Docs

Appearance

NIST AI RMF in Modulos ​

Modulos has two Frameworks for NIST AI RMF 1.0 (NIST AI 100-1), and each has the name "NIST AI RMF":

  • MFF-3 at the AI System level. You add it to each AI System.
  • OFF-3 at the Organization level. You add it to the organization AI System.

NIST AI 100-1 is voluntary guidance. It gives outcomes for AI risk management and sets no obligations. In Section 5, NIST AI 100-1 writes this about the actions of the Core: "Actions do not constitute a checklist, nor are they necessarily an ordered set of steps." In Modulos, you record the work for each outcome with Controls and Evidence.

This page gives the AI System structure, the steps that Modulos recommends, the Requirements, and the work that the Frameworks do not hold. On this page, "you" is the organization that uses the AI RMF. "AI System" is the object in Modulos. "AI system" is an AI system in the sense of NIST AI 100-1.

The Requirements of MFF-3 and OFF-3 follow the subcategories of NIST AI 100-1 of January 2023. As of October 2026, the NIST web page for the AI RMF gives this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." For the status of NIST AI RMF 1.0, see The framework and its status.

Primary sources

This page uses Sections 1.2.2, 5, and 6 and Tables 1 to 4 of NIST AI 100-1, and the Modulos Frameworks MFF-3 and OFF-3. NIST AI 100-1 (PDF).

For NIST AI RMF 1.0, Modulos uses two levels of AI System. The levels are the Modulos structure, not a structure of NIST AI 100-1. For the relation of GOVERN to the other three functions in NIST AI 100-1, see The four functions of the Core.

AI SystemFrameworkFunctions in the Framework
The organization AI SystemOFF-3GOVERN, MAP, MEASURE, and MANAGE
One AI System for each AI system that you manage with the AI RMFMFF-3GOVERN, MAP, MEASURE, and MANAGE
  • The two Frameworks have all four functions. Each Requirement has the name of one subcategory of NIST AI 100-1, for example "Govern 1.2". GOVERN is not only at the Organization level. MAP, MEASURE, and MANAGE are not only at the AI System level.
  • The two Frameworks do not have the same subcategories. Four subcategories have a Requirement only in OFF-3: Govern 1.1, Govern 2.3, Map 5.1, and Measure 2.1. Each other subcategory has a Requirement in MFF-3, and some also have a Requirement in OFF-3. Together, the two Frameworks have all subcategories of NIST AI 100-1. The section The Requirements gives the level of each subcategory.
  • Use the two Frameworks together. If you use only MFF-3, the four subcategories above have no Requirement. If you use only OFF-3, the subcategories that are only in MFF-3 have no Requirement, for example Govern 6.1, Govern 6.2, and Map 1.5.

Organization AI Systems

Frameworks at the Organization level, for example OFF-3, attach to the organization AI System of your organization. The AI Registry shows it with the Type Organization. You cannot make a new organization AI System in the AI Registry. If your organization does not have one, contact Modulos support before you add OFF-3.

A sequence that works ​

Modulos recommends this sequence of work for NIST AI RMF 1.0. NIST AI 100-1 does not set this sequence. If your organization has a governance structure, NIST AI 100-1 lets you do the functions in a different sequence. See The four functions of the Core.

  1. Do the GOVERN work at the Organization (OFF-3). Add OFF-3 to the organization AI System. Then do the work for the GOVERN outcomes. Examples are the policies, processes, procedures, and practices (GOVERN 1), the accountability (GOVERN 2), and the culture (GOVERN 4). GOVERN does not stop after this step. In Section 5.1 of NIST AI 100-1, NIST writes: "Attention to governance is a continual and intrinsic requirement for effective AI risk management over an AI system’s lifespan and the organization’s hierarchy." See Govern.
  2. Use one AI System for each AI system, and add MFF-3. Use one AI System for each AI system that you manage with the AI RMF. Add MFF-3 to each of these AI Systems. MFF-3 also has Govern Requirements for each AI System, for example Govern 1.6, Govern 6.1, and Govern 6.2.
  3. Do the MAP work for each AI system first. The MAP categories are about the context, the categorization of the AI system, and its capabilities, benefits, and costs. They are also about the risks and benefits of its components and about its impacts. Set and document the risk tolerances of your organization (MAP 1.5). The AI RMF "does not prescribe risk tolerance" for your organization (Section 1.2.2). In Modulos, the Requirement for Map 5.1 is only in OFF-3. See Map.
  4. Do the MEASURE work, then the MANAGE work, for each AI system. MEASURE uses tools and methods "to analyze, assess, benchmark, and monitor AI risk and related impacts" (Section 5.3). MANAGE is about "allocating risk resources to mapped and measured risks" (Section 5.4). In Modulos, the Requirement for Measure 2.1 is only in OFF-3. See Measure and Manage.
  5. Review the Requirements, and do the cycle again. When the work on a Requirement is complete, the Requirement Owner does a Review of the Requirement. In Modulos, the Requirement Owner can also be a person who changes the Controls. MEASURE 1.3 is about "Internal experts who did not serve as front-line developers for the system and/or independent assessors". A Review does not make sure that these persons are part of the work. Do steps 3 and 4 again when the context, capabilities, risks, benefits, or impacts of an AI system change. For the Review, see Reviews & Statuses.

