The NIST AI Risk Management Framework (AI RMF) is a voluntary, vendor-neutral framework for governing, mapping, measuring, and managing the risks of AI systems across their lifecycle. It is the de facto North American baseline for AI governance.
The AI RMF Core groups AI risk work into four functions (GOVERN, MAP, MEASURE, and MANAGE) that apply across an AI system's lifecycle. It is voluntary and vendor-neutral.
We assess at two levels: Essentials (19 category-level outcomes, suited to smaller organizations getting started) and Comprehensive (all 72 subcategories of the AI RMF Core). Guidance from the Generative AI Profile is built into each assessment question.
Official source: https://www.nist.gov/itl/ai-risk-management-framework
ThreeShield's CISSP- and CISA-certified assessors run the NIST AI Risk Management Framework engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| Level | What it covers | Builds on the level below |
|---|---|---|
| Essentials | Category-level assessment: the 19 outcome categories of the AI RMF Core (GOVERN 1-6, MAP 1-5, MEASURE 1-4, MANAGE 1-4). Right-sized for organizations that use AI tools but do not build AI systems. | Yes |
| Comprehensive | Subcategory-level assessment: all 72 subcategories of the AI RMF Core, with Generative AI Profile guidance. For organizations that build, embed, or operate consequential AI systems. | Yes |
| NIST AI Risk Management Framework requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
It likely does if your organization uses AI tools (the Essentials level) or builds, embeds, or operates consequential AI systems (the Comprehensive level). The framework itself is voluntary. We confirm scope in the first call, at no charge.
A gap assessment against the NIST AI Risk Management Framework usually takes a few weeks, depending on your starting point. Closing the gaps and standing up the evidence takes longer and is where most of the work sits. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
Start at whatever security maturity you have today. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You