What the NIST Cyber AI Profile asks organizations to do, and where it stands
If a customer, contract or regulator now points you to the Cyber AI Profile, the short answer is this: NIST IR 8596 is a draft Cybersecurity Framework 2.0 community profile, released as an initial preliminary draft on December 16, 2025, with no certification and no final version yet. Nothing in it can be passed or failed, and no body issues a Cyber AI Profile certificate. What you can do is map your current cybersecurity program to its outcomes, identify gaps and document your reasoning. Your organization owns its controls and its risk decisions. An implementation partner can help prepare systems, configurations and evidence. Only an independent auditor or assessor issues a report, and only if the customer or regulator has asked for one under a defined engagement.
The profile is organized around three focus areas. Secure covers protecting the components of AI systems, such as models, data, pipelines and the infrastructure they run on. Defend covers using AI to improve cyber defense, such as detection and triage in security operations. Thwart covers preventing or resisting attacks that use AI, such as AI-assisted phishing or automated intrusion. Which areas matter to you depends on your role. A company that runs AI systems will weigh Secure most heavily. A security operations team that adopts AI tooling will focus on Defend. Organizations that do both should scope all three, and should confirm with the requesting party which focus area their question targets.
Before you commit budget, confirm three things in writing with the requester: which version of the document they mean, since the publication page had no newer version than the April 2026 update at the time of research; whether they expect a mapping to CSF 2.0 subcategories or a narrative; and whether the question is really about the AI RMF or the COSAiS overlays, which serve different purposes. NIST's draft comment period closed January 30, 2026, and NIST says those comments will inform an initial public draft. Scope your evidence work against the draft you can read today, and plan a revision pass when a public draft appears.
How the profile is structured on CSF 2.0
NIST IR 8596 is a community profile of the NIST Cybersecurity Framework 2.0, not of the AI RMF. It keeps the CSF 2.0 structure of functions, categories and subcategories and adds AI-specific priorities to them, so an existing CSF program is the starting point. The Govern function sets the policy, roles and risk strategy that the rest of the profile depends on, and the Identify function covers knowing which AI systems, data, models and third-party components exist in the environment.
- Governance ownership: AI-specific priorities are attached to the CSF Govern categories for risk strategy, roles and supply chain, so the governance owner can see which policies must name AI systems.
- Asset inventory: The Identify categories cover AI systems, models, training data and their dependencies as assets that must be known before they can be protected.
- Supply chain visibility: Third-party models, datasets and plugins fall under the supply chain categories, which matter for the poisoning and provenance concerns the profile raises.
- Existing program mapping: Teams can record which of their current CSF subcategories already cover an AI system and mark the gaps.
Before relying on this structure, confirm the current subcategory wording and numbering against the preliminary draft, since NIST says comments will inform a later public draft.
The Protect and Detect functions carry most of the technical work in the profile. Protect covers safeguards for the components of an AI system, such as model access, training data integrity and the interfaces that expose a model, which corresponds to the Secure focus area. Detect covers monitoring for AI-related anomalies and for the use of AI tools in defensive operations, which connects to the Defend focus area. The security architect and SOC lead will read these categories most closely.
- Component protection: Protect categories address access control, data integrity and configuration of AI components, which is the core of the Secure focus area.
- Model and endpoint monitoring: Detect categories cover monitoring of AI system behavior and inputs, including signs of attempted misuse of model endpoints.
- AI-enabled defense: Defend-related content describes using AI to improve detection and analysis, so SOC leads can assess where AI tools themselves need controls.
- Shared subcategories: Some subcategories serve both the Secure and Defend focus areas, so one control may satisfy more than one priority.
- Test coverage: Architects should check how each Protect subcategory is verified, since the profile points to measurable outcomes rather than fixed technical settings.
Ask the authors for the current focus area tags on each subcategory before building a control matrix from them.
The Respond and Recover functions describe how an organization handles an AI-related incident and restores normal operation. The Thwart focus area, which covers defending against AI-enabled attacks, shows up most clearly in these functions and in Detect, because attackers using AI change the speed and scale of incidents that responders must handle. The SOC lead and governance owner share responsibility here, with the governance owner deciding who can suspend or roll back an AI system.
