your details
