Read 18 selected NIST references. Each has a page number, a toolkit link, and a clear limit.
This map covers selected parts only. The toolkit helps people review writing. It does not put the whole AI RMF into practice, test an AI system, or show NIST approval.
How to read the mapping
Practical support for a selected aspect means the toolkit helps with one named part of the guidance. Contextual connection means the idea is related, but the toolkit does not do the AI-system task. Not covered means the toolkit does not support that task.
The source check used NIST AI 100-1, AI RMF 1.0 (January 2023), and NIST AI 600-1, Generative AI Profile (July 2024). Each row gives the printed page and the PDF page, counted from page 1. A new date on a web page does not mean the linked document is a new edition.
Source meaning in our words: Plan ongoing checks. Name an owner and choose how often to review.
Where the toolkit helps: The guide asks for a check date or trigger, a reason, and an owner. The schedule form records the work to check, owner and backup, priority, selection method, findings, and next change.
Limit: The publisher must assign people and do the checks. A blank form does not show that this happens.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 1; printed page 23; PDF page 28. Identifier: GOVERN 1.5. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
GOVERN 2.1
Source meaning in our words: Record who handles AI risks and how people should contact them.
Where the toolkit helps: The guide separates checking, human approval, a second review, and asking for help. The roles form asks for a contact route, correction owner, backup, and a reason to check the roles again.
Limit: A small-team form does not show that the whole organization has assigned or shared these roles.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 1; printed page 23; PDF page 28. Identifier: GOVERN 2.1. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MAP 1.1
Source meaning in our words: Record the intended use, setting, users, effects, and limits.
Where the toolkit helps: The guide asks who will use the content, what could happen if it is wrong, what time it describes, and what was not checked. Set that context before judging claims.
Limit: This covers the chosen publishing task. It does not fully assess the wider legal, social, environmental, business, or life-cycle setting.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 2; printed page 26; PDF page 31. Identifier: MAP 1.1. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MAP 3.5
Source meaning in our words: Define, assess, and record how people oversee the work.
Where the toolkit helps: The guide names human roles, separates Ready from Approved, blocks unresolved issues, and ties approval to one version. Follow-up questions ask whether owners acted and whether important changes were missed.
Limit: A recorded decision does not prove that oversight works or that an organization uses the process.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 2; printed page 27; PDF page 32. Identifier: MAP 3.5. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MEASURE 1.1
Source meaning in our words: Choose which risks to measure first. Record risks you did not measure.
Where the toolkit helps: The guide starts with risks that matter to readers. Four measures ask for dates, totals, selection rules, exclusions, and gaps. The form records priority, what is counted, how, what is not measured, and the next action. Results stay blank until measured.
Limit: These are example measures for publishing, with a blank record for choosing measures and noting gaps. The user must choose suitable measures and gather data. This does not assess all AI risks or prove results.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 3; printed page 29; PDF page 34. Identifier: MEASURE 1.1. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Contextual connection
MEASURE 2.1
Source meaning in our words: Record the data, measures, and tools used in testing.
Where the toolkit helps: The methods page keeps practice cases separate from software tests. The guide asks for the version, task, materials, steps, kind of reviewer, findings, measures, and limits. These show how to record a test. They are not AI-system testing, evaluation, verification, and validation (TEVV) results.
Limit: Made-up cases and software checks do not test an AI system or show real-world AI accuracy.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 3; printed page 29; PDF page 34. Identifier: MEASURE 2.1. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Contextual connection
MEASURE 2.5
Source meaning in our words: Show whether results are valid and reliable. Record where they may not apply.
Where the toolkit helps: The guide separates made-up practice, dated source examples, software checks, agent checks, and human studies. It says these examples do not prove broad reliability or results for an AI system.
Limit: The toolkit does not prove that a model is valid or reliable, or that its results apply elsewhere. It helps explain why a broad claim may lack proof.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 3; printed page 29; PDF page 34. Identifier: MEASURE 2.5. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MEASURE 2.8
Source meaning in our words: Check and record risks from unclear information or responsibility.
Where the toolkit helps: The guide asks whether readers could wrongly assume independent reporting, a current check, or a wider review. It also asks who owns corrections. Record the risk and the source credit, date, limit, or contact detail used to address it.
Limit: The questions address selected risks about credit, dates, ownership, and disclosure in publishing. They do not fully assess an AI system’s transparency or accountability.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 3; printed page 30; PDF page 35. Identifier: MEASURE 2.8. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MANAGE 4.1
Source meaning in our words: Put monitoring, feedback, error response, recovery, and change steps in place.
Where the toolkit helps: The guide names check triggers, an owner, and a correction route that the publisher must monitor. It asks about late or missed checks. Correction steps cover limiting spread, checking evidence and related content, choosing who to tell, and recording actions actually done.