- Incident playbooks: Respond categories call for response plans that cover AI systems, so playbooks should name the model, data and endpoint involved in an incident.
- Communication and reporting: Response planning includes who is informed inside and outside the organization when an AI system is compromised or misbehaves.
- Recovery of AI assets: Recover categories cover restoring models, data and configurations, which requires known-good versions held in backups.
- Thwart considerations: AI-enabled attacks such as automated phishing or rapid vulnerability discovery may require changes to response timing and triage.
- Rollback authority: Governance owners should confirm who holds the authority to deactivate an AI system during an incident.
Check whether your incident response plan already lists AI systems as assets and whether recovery tests have included a model or dataset.
The profile is a CSF 2.0 community profile, so it does not extend the AI RMF's Govern, Map, Measure and Manage functions. The AI RMF and the Cyber AI Profile are separate documents that address overlapping concerns from different frameworks. NIST's AI RMF page lists the Generative AI Profile and the critical infrastructure concept note as its AI RMF profiles, and the Cyber AI Profile does not appear in that list. Governance owners who use both should keep the two mappings separate and avoid treating one as a substitute for the other.
- Different base frameworks: The Cyber AI Profile builds on CSF 2.0 functions, while the AI RMF builds on its own four functions and seven trustworthy AI characteristics.
- Complementary coverage: The AI RMF addresses broad AI risk management across the AI lifecycle, and the Cyber AI Profile adds cybersecurity detail for AI systems.
- Separate profiles: The AI RMF profiles listed by NIST are not the same as the Cyber AI Profile.
- Separate evidence: Evidence for a CSF subcategory and evidence for an AI RMF subcategory may overlap, but each mapping must be documented on its own terms.
- No shared certification: Neither document provides a certification, so any cross-mapping is an internal working document.
Confirm with NIST's current publication pages whether any cross-reference between the two documents has been added since the preliminary draft.
Draft status: what is final, what is open and what to watch
NIST IR 8596 is still a draft, and the dates that matter most are the ones that have already passed or are scheduled. The cards below separate the settled facts from the open items so that you can plan around the next publication rather than a version that does not yet exist.
Initial preliminary draft
NIST released the Cyber AI Profile as an initial preliminary draft on December 16, 2025. It is organized by CSF 2.0 functions, categories and subcategories around the Secure, Defend and Thwart focus areas. Treat this document as the baseline for comparison, not as a finished profile that an auditor or customer can require by name.
Comment period closed
Comments on the initial preliminary draft were accepted until January 30, 2026. Any comment you or your industry group submitted is now part of the record NIST has said will inform the next stage. If your organization relied on a specific subcategory, confirm whether its wording changed in later drafts before you cite the original text.
Next stage: initial public draft
NIST says the comments will inform an initial public draft. That step is the first version for broad public review and it has not been published as of the April 2026 update of the publication page. Until it appears, plan internal work as a gap assessment against the preliminary draft, and expect wording, scope and examples to shift.
Spring 2026 working sessions
NIST scheduled Spring 2026 Cyber AI Profile virtual working sessions on April 28, May 5 and May 12, 2026, as set out in a CSRC planning note dated April 21, 2026. Sessions like these are where practitioners can raise use cases, such as AI-enabled defense tooling, that the draft may not yet address. Check whether the recordings or summaries were posted before you decide which questions to raise.
Check the CSRC page before setting deadlines
The publication page listed no newer version as of its April 2026 update, so any later draft may already exist. Before you set an internal deadline, a customer commitment or a board report date, check the NIST CSRC page for the current draft number and its comment or release status. Record the date you checked so that your own documentation shows which version you assessed against.
