AI governance, in the same platform as everything else.
AI risk belongs in the same program as everything else. TruOps assesses it against the NIST AI RMF using the same assessments, evidence, and register you already use.
NIST AI RMF profile
Subcategories addressed, by function, current vs target
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
The NIST AI Risk Management Framework (AI RMF 1.0), released in January 2023, is voluntary guidance for managing risks from AI systems. It is organized into four functions: Govern, Map, Measure, and Manage. NIST published a Generative AI Profile (NIST AI 600-1) in July 2024 that applies the framework to generative AI.
- Published by
- NIST
- Version
- AI RMF 1.0 (January 2023)
- Functions
- Govern, Map, Measure, and Manage
- Companion
- Generative AI Profile, NIST AI 600-1
The four functions
| Function | Focus |
|---|---|
| Govern | Culture, policies, roles, and accountability for AI risk |
| Map | Context: what the AI system is for, who it affects, and what could go wrong |
| Measure | Analysis and tracking of AI risks and trustworthiness characteristics |
| Manage | Prioritizing and acting on risks, and monitoring over time |
The challenge
AI risk often gets tracked in a side spreadsheet while models ship. The NIST AI RMF works best when every AI system has an owner, evidence, and risks in the same register as everything else.
- Govern, Map, Measure, and Manage were covered in one workshop and never revisited.
- You can't see the AI built into the SaaS products you buy.
- ISO 42001 is coming next and would mean starting over.
What you're probably using today
Almost nobody starts NIST AI RMF from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
Trustworthy AI characteristics
The framework describes trustworthy AI as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
How TruOps helps with the NIST AI RMF
Pick the NIST AI RMF as your anchor, or map it to the framework you already run. TruOps keeps the NIST AI RMF's own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your NIST AI RMF assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
Many AI RMF outcomes overlap with ISO/IEC 42001 and with controls you already run for SOC 2 or ISO 27001. TruOps shows how much of your AI RMF readiness those controls already cover.
How TruOps helps
- Anchor or map
- Use AI RMF as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your AI RMF assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
Is the NIST AI RMF mandatory?
No. It's voluntary guidance, though customers, contracts, and policies reference it more and more.
How does the AI RMF relate to ISO/IEC 42001?
The AI RMF is voluntary guidance, while ISO/IEC 42001 is a certifiable management system standard. Their concepts overlap, and they're often mapped to each other.
Can TruOps assess our AI systems?
Yes. Scope an assessment to an AI system or business process and run an AI RMF or ISO 42001 questionnaire, just like any other assessment.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
The certifiable AI management system standard.
→Use casesAI governanceFind every AI tool and agent, see what it can reach, and assess it against NIST AI RMF, ISO 42001, and the EU AI Act.
→LearnWhat is AI GRC?When AI does the work of governance, risk, and compliance.
→LearnHuman-in-the-loop AI in GRCWhy AI should draft and people should decide.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.