Limit: This helps with a limited publishing task. It is not a full management program for an AI system in use.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 4; printed page 33; PDF page 38. Identifier: MANAGE 4.1. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MANAGE 4.3
Source meaning in our words: Tell the right people about incidents. Record the response and recovery.
Where the toolkit helps: The correction form records the content and version, evidence, owner, steps to limit spread, corrected words, new check, related content, who to tell, and where and when work finished. A plan to send a notice is kept separate from a sent notice.
Limit: The organization must decide who is affected, act, and record what it actually told people and fixed.
NIST AI 100-1 · AI RMF 1.0; Section 5; Table 4; printed page 33; PDF page 38. Identifier: MANAGE 4.3. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
GV-1.5-001
Source meaning in our words: Assign people to check source history and watch for incidents on a schedule.
Where the toolkit helps: Source records include publishers, places to find evidence, access limits, and shared origins. The schedule assigns owners for changed sources, reader reports, and open issues. It records when to check and what was found.
Limit: An owner field and schedule are just a form. They do not prove that people followed through.
NIST AI 600-1 · Generative AI Profile; Section 3; GOVERN 1.5; printed page 16; PDF page 20. Identifier: GV-1.5-001. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
GV-1.5-003
Source meaning in our words: Keep a policy for retaining test records and content history.
Where the toolkit helps: The guide and policy form ask for an owner, record types including test records, a period or deletion trigger, reasons, permitted evidence, file links, access, deletion decisions, and policy review. They set no universal period.
Limit: Saving a file is not a retention policy. Each organization must choose how long to keep records. NIST does not set one period here for everyone.
NIST AI 600-1 · Generative AI Profile; Section 3; GOVERN 1.5; printed page 16; PDF page 20. Identifier: GV-1.5-003. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MS-2.5-001
Source meaning in our words: Do not make broad capability claims from a small or informal test.
Where the toolkit helps: The guide keeps practice, source checks, software tests, and agent checks separate from human studies. It says not to infer detection rates, time savings, less harm, or model reliability from examples. Claims about results need the test steps, observations, and limits.
Limit: A small set of made-up cases cannot prove better results, less harm, or real-world AI accuracy.
NIST AI 600-1 · Generative AI Profile; Section 3; MEASURE 2.5; printed page 31; PDF page 35. Identifier: MS-2.5-001. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MS-2.5-003
Source meaning in our words: Check output sources and citations before use and during later monitoring.
Where the toolkit helps: The guide asks you to open sources, match identity and context, and record where the evidence is and what was checked. Each key claim links to evidence. Support, source suitability, and date fit stay separate. Later checks revisit changing sources and linked claims.
Limit: A person supplies the judgments. A source link alone cannot prove support, source fit, accuracy, or current truth.
NIST AI 600-1 · Generative AI Profile; Section 3; MEASURE 2.5; printed page 31; PDF page 35. Identifier: MS-2.5-003. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Not covered
MS-2.8-003
Source meaning in our words: Keep traceable content history with methods that protect it from tampering.
Where the toolkit helps: The methods page says editable records, saved versions, and file hashes cannot prove identity, prove event times, or prevent tampering. The toolkit has no protected source-history system. This is why the action is Not covered.
Limit: Not covered. Editable files and hashes alone do not provide the protection this action describes.
NIST AI 600-1 · Generative AI Profile; Section 3; MEASURE 2.8; printed page 34; PDF page 38. Identifier: MS-2.8-003. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Not covered
MS-2.8-004
Source meaning in our words: Test whether instructions for users of a generative AI system are adequate.
Where the toolkit helps: The methods page separates worksheet usability checks from tests of a generative AI system’s user instructions. No such instruction test is reported. The guide also marks this action Not covered.
Limit: Not covered. This release has not tested those instructions with users. An AI walkthrough is not human research.
NIST AI 600-1 · Generative AI Profile; Section 3; MEASURE 2.8; printed page 34; PDF page 38. Identifier: MS-2.8-004. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MG-4.1-002
Source meaning in our words: Keep and assess ways to monitor generative AI after it is put into use.
Where the toolkit helps: The guide asks whether source changes were found before readers used old information, what was missed, how it was found, and whether owners acted. The schedule form records evidence and planned changes to timing, selection, sources, or who to ask for help.
Limit: This only supports checks for made-up facts in published writing. It does not assess how well monitoring works or wider chemical, biological, radiological, nuclear (CBRN), or cyber risks.
NIST AI 600-1 · Generative AI Profile; Section 3; MANAGE 4.1; printed page 44; PDF page 48. Identifier: MG-4.1-002. Source check: identifier_locator_and_paraphrase_checked. Artifact check: source and artifact reviewed.
Practical support for a selected aspect
MG-4.3-002
Source meaning in our words: Keep steps for tracking errors, close calls, and harmful effects.
Where the toolkit helps: The guide and form keep reported errors, errors caught before publication, and observed harm separate. They record affected content, evidence, unknowns, owner, actions, a new check, and completion. A draft error is not treated as proof of harm.