How the Cyber AI Profile relates to the AI RMF and its secure and resilient characteristic
The Cyber AI Profile and the AI RMF overlap on security, but they are different documents with different jobs. The AI RMF 1.0 (NIST AI 100-1, January 2023) lists seven characteristics of trustworthy AI, and one of them is *secure and resilient*. Section 3.3 of that document names adversarial examples, data poisoning and exfiltration of models, training data or other intellectual property through system endpoints as common AI security concerns, and it points to the NIST Cybersecurity Framework and Risk Management Framework as applicable guidance. The Cyber AI Profile, NIST IR 8596, is the cybersecurity profile that fills much of that pointer. It is built on CSF 2.0, not on the AI RMF, so it gives you functions and subcategories to score against rather than AI RMF categories to document.
The AI RMF is voluntary, and NIST does not certify, accredit or endorse any organization's use of it. The same is true of the Cyber AI Profile, which is still an initial preliminary draft. Before you cite either document in a customer questionnaire or a contract, confirm the exact version you are relying on and whether NIST has published a newer public draft on the IR 8596 publication page. Treat the Profile as a way to organize secure-by-design, defensive and AI-enabled attack work under CSF outcomes, and keep the AI RMF Map, Measure and Manage records as the evidence of how you assessed and treated AI risk.
The AI RMF itself is under revision. NIST says the framework is being revised as part of the White House AI Action Plan and has not published a revised version as of 17 October 2026. Because the Playbook will be updated after that revision, a mapping you build today between AI RMF subcategories and Cyber AI Profile subcategories should carry a version date and an owner. Plan to re-check it when NIST publishes the revised AI RMF, and confirm with your assessor or customer which version they expect you to reference.
How to plan for the Cyber AI Profile while it is still in draft
This sequence lets a security team prepare now for NIST IR 8596 by building an inventory of its AI systems, mapping them to CSF 2.0 outcomes, and recording decisions that can be revisited when the initial public draft is published. Each step produces a working artifact the team can reuse.
Inventory AI systems and their components
Start by listing every AI system the organization builds, buys or runs, including embedded AI features in third-party products. For each system, record its purpose, owner, data sources, models, hosting location, integrations and the people or services that can change it. Include pre-trained models, plugins and agent tools, because the Cyber AI Profile addresses AI system components. This step is done when the inventory has an owner and a named system boundary for each entry and the security team has reviewed it against procurement and engineering records.
Map inventory entries to CSF 2.0 outcomes
Take each inventory entry and link it to the existing CSF 2.0 categories and subcategories that already govern it, such as asset management, supply chain risk, access control, data security, monitoring and incident response. The Cyber AI Profile is organized on CSF 2.0, so this mapping shows where current controls already reach AI components and where they do not. The output is a working matrix that shows, for each system, which CSF outcomes apply and which control owner is responsible for each one.
Identify gaps for AI-specific risks
Review the matrix for risks that conventional controls may not cover, such as adversarial inputs, data poisoning, model exfiltration through endpoints, prompt injection through tool output and unsafe agent permissions. NIST's AI RMF Section 3.3 names several of these concerns as common AI security issues. For each gap, record the affected system, the risk, the existing control that falls short and the question an assessor would ask. The output is a gap register that a risk owner can review and prioritize.
Decide which AI-enabled defense uses to evaluate
The draft covers AI used to improve cybersecurity as well as the security of AI systems. Choose the defense use cases the team will evaluate first, such as AI-assisted alert triage, log analysis or vulnerability prioritization, and record the data each one touches and the human decisions it influences. Confirm the evaluation criteria with the risk owner, including how the team would detect errors and who approves changes. The output is a short list of defense use cases with documented scope, data access and oversight points.
Track drafts, working sessions and comment windows
Assign one person to monitor the NIST IR 8596 publication page, the Cyber AI Profile working sessions and the related COSAiS project. Record each publication date, comment deadline and session outcome in a change log, and note which of the team's gaps or assumptions each update affects. NIST scheduled Spring 2026 working sessions on April 28, May 5 and May 12, 2026, so confirm the current schedule directly with NIST before relying on it. The output is a dated tracker that shows what has changed since the team last reviewed the matrix.
