Illustrative · AICM↔AI RMF · sample

Initech: NIST AI RMF compared with CSA AICM

Practitioners compare NIST AI RMF to CSA AICM. This report places each GRA control on Govern / Map / Measure / Manage via the AICM domain rollup — the peer frame to the control spine, not a second quiz and not a CSA sheet gap cell.

Assessed on CSA AICM via the function diagnostic. AI RMF placement is the AICM↔AI RMF comparison lens (domain→Govern/Map/Measure/Manage), not a CSA sheet gap cell. Not a NIST conformity claim.

Executive summary

Initech: every control on this slice aligns to an AI RMF function via the AICM domain rollup (the peer comparison to CSA AICM). 17 aligned controls are absent in attestation. Foundational NIST (800-53/CSF) still leaves an AI-only remainder of 59 AICM controls. Not a NIST conformity claim.

AI risk management (Govern, Map, Measure, Manage) — the peer frame practitioners compare to CSA AICM.

Controls in this slice

Priority (mapped, absent)

Attested implemented

Matrix mapped / aligned

247

Full AICM matrix aligns to AI RMF functions (247 controls · 18 domains). Foundational NIST AI-only remainder: 59.

Control register

Gap = Aligned means the AICM control sits under an AI RMF function in the comparison lens. Priority = aligned and practice absent.

AICM	Title	AI RMF fn	Gap	Refs	Posture	Board line
GRC-01	Governance Program Policy and Procedures	Govern	Aligned	Govern · GOVERN-1 · GOVERN-2 · via AICM GRC	Implemented	Self-attested in place; AICM control aligned to an AI RMF function (comparison lens).
GRC-02	Risk Management Program	Govern	Aligned	Govern · GOVERN-1 · GOVERN-2 · via AICM GRC	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
GRC-03Priority	Organizational Policy Reviews	Govern	Aligned	Govern · GOVERN-1 · GOVERN-2 · via AICM GRC	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
HRS-15	AI Acceptable Use	Govern	Aligned	Govern · GOVERN-1 · GOVERN-2 · via AICM HRS	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
GRC-15Priority	Human supervision	Govern	Aligned	Govern · GOVERN-1 · GOVERN-2 · via AICM GRC	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
AIS-01	Application and Interface Security Policy and Procedures	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM AIS	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
AIS-04Priority	Secure Application Development Lifecycle	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM AIS	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
AIS-07Priority	Application Vulnerability Remediation	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM AIS	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
TVM-01	Threat and Vulnerability Management Policy and Procedures	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM TVM	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
TVM-03Priority	Vulnerability Identification	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM TVM	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
TVM-08Priority	Vulnerability Remediation Schedule	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM TVM	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
A&A-01	Audit and Assurance Policy and Procedures	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM A&A	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
A&A-02Priority	Independent Assessments	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM A&A	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
A&A-05Priority	Audit Management Process	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM A&A	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
A&A-06Priority	Remediation	Measure	Aligned	Measure · MEASURE-1 · MEASURE-2 · via AICM A&A	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
STA-01	Supply Chain Risk Management Policies and Procedures	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM STA	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
STA-08	Supply Chain Inventory	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM STA	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
STA-10Priority	Supply Chain Risk Management	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM STA	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
STA-13Priority	Supply Chain Compliance Assessment	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM STA	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
BCR-01Priority	Business Continuity Management Policy and Procedures	Manage	Aligned	Manage · MANAGE-1 · MANAGE-2 · via AICM BCR	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
BCR-02Priority	Risk Assessment and Impact Analysis	Manage	Aligned	Manage · MANAGE-1 · MANAGE-2 · via AICM BCR	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
BCR-08	Backup	Manage	Aligned	Manage · MANAGE-1 · MANAGE-2 · via AICM BCR	Partial	Partially attested on an AICM control that aligns to AI RMF. Close practice for the RMF climb.
BCR-06Priority	Business Continuity Exercises	Manage	Aligned	Manage · MANAGE-1 · MANAGE-2 · via AICM BCR	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
IPY-01Priority	Interoperability and Portability Policy and Procedures	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM IPY	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
IPY-03Priority	Secure Interoperability and Portability Management	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM IPY	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.
IPY-04Priority	Data Portability Contractual Obligations	Map	Aligned	Map · MAP-1 · MAP-2 · via AICM IPY	Absent	AICM↔AI RMF alignment is clear, but practice is not attested. Priority for the AI RMF climb.