NIST CSF or NIST AI RMF: which should your team start from?
Start with CSF 2.0 when the exposure is enterprise cybersecurity, such as ransomware, access management, supplier risk or incident response across the whole organization. Start with AI RMF 1.0 when the exposure is how an AI system behaves, including validity, bias, explainability and harmful outputs. Combine them when an AI system sits inside the security program, for example a model that can reach production data or an agent that takes actions on your network. In that case, use the CSF to govern the security program and the AI RMF to govern the AI-specific risks inside it. Neither framework is required by law for private organizations, and neither offers certification. NIST's AI RMF FAQ says private and public organizations are not required to use it, and NIST states it does not offer certifications or endorsements of CSF-related implementations.
Because neither framework produces a certificate or an audit report, the proof you can show is your own evidence: a current profile, a target profile, the risk decisions behind any gaps, and records of the actions you took. Any external attestation has to come from a different instrument, such as a SOC 2 report, a sector regulation or a standard with a certification body. Confirm with your auditor, regulator or customer which of those they expect before you decide how much of the work to document in CSF or AI RMF terms.
Before you commit, check two dependencies. The Cyber AI Profile in NIST IR 8596 is a CSF 2.0 community profile, not an AI RMF profile, and its initial preliminary draft was released December 16, 2025, so confirm the current draft status on the NIST CSRC page before you build on it. AI RMF 1.0 is also under revision as part of the White House AI Action Plan, and NIST has not yet published a revised version, so plan your AI governance mapping to tolerate wording changes. Assign one owner for each framework so the cybersecurity and AI governance teams do not maintain two conflicting risk registers.
How CSF 2.0 and AI RMF 1.0 differ on scope, structure and status
This table compares the two NIST frameworks factor by factor, from purpose and structure to revision status and companion resources. Read each row as a question to settle with your governance team before choosing which document leads your program.
| Factor | NIST CSF 2.0 | NIST AI RMF 1.0 |
|---|---|---|
| Purpose | Manage cybersecurity risk through outcomes across the enterprise | Manage risks to individuals, organizations and society from AI systems, including validity, bias and explainability |
| Published | February 26, 2024 as NIST CSWP 29, succeeding Version 1.1 of April 16, 2018 | January 26, 2023 as NIST AI 100-1 (dated January 2023) |
| Core structure | 6 Functions, 22 Categories, 106 Subcategories | 4 functions, 19 categories, 72 subcategories |
| Function names | Govern, Identify, Protect, Detect, Respond, Recover | Govern (cross-cutting), Map, Measure, Manage |
| Who it applies to | Voluntary for most organizations; mandatory only for U.S. federal agencies under a 2017 executive order | Voluntary; neither private nor public sector organizations are required to use it |
| Tiers and profiles | Four Tiers (Partial to Adaptive), plus Current and Target Organizational Profiles | Temporal profiles described in AI 100-1 Section 6; users choose which categories and subcategories to apply |
| Companion resources | Implementation Examples, Informative References and Quick-Start Guides, updated online more often than the framework | Playbook with suggested actions and documentation prompts; Generative AI Profile (NIST AI 600-1, July 26, 2024) |
| Cost of documents | Free to download | AI 100-1 and AI 600-1 free; Playbook free as PDF, CSV, Excel and JSON |
| Certification | None; NIST has no plans for a conformity assessment program | None; NIST does not validate or endorse any organization's use |
| Current revision status | No revision of the Core as of October 2026; archive shows new Quick-Start Guides, Community Profiles and mappings | Being revised under the July 2025 AI Action Plan; no revised version published as of October 17, 2026 |
Where the CSF and AI RMF work overlaps
NIST CSF 2.0 and the AI RMF are both voluntary, both use outcome language instead of checklists, and both put governance at the front. The CSF-based Cyber AI Profile (NIST IR 8596) is the bridge between them, but it is still a preliminary draft, and no official line-by-line crosswalk between the two frameworks has been supplied, so mappings need to be confirmed by your own team.
Govern as the shared starting point
CSF 2.0 added the Govern Function to the five Functions of earlier versions. AI 100-1 also treats Govern as a cross-cutting function that should be in place before most users start with Map. Both frameworks therefore ask who owns risk decisions, how policy is set and how oversight works. Check whether your existing CSF GV outcomes already assign AI system ownership, or whether AI risk needs its own accountable owner and policy.