Document decisions and assumptions
Write down the decisions made so far, including the inventory boundary, the CSF mappings, the gaps accepted for now, the defense use cases in scope and the assumptions that depend on the draft text. Mark each assumption with the draft version it relies on. Ask the accountable executive to approve the document so the decisions have a named owner. The output is a planning record that explains why each choice was made, which an auditor or customer can read without interviewing the team.
Plan the revisit when the initial public draft arrives
Create a revisit checklist that lists every decision and assumption from the planning record, the evidence each one relies on and the people who must review it. When NIST publishes the initial public draft, compare its structure and subcategories with the matrix, update the gap register and mark which decisions still hold. Because NIST has said comments on the preliminary draft will inform the next draft, treat this checklist as a living record. The output is a dated revisit plan with owners, reviewed each time the profile changes.
Who owns the controls, who prepares the evidence and who issues any report
The Cyber AI Profile is a draft guidance publication, not a certification scheme, so no one can certify conformance to it. Responsibility for risk decisions, control operation, evidence preparation and any independent opinion sits with different parties, and mixing them up is the most common source of confusion in buyer conversations.
The organization owns risk decisions
Your organization decides which AI systems are in scope, which risks it accepts, and which Cyber AI Profile outcomes matter for its environment. Those decisions belong to named executives and risk owners, not to a vendor or consultant. Before any work starts, confirm who signs off on the target profile, who approves residual risk, and how those approvals are recorded. An implementation partner can draft these records, but the organization must adopt and maintain them.
The organization operates its controls
Controls only count when your own teams run them day to day. Examples include access reviews for model endpoints, logging of prompts and tool calls, change approval for model updates, and monitoring of AI-enabled detection tools. Ask who performs each control, how often, and who checks it. A partner can configure the systems that perform these controls, but operation and ownership of the control stay with your staff.
An implementation partner prepares systems and evidence
DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Cyber AI Profile work, that can mean configuring logging, access controls and test environments, and organizing the evidence that shows those controls exist. Scope, deliverables and timelines are agreed in writing before work starts. Security testing of AI systems and agents is also available as a separate engagement.
Testing supports, but does not replace, assurance
Security testing of AI applications, APIs, infrastructure and agents can show how a system behaves under attack and produce findings your team can act on. Testing results are internal evidence. They do not amount to an audit opinion, and a test report should not be presented to a customer or regulator as proof of conformance. Ask the tester to state the method, scope and limits in the report.
Independent assessors issue any report
Only an independent auditor, assessor or certification body can issue an attestation, report or certificate. DeployOpen does not issue reports, attestations or certificates and does not guarantee audit outcomes. For the Cyber AI Profile, no NIST publication provides a certification, so no body can certify conformance to it. If a customer or regulator asks for an independent opinion, confirm which framework they mean and which assessor is qualified to give it.
Questions buyers ask about the NIST Cyber AI Profile
Is NIST IR 8596 final?
No. NIST IR 8596, the Cybersecurity Framework Profile for Artificial Intelligence, was released as an initial preliminary draft on December 16, 2025. NIST accepted comments until January 30, 2026, and says those comments will inform an initial public draft. As of its April 2026 update, the publication page lists no newer version. Treat the current text as a working document that may change, and check the NIST IR 8596 initial preliminary draft page before you cite it in a contract, policy or board paper. Ask any partner to state in writing which version their assessment or gap analysis is based on, and to plan a review when a new draft appears.
Is there a certification for the Cyber AI Profile?
No. The Cyber AI Profile is a voluntary community profile of the Cybersecurity Framework 2.0. NIST publishes guidance and does not certify organizations against it. Any claim that an organization is "certified to the Cyber AI Profile" should be challenged. Evidence can still be reviewed by a customer, internal audit or an independent assessor, who can report on what was tested and what was found. Only an independent auditor or certification body issues reports or certificates, and a implementation partner such as DeployOpen prepares systems and evidence but does not issue either. Ask your contract counterparts which framework or assessment they actually need, because a profile cannot satisfy a certification requirement on its own.
How does the Cyber AI Profile differ from the AI RMF?
