NIST AI RMF Crosswalk
Purpose: Let a team that organises its AI risk programme around the NIST AI Risk Management Framework find the wiki control objectives and test cases for each subcategory, and see which subcategories the wiki does not reach.
Audience: GRC, risk and audit teams; security architecture; programme owners who report against the AI RMF.
Using the two together: Use the AI RMF for the structure and language of the programme. Use this wiki for the control objectives, evidence, audit procedures and test cases behind each subcategory.
About the framework and this page
The AI Risk Management Framework 1.0 (NIST AI 100-1) was published by the US National Institute of Standards and Technology in January 2023. Its Core has four functions, Govern, Map, Measure and Manage, divided into 19 categories and 72 subcategories. NIST publishes the Core at https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; the list of subcategory numbers used here was checked against that page on 10 October 2026.
The tables are generated each time the site is built. They are read from the NIST AI RMF field of each control in the AI Security Control Objectives Library and from the NIST AI RMF Mapping field of each test case. To change a mapping, edit the control or the test case; this page follows on the next build.
Verify before use. A control citing a subcategory means the control helps to meet it, not that it meets it in full. The mappings are the wiki's own judgment and have not been reviewed by NIST. Read the subcategory text before relying on a mapping in an audit.
How to read the tables
- Wiki controls are the control objectives whose record cites the subcategory.
- Test cases under those controls counts the distinct test cases that test at least one of those controls.
- Test cases that cite it counts the test cases whose own record names the subcategory. Cases in layers L01 to L03 name a function and not a subcategory, so they are not counted in this column.
Subcategories to wiki controls
47 of the 72 subcategories are cited by at least one control.
Govern
| Subcategory | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|
| GOVERN 1.1 | AI-CTRL-007; AI-CTRL-013; AI-CTRL-042; AI-CTRL-043 | 55 | 128 |
| GOVERN 1.2 | AI-CTRL-012 | 7 | 0 |
| GOVERN 1.3 | AI-CTRL-011; AI-CTRL-037 | 28 | 0 |
| GOVERN 1.4 | AI-CTRL-010; AI-CTRL-012 | 33 | 0 |
| GOVERN 1.5 | AI-CTRL-038 | 17 | 0 |
| GOVERN 1.6 | AI-CTRL-001; AI-CTRL-006; AI-CTRL-011 | 62 | 0 |
| GOVERN 1.7 | AI-CTRL-011 | 18 | 0 |
| GOVERN 2.1 | AI-CTRL-012 | 7 | 0 |
| GOVERN 2.2 | AI-CTRL-012; AI-CTRL-044 | 8 | 0 |
| GOVERN 2.3 | None | 0 | 0 |
| GOVERN 3.1 | None | 0 | 0 |
| GOVERN 3.2 | AI-CTRL-023; AI-CTRL-045 | 9 | 0 |
| GOVERN 4.1 | None | 0 | 0 |
| GOVERN 4.2 | AI-CTRL-033 | 6 | 0 |
| GOVERN 4.3 | AI-CTRL-034; AI-CTRL-035 | 74 | 0 |
| GOVERN 5.1 | AI-CTRL-043 | 1 | 0 |
| GOVERN 5.2 | None | 0 | 0 |
| GOVERN 6.1 | AI-CTRL-001; AI-CTRL-004; AI-CTRL-007; AI-CTRL-014; AI-CTRL-024; AI-CTRL-031 | 118 | 73 |
| GOVERN 6.2 | AI-CTRL-014; AI-CTRL-035; AI-CTRL-040 | 72 | 0 |
Map
| Subcategory | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|
| MAP 1.1 | AI-CTRL-011; AI-CTRL-042 | 19 | 36 |