Current and Target Profiles for AI
The CSF Organizational Profile records a Current Profile and a Target Profile, and AI 100-1 Section 6 describes the same gap-analysis pattern for AI risk. Comparing the two shows where AI-related cyber outcomes or AI governance actions fall short. Teams should decide whether one combined profile covers both risk types or whether separate profiles are kept, and confirm that each one has a named owner and review cycle.
Trustworthiness versus security outcomes
The CSF focuses on cybersecurity outcomes such as protecting assets and responding to incidents. AI 100-1 lists seven characteristics of trustworthy AI, including validity, explainability, privacy and fairness with harmful bias managed, and security is only one of them. Where a model fails on validity or bias, a CSF-only program may show no gap, so confirm that AI-specific characteristics are tracked separately from security outcomes.
Shared evidence across both frameworks
Asset inventories, access records, incident procedures and supplier reviews can serve both CSF outcomes and AI RMF actions. Neither framework issues a certificate, so the proof is internal documentation that auditors or customers may later examine. Ask which artifacts will be reused, who maintains them, and whether the AI RMF Playbook documentation prompts can be recorded in the same system of record as CSF evidence.
CSF-based Cyber AI Profile versus the AI RMF Generative AI Profile
NIST IR 8596 is a community profile of the Cybersecurity Framework 2.0, not of the AI RMF. Its purpose is to help security teams think about securing AI systems, defending against AI-enabled threats and using AI in cyber operations, expressed in the same six Functions and Categories that the CSF already uses. Because it sits on the CSF Core, a security team can record AI-related outcomes alongside existing enterprise outcomes instead of building a separate taxonomy. The initial preliminary draft was released December 16, 2025, and comments closed January 30, 2026, so the content may still change before a public draft.
- Starting document: Read the CSF 2.0 Core and the preliminary draft together, since the profile only adds AI-specific priorities to outcomes that already exist.
- Method: Use the Current and Target Profile approach from CSWP 29 to record what the AI systems achieve today and what they should achieve.
- Audience: Security, risk and operations teams that already run a CSF program and need to bring AI systems into it.
- Status: Treat the preliminary draft as a working document and confirm the latest draft status on the NIST publication page before you cite it.
- Limit: The profile does not define AI risk validity, bias or explainability, which belong to the AI RMF.
Before relying on the profile, confirm which draft is current and check whether your AI inventory covers the systems it names.
NIST AI 600-1, the Generative AI Profile, was published July 26, 2024. It is a cross-sectoral profile of the AI RMF, meaning it applies the AI RMF to a specific kind of AI rather than to a specific sector or security program. It defines 12 generative AI risks and lists suggested actions for each, and every suggested action is tied to an AI RMF subcategory. That tie lets AI governance, model risk and product teams trace a generative AI risk back to the Govern, Map, Measure or Manage outcomes they already document.
- Scope: Generative AI systems, including the risks that come from model outputs, training data and deployment context.
- Structure: Each suggested action links to an AI RMF subcategory, so the profile works as an overlay on the AI RMF Core.
- Access: NIST AI 600-1 is available free of charge from NIST.
- Companion: The NIST AI RMF Playbook also gives suggested actions for each subcategory, but its last content update is dated August 2023 and NIST says it will be updated after the AI RMF is revised.
- Fit: Governance and AI product teams that use generative models need this profile more than teams that only run classic machine learning.
Confirm the AI RMF revision status with NIST, since the AI RMF 1.0 is under review as part of the White House AI Action Plan.
AI 100-1 Section 6 describes temporal profiles, which are snapshots of how an organization manages AI risk at two points in time. A Current Profile records how AI risk is managed today. A Target Profile records the outcomes the organization needs to reach its desired state. Comparing the two reveals gaps, and those gaps become the basis for action plans. NIST says prioritization depends on the user's needs and risk management processes, so the method does not set a fixed order of work.
- Current Profile: List the outcomes the team achieves or attempts today, and how well it does so.
- Target Profile: List the outcomes selected and prioritized, considering planned changes such as new requirements, technology adoption and threat trends.
- Gap analysis: Compare the two profiles to find outcomes that are missing, weak or not yet measured.
- Action plan: Turn each gap into owned tasks with dates set by the organization, not by the framework.
- Shared use: The same method works with a CSF profile for security outcomes and an AI RMF profile for AI risk outcomes, so one review can cover both.
Before starting, ask your security and AI governance leads to agree on which profile is the baseline so the two teams do not record the same gap twice.