The Cyber AI Profile is built on the Cybersecurity Framework 2.0, so it organizes work by CSF functions, categories and subcategories. The AI RMF is a separate framework organized into Govern, Map, Measure and Manage. NIST describes the Cyber AI Profile as a community profile of CSF 2.0, not of the AI RMF. Its three focus areas are securing AI system components (Secure), AI-enabled cyber defense (Defend) and thwarting AI-enabled attacks (Thwart). The two work together: the AI RMF frames trustworthy AI risk across the AI lifecycle, while the Cyber AI Profile gives security teams a cybersecurity-oriented structure they can map their existing CSF program against.
Does the Cyber AI Profile replace COSAiS or the Generative AI Profile?
No. They serve different purposes. NIST's Control Overlays for Securing AI Systems (COSAiS) project builds SP 800-53 overlays for AI systems, and NIST released a predictive AI overlay annotated outline on January 8, 2026 to support Cyber AI Profile Workshop #2. The Generative AI Profile, NIST AI 600-1, is an AI RMF profile published July 26, 2024 that defines 12 generative AI risks with suggested actions tied to AI RMF subcategories. Organizations that run SP 800-53 programs will likely use COSAiS, and those working under the AI RMF will likely use AI 600-1. The Cyber AI Profile is a CSF-based view of the same security problem, so expect overlap to be reconciled in later drafts rather than assumed now.
What should we do before the initial public draft?
Start with work that will hold regardless of the final wording. Inventory your AI systems, including third-party models and AI features in purchased software. Confirm your current CSF 2.0 profile and identify where AI assets sit in the Identify, Protect, Detect, Respond and Recover functions. Document threats such as adversarial examples, data poisoning and model or data exfiltration through endpoints, which AI 100-1 names as common concerns. Review how your teams use AI for detection and response, since the draft covers both securing AI and using AI for defense. Consider attending or following the Spring 2026 virtual working sessions on April 28, May 5 and May 12, 2026, and record which assumptions you will need to revisit when the public draft arrives.
Do we need a consultant, and what drives the effort?
You do not have to hire one. Your organization owns its controls and decisions. A consultant or implementation partner can help when the work exceeds your internal capacity. Effort is driven by the number and type of AI systems in scope, how many CSF categories you will assess, how much of your environment is self-hosted versus purchased as a service, the maturity of your existing CSF program, and whether you need evidence collected for an external reviewer. Because NIST has not finalized the profile, a sensible scope separates work that is stable (asset inventory, access control, logging, supplier review) from work that depends on the final text. Ask any partner for a written scope listing systems, CSF categories, deliverables, what is assumed about the draft version, and what happens if the public draft changes. Ask for the same in writing from any firm that offers an assessment.
How DeployOpen scopes Cyber AI Profile readiness work on self-hosted platforms
DeployOpen helps organizations prepare the systems, controls and evidence behind the security outcomes that NIST IR 8596 describes, on open-source platforms the client runs in its own infrastructure. The organization keeps ownership of its risk decisions and controls, and DeployOpen does not issue any assessment report or certificate.
How we scope
- We agree a written scope before work starts, naming which Cyber AI Profile focus areas (Secure, Defend, Thwart) and CSF 2.0 functions apply.
- The scope lists the self-hosted platforms, cloud accounts or air-gapped networks in which the work will happen.
- Scope notes flag draft status, so the client knows which IR 8596 items may change before the final publication.
How we build
- We prepare AI system inventories, asset records and logging configurations that map to the chosen CSF 2.0 subcategories.
- We run security testing of AI applications, APIs and agents where the written scope includes it, and record the results.
- We configure hardening and monitoring on open-source platforms so the client can show how each control operates.
How we hand over
- We deliver documentation of configurations, control mappings and test results, written for the client's own assessors and auditors.
- We walk through the evidence with the client's security and compliance staff so they can run it after handover.
- Deliverables are listed in the written scope, so the client knows exactly what it receives and when.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work ends.
- Retainers can track changes when NIST publishes a revised draft of IR 8596 or updated COSAiS overlays.
- Confirm with DeployOpen in the quote whether a retainer covers re-testing after platform upgrades.
