NIST AI RMF 1.0
NIST AI RMF Control Mapping
Clear visibility into how WhiteBox XAI aligns with the NIST AI RMF MAP, MEASURE, MANAGE, and GOVERN functions.
The NIST AI Risk Management Framework provides a voluntary, flexible approach to managing AI risk. WhiteBox XAI accelerates your alignment by automating technical measurement (drift, fairness) and providing a centralized workflow for risk mapping and governance.
Platform Automated
Platform Workflow
Customer Responsibility
GOVERN — A culture of AI risk management is cultivated and present
GOVERN-1
Your Org
GOVERN 1 — Policies, processes, procedures and practices for mapping, measuring and managing AI risks are in place, transparent and implemented effectively
The organization's uploaded AI governance policy and the platform's audit trail and compliance assessment history, evidencing that policies exist and are followed.
GOVERN-2
Your Org
GOVERN 2 — Accountability structures are in place so the appropriate teams and individuals are empowered, responsible and trained
The RBAC role assignments, the RACI matrix and review-board membership, together with the organization's uploaded training records.
GOVERN-3
Your Org
GOVERN 3 — Workforce diversity, equity, inclusion and accessibility processes are prioritized
The organization's uploaded workforce diversity, equity, inclusion and accessibility policies for its AI risk work. The platform does not evidence this itself.
GOVERN-4
Your Org
GOVERN 4 — Organizational teams are committed to a culture that considers and communicates AI risk
The organization's uploaded records of its risk-culture practices, such as training and communication. The platform does not evidence this itself.
GOVERN-5
Your Org
GOVERN 5 — Processes are in place for robust engagement with relevant AI actors
The organization's uploaded records of engagement with relevant AI actors and stakeholders. The platform does not evidence this itself.
GOVERN-6
Your Org
GOVERN 6 — Policies and procedures address AI risks and benefits arising from third-party software and data and other supply chain issues
The organization's uploaded vendor assessments and third-party policies for AI components and data.
MAP — Context is recognized and risks related to context are identified
MAP-1
Workflow
MAP 1 — Context is established and understood
The model card's intended use and deployment context, and the registered model type.
MAP-2
Automated
MAP 2 — Categorization of the AI system is performed
The system's recorded risk-tier classification and model type.
MAP-3
Workflow
MAP 3 — AI capabilities, targeted usage, goals and expected benefits and costs are understood against appropriate benchmarks
The model card's capabilities and the model's registered baseline metrics.
MAP-4
Your Org
MAP 4 — Risks and benefits are mapped for all components of the AI system, including third-party software and data
The risk register's per-system entries, data-lineage records and the organization's uploaded vendor assessments for third-party components.
MAP-5
Your Org
MAP 5 — Impacts to individuals, groups, communities, organizations and society are characterized
The risk register's per-system entries and the organization's uploaded impact assessments. The platform does not generate an impact assessment.
MEASURE — Identified risks are analyzed, assessed, benchmarked and monitored
MEASURE-1
Automated
MEASURE 1 — Appropriate methods and metrics are identified and applied
The drift, performance and fairness metrics the platform computes for each model.
MEASURE-2
Automated
MEASURE 2 — AI systems are evaluated for trustworthy characteristics
Fairness audits, explainability output, drift monitoring and trust-score history evidencing evaluation against trustworthy-AI characteristics.
MEASURE-3
Automated
MEASURE 3 — Mechanisms for tracking identified AI risks over time are in place
Drift-monitoring history, alerts and trust-score history for each model.
MEASURE-4
Your Org
MEASURE 4 — Feedback about the efficacy of measurement is gathered and assessed
The organization's uploaded reviews of its measurement approach. The platform does not evidence this itself.
MANAGE — Risks are prioritized and acted upon based on a projected impact
MANAGE-1
Workflow
MANAGE 1 — AI risks based on MAP and MEASURE output are prioritized, responded to and managed
The risk register's prioritization and mitigation plans.
MANAGE-2
Workflow
MANAGE 2 — Strategies to maximize AI benefits and minimize negative impacts are planned, implemented and documented
The risk register's mitigation plans and the fairness audit's mitigation recommendations.
MANAGE-3
Your Org
MANAGE 3 — AI risks and benefits from third-party entities are managed
The organization's uploaded vendor assessments for third-party AI risk.
MANAGE-4
Workflow
MANAGE 4 — Risk treatments, including response and recovery, and communication plans are documented and monitored regularly
The incident register and the monitoring reports showing treatments are tracked after deployment.
See what your AI has been hiding.
Request an enterprise demo and walk through real drift detection, explainability, and governance workflows.