What AI RMF covers that CSF 2.0 does not
The AI RMF covers trustworthy AI characteristics that CSF 2.0 does not define. NIST AI 100-1 describes seven: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. CSF 2.0 speaks to security and resilience outcomes, such as protecting systems and recovering from incidents, but it sets no requirement for model validity, bias testing or explainability. A security team that adopts only the CSF will have a sound basis for securing an AI system and still no defined way to show that its outputs are valid, that harmful bias was examined, or that a decision can be explained to the people it affects. Those gaps need an AI risk owner to decide which characteristics matter for each system, and the answer will differ between, for example, an internal document summarizer and a system that informs credit or clinical decisions (illustrative).
The AI RMF also changes how the work is sequenced. AI 100-1 calls Govern a cross-cutting function that sets the policies, roles and accountability the other functions depend on. It then says most users start with Map after Govern outcomes are in place, and move on to Measure and Manage. The categories are not a checklist, and users may select which categories and subcategories apply. Before using the framework, confirm with your AI risk owners who holds accountability for each system, which characteristics are in scope, and where the Map output will be recorded, since those decisions set the starting point for any profile you build.
The NIST AI RMF Playbook is the voluntary online companion, with suggested actions, documentation prompts and references for each subcategory. Its audit log shows the last content update in August 2023, and AIRC says it will update the Playbook after the AI RMF itself is revised. NIST has stated that AI RMF 1.0 is being revised as part of the White House AI Action Plan, so treat current Playbook text as a starting reference rather than settled guidance. Ask your AI risk owners to confirm which Playbook suggestions still match the current revision before adopting them as internal control requirements, and check the NIST AI Risk Management Framework page for the latest status.
Who assesses each framework, what is issued and the review cycle
This table compares who reviews each framework, what artifacts it produces and how often it is revisited. Neither framework has a certificate, so read the middle column as the reviewer you choose, not a regulator or accreditor.
| Question | NIST CSF 2.0 | NIST AI RMF 1.0 |
|---|---|---|
| Who assesses | None. NIST has no plans for a CSF conformity assessment program and does not certify CSF implementations. | None. NIST does not validate or endorse any organization's use of the AI RMF, and no accreditation program exists. |
| Who reviews your work | Internal teams, or independent reviewers you select and scope yourself, for example for a gap assessment. | Internal teams, or independent reviewers you select and scope yourself, for example for model risk or AI governance review. |
| What is issued | Organizational Profiles (Current and Target), gap action plans and internal documentation. No certificate. | Documented risk decisions, Playbook-informed evidence, action plans and internal documentation. No certificate. |
| What is not issued | No attestation, certificate or conformity mark that a third party can cite as proof of compliance. | No attestation, certificate or conformity mark that a third party can cite as proof of compliance. |
| Review cycle | Set by your organization. The Core has no published revision since CSF 2.0 (February 2024), and Quick-Start Guides and mappings update separately. | Set by your organization. NIST is revising AI RMF 1.0 and expects a formal review with community input no later than 2028. |
| Playbook and companion updates | Quick-Start Guides, informative references and Community Profiles are published online and can change without a new framework version. | The Playbook's last content update is August 2023, and AIRC says it will be updated after the AI RMF is revised. |
| Independent assurance | For security controls, select an independent instrument separately, such as an attestation or audit scoped to your environment. Confirm the scope with the assessor. | For AI systems, select any independent assurance separately and confirm with the provider which scope and standard it covers. |
Doing both: order of work and shared evidence
This sequence lets one team build a single enterprise picture and then add AI-specific risk work without repeating evidence collection. Each step ends with a named output that the next step depends on.
Assign governance and ownership first
Leadership sets who owns cybersecurity risk and who owns AI risk, and how the two report into one risk committee. In CSF terms this is the GV Function, and in AI RMF terms it is the Govern function, which NIST describes as cross-cutting and which most users put in place before Map. Done means a written accountability model naming owners for each CSF Category touched by AI, a decision on who approves AI system use, and a documented risk tolerance that both frameworks' activities will reference.
Build the enterprise CSF Current Profile
The security function records, for each relevant Subcategory across the six Functions, the outcomes the organization currently achieves and how well. This is the baseline for the whole enterprise, not only AI, so it draws on existing asset inventories, control evidence and incident records. Done means a Current Profile approved by the governance owners, with each Subcategory marked by its present status and a named evidence source.