The Requirements ​

Each Requirement of MFF-3 and OFF-3 has the name of one subcategory of NIST AI 100-1. A subcategory can have a Requirement in MFF-3, in OFF-3, or in the two Frameworks. Below, "None" shows that the Framework has no Requirement for the subcategory.

GOVERN ​

Requirement nameMFF-3 (AI System)OFF-3 (Organization)NIST text
Govern 1.1NoneORF-98GOVERN 1.1
Govern 1.2MRF-132ORF-99GOVERN 1.2
Govern 1.3MRF-133ORF-100GOVERN 1.3
Govern 1.4MRF-134ORF-101GOVERN 1.4
Govern 1.5MRF-135ORF-102GOVERN 1.5
Govern 1.6MRF-136NoneGOVERN 1.6
Govern 1.7MRF-137NoneGOVERN 1.7
Govern 2.1MRF-138ORF-103GOVERN 2.1
Govern 2.2MRF-139NoneGOVERN 2.2
Govern 2.3NoneORF-104GOVERN 2.3
Govern 3.1MRF-140NoneGOVERN 3.1
Govern 3.2MRF-141ORF-105GOVERN 3.2
Govern 4.1MRF-142ORF-106GOVERN 4.1
Govern 4.2MRF-143ORF-107GOVERN 4.2
Govern 4.3MRF-144ORF-108GOVERN 4.3
Govern 5.1MRF-145NoneGOVERN 5.1
Govern 5.2MRF-146NoneGOVERN 5.2
Govern 6.1MRF-147NoneGOVERN 6.1
Govern 6.2MRF-148NoneGOVERN 6.2

MAP ​

Requirement nameMFF-3 (AI System)OFF-3 (Organization)NIST text
Map 1.1MRF-150NoneMAP 1.1
Map 1.2MRF-151NoneMAP 1.2
Map 1.3MRF-152ORF-109MAP 1.3
Map 1.4MRF-153ORF-110MAP 1.4
Map 1.5MRF-154NoneMAP 1.5
Map 1.6MRF-155NoneMAP 1.6
Map 2.1MRF-156NoneMAP 2.1
Map 2.2MRF-157ORF-111MAP 2.2
Map 2.3MRF-158NoneMAP 2.3
Map 3.1MRF-159NoneMAP 3.1
Map 3.2MRF-160ORF-112MAP 3.2
Map 3.3MRF-161ORF-113MAP 3.3
Map 3.4MRF-162NoneMAP 3.4
Map 3.5MRF-163NoneMAP 3.5
Map 4.1MRF-164ORF-114MAP 4.1
Map 4.2MRF-165NoneMAP 4.2
Map 5.1NoneORF-115MAP 5.1
Map 5.2MRF-166NoneMAP 5.2

MEASURE ​

Requirement nameMFF-3 (AI System)OFF-3 (Organization)NIST text
Measure 1.1MRF-167ORF-116MEASURE 1.1
Measure 1.2MRF-168NoneMEASURE 1.2
Measure 1.3MRF-169ORF-117MEASURE 1.3
Measure 2.1NoneORF-118MEASURE 2.1
Measure 2.2MRF-171NoneMEASURE 2.2
Measure 2.3MRF-172NoneMEASURE 2.3
Measure 2.4MRF-173NoneMEASURE 2.4
Measure 2.5MRF-174NoneMEASURE 2.5
Measure 2.6MRF-175NoneMEASURE 2.6
Measure 2.7MRF-176ORF-120MEASURE 2.7
Measure 2.8MRF-177ORF-122MEASURE 2.8
Measure 2.9MRF-178NoneMEASURE 2.9
Measure 2.10MRF-179ORF-123MEASURE 2.10
Measure 2.11MRF-180NoneMEASURE 2.11
Measure 2.12MRF-181NoneMEASURE 2.12
Measure 2.13MRF-182NoneMEASURE 2.13
Measure 3.1MRF-183ORF-124MEASURE 3.1
Measure 3.2MRF-184ORF-125MEASURE 3.2
Measure 3.3MRF-185ORF-126MEASURE 3.3
Measure 4.1MRF-186NoneMEASURE 4.1
Measure 4.2MRF-187ORF-127MEASURE 4.2
Measure 4.3MRF-188ORF-128MEASURE 4.3