| MAP 1.2 | None | 0 | 0 |
| MAP 1.3 | None | 0 | 0 |
| MAP 1.4 | None | 0 | 0 |
| MAP 1.5 | AI-CTRL-037 | 10 | 0 |
| MAP 1.6 | None | 0 | 0 |
| MAP 2.1 | None | 0 | 0 |
| MAP 2.2 | AI-CTRL-039 | 8 | 0 |
| MAP 2.3 | AI-CTRL-019; AI-CTRL-029 | 28 | 20 |
| MAP 3.1 | None | 0 | 0 |
| MAP 3.2 | None | 0 | 0 |
| MAP 3.3 | None | 0 | 0 |
| MAP 3.4 | AI-CTRL-044 | 1 | 0 |
| MAP 3.5 | AI-CTRL-023; AI-CTRL-045 | 9 | 0 |
| MAP 4.1 | AI-CTRL-007; AI-CTRL-024; AI-CTRL-029; AI-CTRL-031; AI-CTRL-046 | 70 | 26 |
| MAP 4.2 | AI-CTRL-024; AI-CTRL-030; AI-CTRL-032 | 58 | 0 |
| MAP 5.1 | AI-CTRL-013; AI-CTRL-041; AI-CTRL-042 | 43 | 0 |
| MAP 5.2 | None | 0 | 0 |
Measure
| Subcategory | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|
| MEASURE 1.1 | None | 0 | 0 |
| MEASURE 1.2 | AI-CTRL-038 | 17 | 0 |
| MEASURE 1.3 | AI-CTRL-038 | 17 | 0 |
| MEASURE 2.1 | AI-CTRL-034 | 36 | 0 |
| MEASURE 2.2 | None | 0 | 0 |
| MEASURE 2.3 | None | 0 | 0 |
| MEASURE 2.4 | AI-CTRL-006; AI-CTRL-008; AI-CTRL-009 | 55 | 52 |
| MEASURE 2.5 | AI-CTRL-028; AI-CTRL-039 | 26 | 9 |
| MEASURE 2.6 | AI-CTRL-034; AI-CTRL-039 | 44 | 27 |
| MEASURE 2.7 | AI-CTRL-005; AI-CTRL-015; AI-CTRL-016; AI-CTRL-017; AI-CTRL-018; AI-CTRL-019; AI-CTRL-020; AI-CTRL-021; AI-CTRL-022; AI-CTRL-026; AI-CTRL-027; AI-CTRL-028; AI-CTRL-029; AI-CTRL-030; AI-CTRL-032; AI-CTRL-033; AI-CTRL-034; AI-CTRL-036; AI-CTRL-040 | 376 | 225 |
| MEASURE 2.8 | AI-CTRL-008; AI-CTRL-015 | 62 | 1 |
| MEASURE 2.9 | AI-CTRL-041 | 3 | 0 |
| MEASURE 2.10 | AI-CTRL-002; AI-CTRL-003; AI-CTRL-004; AI-CTRL-013; AI-CTRL-017; AI-CTRL-018; AI-CTRL-020; AI-CTRL-021; AI-CTRL-026; AI-CTRL-029 | 159 | 92 |
| MEASURE 2.11 | AI-CTRL-041 | 3 | 0 |
| MEASURE 2.12 | None | 0 | 0 |
| MEASURE 2.13 | None | 0 | 0 |
| MEASURE 3.1 | AI-CTRL-009 | 22 | 0 |
| MEASURE 3.2 | None | 0 | 0 |
| MEASURE 3.3 | None | 0 | 0 |
| MEASURE 4.1 | None | 0 | 0 |
| MEASURE 4.2 | None | 0 | 0 |
| MEASURE 4.3 | None | 0 | 0 |
Manage
| Subcategory | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|
| MANAGE 1.1 | AI-CTRL-033 | 6 | 0 |
| MANAGE 1.2 | AI-CTRL-037 | 10 | 0 |
| MANAGE 1.3 | AI-CTRL-005; AI-CTRL-010; AI-CTRL-016; AI-CTRL-022; AI-CTRL-027 | 147 | 4 |
| MANAGE 1.4 | AI-CTRL-037 | 10 | 0 |
| MANAGE 2.1 | None | 0 | 0 |
| MANAGE 2.2 | None | 0 | 0 |
| MANAGE 2.3 | AI-CTRL-025; AI-CTRL-035; AI-CTRL-040 | 61 | 209 |
| MANAGE 2.4 | AI-CTRL-025 | 11 | 1 |
| MANAGE 3.1 | AI-CTRL-014; AI-CTRL-024; AI-CTRL-031 | 61 | 1 |
| MANAGE 3.2 | AI-CTRL-031 | 24 | 0 |
| MANAGE 4.1 | AI-CTRL-002; AI-CTRL-003; AI-CTRL-004; AI-CTRL-008; AI-CTRL-009; AI-CTRL-036 | 110 | 183 |
| MANAGE 4.2 | AI-CTRL-038 | 17 | 0 |
| MANAGE 4.3 | AI-CTRL-035 | 39 | 0 |
Subcategories that no control cites
GOVERN 2.3, GOVERN 3.1, GOVERN 4.1, GOVERN 5.2, MAP 1.2, MAP 1.3, MAP 1.4, MAP 1.6, MAP 2.1, MAP 3.1, MAP 3.2, MAP 3.3, MAP 5.2, MEASURE 1.1, MEASURE 2.2, MEASURE 2.3, MEASURE 2.12, MEASURE 2.13, MEASURE 3.2, MEASURE 3.3, MEASURE 4.1, MEASURE 4.2, MEASURE 4.3, MANAGE 2.1, MANAGE 2.2.
Attribution
NIST publications are works of the United States Government. This page cites subcategory numbers only and does not reproduce the text of the framework.