Inventory AI systems and map each one
Add every AI system, including vendor-hosted models and AI features in existing products, to the same asset inventory the CSF Identify work uses. For each in-scope system, run the AI RMF Map function to record its context, intended use, impacts and known limitations. Done means an AI inventory linked to the enterprise asset records, and a Map record per in-scope system that names the business owner and the data it touches.
Compare profiles and set action plans
Build the Target Profile by selecting the CSF outcomes the organization needs, taking into account new AI requirements, technology adoption and threat trends. Set the Current and Target Profiles side by side to reveal gaps, then prioritize them using the organization's risk management process. Done means a prioritized action plan in which each gap has an owner, a documented decision and a reference to the AI risks it addresses.
Measure and manage AI-specific risks
Use the AI RMF Measure function to test the characteristics that matter for each system, such as validity, bias, explainability and privacy, and use Manage to decide how each risk is treated, accepted or monitored. Where NIST AI 600-1 applies to generative systems, use its suggested actions as a reference rather than a checklist. Done means a risk register for AI systems with measurement results, treatment decisions and residual risk accepted by a named owner.
Run CSF operations for AI incidents
Detect, Respond and Recover cover AI systems through the same monitoring, incident response and recovery processes used for other systems, extended to cover model behavior, data exposure and vendor failures. Incident records feed back into both the AI RMF Manage work and the CSF Current Profile. Done means AI systems are included in detection and response runbooks, and the incident log tags each AI-related event so it can be traced to the Measure and Manage records.
Reuse shared evidence and document each framework
Asset inventories, risk registers and incident records can serve both frameworks, so keep one source of record and link each item to the CSF Subcategory and the AI RMF subcategory it supports. Each framework's outcomes still need their own documentation, because a shared asset list does not show that a CSF outcome is achieved or that an AI characteristic was measured. Done means a cross-reference that a reviewer can follow in both directions, with the gaps in the mapping stated openly.
Questions buyers ask before choosing or combining NIST CSF and AI RMF
Is NIST CSF 2.0 or the AI RMF required for my organization?
Neither framework is required for most organizations. NIST describes the AI RMF as voluntary, and NIST says neither private nor public sector organizations are required to use it. The CSF is also voluntary for most organizations, though NIST notes that some companies require it of customers or suppliers. The one mandatory case is U.S. federal agencies, which a 2017 executive order required to use the CSF. Check your contracts, customer security questionnaires and sector regulator for any obligation that names either framework, because those requirements, not the frameworks themselves, are what bind you.
Can I get certified against NIST CSF or the AI RMF?
No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans to develop a conformity assessment program for the CSF. For the AI RMF, NIST's use cases page says it does not validate or endorse any individual organization or its approach, and its framework materials describe no certification, accreditation or conformity assessment program. Any vendor offering a 'NIST certified' badge for either framework is making a claim NIST does not support. What you can produce is a documented profile and internal or independent assessment evidence, which an auditor or customer can review.
If our security team owns the program but AI governance is new, where should we start?
Start with the CSF, then bring in the AI RMF for the AI-specific risks. Most security teams already work in CSF terms such as Govern, Identify, Protect, Detect, Respond and Recover, so a Current Profile is a practical first document. AI 100-1 says most users start with Map after putting Govern outcomes in place, so the AI governance lead should own the Govern categories for AI, including accountability and documented roles. Once the CSF Current Profile exists, use it to show where AI systems sit inside the existing program. Watch for NIST IR 8596, the Cyber AI Profile, which is a CSF-based community profile and may give your team a shared structure, though it is still a preliminary draft.
How long does this work take, and what drives the effort?
No fixed duration is supported by the sources we rely on, so treat any timeline you receive as a function of scope. The largest drivers are the number of AI systems in scope, whether those systems are generative, third-party or built in-house, how mature your existing CSF program is, and whether asset inventories, data lineage and model documentation already exist. An organization with a documented CSF Current Profile and a short list of AI use cases will move faster than one that must first inventory every system. Ask the team you engage to state the assumptions behind any estimate, and to name which items depend on data your organization has not yet collected.
What cost components should I expect, and what should a written quote include?
Expect costs in five groups: internal staff time for the security, AI, legal and business owners who answer questions and approve decisions; tooling for asset inventory, evidence storage and monitoring; external help for gap analysis or facilitated profiling; training for the people who will run the controls; and ongoing monitoring, which recurs after the first profile is complete. Staff time is usually the largest and most often underestimated. Ask any provider for a written scope listing the systems and functions covered, the deliverables (for example, the profile documents and gap action plan), the assumptions about existing evidence, and which costs are one-time versus recurring. DeployOpen works from a written scope, and quotes follow from it.