MANAGE ​

Requirement nameMFF-3 (AI System)OFF-3 (Organization)NIST text
Manage 1.1MRF-189ORF-129MANAGE 1.1
Manage 1.2MRF-190ORF-130MANAGE 1.2
Manage 1.3MRF-191ORF-131MANAGE 1.3
Manage 1.4MRF-192NoneMANAGE 1.4
Manage 2.1MRF-193NoneMANAGE 2.1
Manage 2.2MRF-194ORF-132MANAGE 2.2
Manage 2.3MRF-195ORF-133MANAGE 2.3
Manage 2.4MRF-196NoneMANAGE 2.4
Manage 3.1MRF-197NoneMANAGE 3.1
Manage 3.2MRF-198NoneMANAGE 3.2
Manage 4.1MRF-199ORF-134MANAGE 4.1
Manage 4.2MRF-200ORF-135MANAGE 4.2
Manage 4.3MRF-201ORF-136MANAGE 4.3

For the Controls that are in MFF-3 or OFF-3 and also in other Frameworks, see Control overlap.

Work that the Frameworks do not hold ​

For NIST AI RMF 1.0 and the related NIST documents, MFF-3 and OFF-3 have no Requirement for three items. The items are Profiles, NIST AI 600-1, and the suggested actions of the Playbook. If you use one of these, you do that work without the Frameworks.

  • Profiles. No Requirement of MFF-3 or OFF-3 is about a profile. If you use a Current Profile and a Target Profile (NIST AI 100-1, Section 6), you compare them without the Frameworks. See NIST AI RMF profiles.
  • NIST AI 600-1, the Generative AI Profile. Modulos has no Framework for NIST AI 600-1. No Requirement of MFF-3 or OFF-3 has the name of a risk or of one of the suggested actions of NIST AI 600-1. If you use the Profile, you apply it and its suggested actions independently of the Frameworks. NIST AI 600-1 writes: "Not every suggested action applies to every AI Actor". To record the generative AI (GAI) risks of NIST AI 600-1 in Modulos, add each risk to the Organization Taxonomy. Then select the GAI risks that apply to each AI System that uses GAI, in its risk register. See The Generative AI Profile in Modulos.
  • The suggested actions of the Playbook. The NIST AI RMF Playbook is a voluntary companion resource of NIST. It gives suggested actions for the outcomes of the Core. No Requirement of MFF-3 or OFF-3 refers to the Playbook. If you use its suggested actions, apply them independently of the Frameworks. See The framework and its status.

The risk register and MANAGE 1.3 and 1.4 ​

In Modulos, the risk register of each AI System holds the risks of that AI System and their quantification. The risk register does not record the risk response that you select. It also does not record that you accept a residual risk. The Requirements for Manage 1.3 and Manage 1.4 include the documentation that these two subcategories of NIST AI 100-1 name:

  • Manage 1.3 (MRF-191, ORF-131): the documentation of the responses to the AI risks "deemed high priority", as the MAP function identifies them. In MANAGE 1.3, NIST AI 100-1 writes that these responses "are developed, planned, and documented". For the types of risk response in NIST AI 100-1, see MANAGE 1.3.
  • Manage 1.4 (MRF-192): the documented "negative residual risks" to "downstream acquirers" of AI systems and to end users. See MANAGE 1.4.

Record this documentation with the Controls and Evidence of these Requirements. For the risk register, see AI System Risks.

Where to go next ​

NIST AI RMF overview

AI RMF 1.0, the Core, the profiles, and the Generative AI Profile

NIST AI RMF Govern function

The six GOVERN categories and the outcomes in each category

Requirements

Requirements, their Controls, and the Review of a Requirement in Modulos

AI System Risks

The risk register and the quantification of the risks of each AI System

Sources of this page ​

  • NIST AI 100-1 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST, January 2023: Sections 1.2.2, 5, 5.1, 5.3, 5.4, and 6, and Tables 1 to 4. PDF.
  • NIST AI 600-1 — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST, July 2024: the Profile, its risks, and its suggested actions. PDF.
  • NIST AI RMF web page — the text about AI RMF 1.0 and the White House AI Action Plan, as of October 2026. NIST page.
  • NIST AI RMF Playbook — the companion resource of NIST with suggested actions. Playbook page.
  • The Modulos Frameworks MFF-3 and OFF-3.

Disclaimer

This page gives general information only. It is not legal advice. Compare this page with NIST AI 100-1 before you make a decision.