NIST AI Risk Management Framework: Govern, Map, Measure, Manage — Plus Ongoing Governance Practices

The NIST AI Risk Management Framework (AI RMF), published by the U.S. National Institute of Standards and Technology, is a voluntary, widely adopted framework that organizes AI risk-management work into four core functions: Govern, Map, Measure, and Manage. When an exam question describes “a single, widely recognized framework organizing AI risk activities into governance, context-mapping, measurement, and ongoing management,” the NIST AI RMF is the answer — not ISO 9001, not GDPR (the EU’s General Data Protection Regulation), not an AWS service.

The four functions

Govern is the cross-cutting foundation. It establishes the organizational structures that make risk management possible at all: accountability and roles, risk-tolerance policies, escalation paths, workforce training, and a culture where AI risk is owned by named people. Critically, Govern activities happen — and make sense — before any specific AI use case exists. An organization assigning AI accountability roles and defining risk-tolerance policies before choosing a single project is doing Govern work.

Map establishes context for a specific AI system or use case. Here you identify what the system will do, who it affects, what could go wrong in this context, and what the risk profile looks like. Map is where abstract policy meets a concrete application: the same model can carry very different risk when mapped into hiring versus product search.

Measure quantifies the risks Map identified. This is where metrics, testing, and evaluation live: bias measurements, accuracy and robustness testing, red-teaming results, tracking risk indicators over time. Tools like Amazon SageMaker Clarify (bias and explainability reports) and model evaluation in Amazon Bedrock produce Measure-style evidence.

Manage acts on what was measured: prioritizing risks against the tolerance Govern defined, applying mitigations, accepting or transferring residual risk, responding to incidents, and monitoring deployed systems so the loop keeps running.

Govern vs. Map — the exam’s favorite distinction

	Govern	Map
Scope	Organization-wide, cross-cutting	One AI system or use case at a time
Timing	Can precede any specific project	Requires a concrete context to analyze
Output	Roles, accountability structures, risk-tolerance policy, training programs	Context description, stakeholder impacts, identified risks for this system
Question it answers	”Who owns AI risk here, and how much risk will we accept?"	"What is this system, and what could it do wrong in this setting?”

If the scenario has no specific use case yet — just committees, role assignments, and policy-setting — it’s Govern. The moment it’s about identifying risks of a particular system in a particular context, it’s Map.

Governance is ongoing, not a launch checklist

The AIF-C01 exam repeatedly draws one line: mature AI governance is a continuous process, while immature governance is a one-time setup task. Practices that signal an ongoing review process include:

• Scheduled periodic reviews of deployed models — reassessing performance, bias, and drift on a cadence, not just at launch.
• Independent human audits — periodic review of a deployed system’s decisions by people who did not build the model, hunting for unfair or untrustworthy outcome patterns that automated metrics miss. Because the reviewers are independent and it recurs, this is an audit practice, distinct from the everyday human-in-the-loop approval of individual predictions.
• Updating policies as regulations and use cases change — governance documents are living artifacts.
• Continuous monitoring with defined escalation — production alarms for drift or anomalous behavior, wired to owners who must act.
• Recurring workforce training — for example, requiring every employee to complete a responsible-AI training module covering acceptable use and data handling before using a generative AI assistant with customer data. The governance objective this fulfills is building organizational AI literacy and ensuring employees understand and follow responsible-use policy — a Govern-function control, and an ongoing one as tools and rules evolve.

One-time counterparts — writing an initial policy document, running a single pre-launch bias test, appointing a committee once and never reconvening — are the distractors.

The framework in an AWS context

The NIST AI RMF is vendor-neutral, but AIF-C01 expects you to see how AWS services generate its evidence. AWS CloudTrail and AWS Config supply the audit logging and configuration history that accountability requires; AWS Audit Manager maps collected evidence to compliance frameworks; Amazon SageMaker Model Monitor detects data and prediction drift in production (feeding Measure and Manage); SageMaker Model Cards and AWS AI Service Cards document intended use and limitations; and Guardrails for Amazon Bedrock enforce content and safety policy at inference time. For the measurement side of fairness specifically, see AI bias and fairness; for how legal regimes impose some of these duties from outside, see the EU AI Act and algorithmic accountability laws.

How the AIF-C01 exam tests this

The NIST AI RMF anchors the Security, Compliance, and Governance domain — the full AIF-C01 study guide breaks down that domain’s weight and the exam’s format, and the function-classification patterns below are staples of the practice exam bank.

• Framework identification. A stem lists the four functions (or paraphrases them as governance, context-mapping, measurement, ongoing management) and asks which framework this is. Answer: the NIST AI Risk Management Framework.
• Function classification. A scenario describes an activity — assigning accountability roles and risk tolerance before selecting use cases (Govern), characterizing a specific system’s context and stakeholders (Map), running bias metrics (Measure), applying mitigations and monitoring (Manage) — and asks where it belongs. Watch for the Govern-vs-Map contrast: organization-wide-and-early versus system-specific.
• Ongoing vs. one-time. A multiple-response item asks which practices reflect a mature, continuous governance process. Pick recurring reviews, independent audits, and policy updates; reject anything framed as done-once-at-setup.
• Name the practice. A company wants periodic, independent human review of a deployed system’s decisions to catch unfairness automated metrics miss. That is a human audit (algorithm audit) — not human-in-the-loop approval, not monitoring dashboards, not retraining.
• Training-requirement framing. Mandatory responsible-AI training before employees touch a generative tool fulfills the governance objective of workforce AI literacy and policy compliance.

Quick reference

• NIST AI RMF = voluntary framework with four functions: Govern, Map, Measure, Manage.
• Govern: cross-cutting accountability, roles, risk tolerance, training — can exist before any specific use case.
• Map: establish context and identify risks for one specific system; needs a concrete use case.
• Measure: quantify and test the mapped risks (bias metrics, evaluations, red-teaming).
• Manage: prioritize, mitigate, monitor, and respond based on measurements and tolerance.
• Mature governance is continuous: periodic reviews, independent human audits, policy updates, monitored escalation paths.
• Independent periodic review of a deployed model’s decisions by non-builders = human/algorithm audit.
• Mandatory responsible-AI training = Govern-function control building AI literacy and policy compliance.
• AWS evidence stack: CloudTrail, AWS Config, Audit Manager, SageMaker Model Monitor, Model Cards, Guardrails for Amazon Bedrock.