Can our own team do this without outside help?
Yes, a team can build both profiles internally, provided it names an accountable owner for each function and writes the profile down. NIST describes the CSF Organizational Profiles as Current and Target profiles that record outcomes achieved now and outcomes selected for the desired state, and the AI RMF lets users choose the categories and subcategories that fit their context. The usual gap is not method but time and independence: someone outside the working group should review the Target Profile and the risk decisions it contains. External help is most useful for that review, for facilitation, or for technical testing of AI systems, which is a separate service from framework mapping.
How should we handle the pending AI RMF revision and the preliminary Cyber AI Profile?
Build the program on the parts that are unlikely to change, and record which parts depend on pending work. NIST says AI RMF 1.0 is being revised under the White House AI Action Plan and has not published a revised version, and the July 2025 plan recommends removing references to misinformation, diversity, equity and inclusion, and climate change. AI 100-1 also expects a formal review no later than 2028. For the Cyber AI Profile, NIST IR 8596 is at the initial preliminary draft stage, with comments closed January 30, 2026, and NIST says comments will inform an initial public draft. Keep your Current Profile and controls mapped to the CSF Core, and tag AI-specific subcategories with the AI RMF version you used so you can update them when the revision is published.
What drives the cost of running both frameworks
Both frameworks are free to use, so the cost sits in staff time, tooling, data collection, governance work, training and any external support. NIST publishes the CSF 2.0 and AI RMF 1.0 documents, the AI RMF Playbook and the Generative AI Profile (NIST AI 600-1) without charge, and NIST does not certify or assess implementations. Your costs therefore come from the people who build profiles and inventories, the engineers who collect evidence, the reviewers who sign off on AI risk decisions, and any consultant you pay for a fixed-scope piece of work. Ask any provider to price each of those components separately so you can see who is paid for what.
Most of the effort is one-time: writing the first CSF Current and Target Profiles, inventorying AI systems, and mapping each system to the AI RMF Govern, Map, Measure and Manage Functions and their Categories. Recurring work includes reviewing profiles as threats and technology change, tracking Playbook updates, and monitoring the AI RMF revision that NIST says is under way. The Playbook's audit log shows its last content update in August 2023 and AIRC says it will be updated after the AI RMF is revised, so budget for re-mapping rather than assuming the current guidance will stay put.
The main drivers that raise effort are the number of AI systems in scope, whether generative AI is in use (which brings in the Generative AI Profile's 12 risks), how many of the CSF Implementation Examples you decide to adopt, and whether a CSF program already exists. A mature CSF program lets you extend existing evidence to AI, while a new program means building both at once. In any fixed-scope quote, ask for a list of deliverables (profiles, AI system inventory, subcategory mapping), the evidence format for each, the review points where your staff sign off, and what happens if the AI RMF revision changes subcategories during the engagement.
How DeployOpen scopes and delivers CSF and AI RMF readiness
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares the controls and evidence for compliance assessments. For NIST CSF vs NIST AI RMF, we start with the written scope so that CSF outcomes and AI RMF functions map to the systems and teams you actually run.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We confirm which CSF 2.0 Functions and Categories apply to your environment and which AI systems fall under AI RMF Map and Measure.
- We agree whether a Current Profile, Target Profile or both will be produced, and who owns each review decision.
How we build
- We configure and integrate the self-hosted platforms in your own cloud accounts, data centers or air-gapped networks.
- We map existing controls to CSF Subcategories and AI RMF Govern, Map, Measure and Manage subcategories, recording gaps in one shared register.
- We test the controls and AI systems in scope, then document the results against the agreed profiles.
How we hand over
- We deliver documented profiles, control evidence, configuration records and an action plan tied to named owners.
- We train your security, governance and engineering staff on how to maintain the profiles and update evidence.
- We state clearly what the evidence supports and what an independent assessor would still need to review, since DeployOpen does not issue certifications or attestations.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover profile reviews when NIST publishes updated guidance, including the Cyber AI Profile and any revised AI RMF.
- Confirm the retainer terms, response expectations and review cadence in the written quote before you commit.
Sources and further reading
- NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (PDF) ↗
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) ↗
- NIST IR 8596, Cybersecurity Framework Profile for AI (initial preliminary draft) ↗
- NIST AI 600-1, AI RMF: Generative Artificial Intelligence Profile ↗
- NIST Cybersecurity Framework FAQs ↗
