The exposure goes well beyond model hacking. It includes sensitive data leakage, unreliable outputs, prompt injection, supply-chain compromise, autonomous agent actions, bias, privacy, and regulatory risk. The gap shows in the data: IBM's 2025 breach study found 63% of breached organizations lacked an AI governance policy or were still developing one.
This article explains the major frameworks, shows how they fit together, and outlines how boards and operating teams can turn them into measurable execution.
Key Takeaways
- AI frameworks extend your existing cybersecurity, privacy, and enterprise risk programs; they don't replace them.
- NIST AI RMF, ISO/IEC 42001, CSA AICM, OWASP, and MITRE ATLAS do different jobs and work best as layers.
- Start with an AI inventory, named owners, risk tiers, and testing evidence.
- Success means fewer surprises, faster escalation, and defensible reporting.
What AI Security and Risk Management Frameworks Need to Cover
Terms That Overlap but Differ
Teams use these words interchangeably. They shouldn't.
- AI security: protecting confidentiality, integrity, and availability against unauthorized access or use.
- AI safety: avoiding conditions that endanger life, health, property, or the environment.
- AI risk management: continuous lifecycle activity addressing AI's potential harms and benefits.
- AI governance: roles, decision processes, and executive accountability.
- Responsible AI: broader principles such as human rights, agency, and oversight.
Security is one component of trustworthiness, not a synonym for it.
Why Traditional Controls Fall Short
Conventional controls assume predictable software. AI adds probabilistic outputs, shifting model behavior, and new attack paths. OWASP's LLM guidance covers malicious instructions, manipulation of training and embedding data, and damage from excessive agent authority. NIST also flags third-party models, data, and plugins as supply-chain exposure needing AI-specific provenance checks.
The Lifecycle a Credible Framework Addresses
Coverage should run from use-case selection and data collection through development, testing, deployment, monitoring, change management, incident response, and retirement.
Risk shifts along the way. An internal experiment with synthetic data is a modest concern. Put it in front of customers, or give an agent access to billing or HR systems, and the same model now carries privacy, financial, and legal consequences. Reassess at every change in exposure.
Practical Risk Categories
No universal four-category taxonomy exists. NIST uses seven trustworthiness characteristics, the MIT AI Risk Repository uses seven domains, and the EU AI Act uses legal risk tiers. Pick a business-facing set and document it:
- Security and integrity
- Privacy and confidentiality
- Safety and reliability
- Fairness and harmful bias
- Operational resilience
- Legal and regulatory exposure
- Third-party and supply-chain risk
Tie each category to a decision: approve the use case, restrict data access, require human review, delay deployment, or retire the system.
Operational, Not Aspirational
A framework becomes operational when it has defined owners, control objectives, testing methods, evidence requirements, exception processes, escalation thresholds, and a review cadence. Without those, it's a policy document.
Major AI Security and Risk Management Frameworks
NIST AI Risk Management Framework
The AI RMF 1.0 (January 2023) is voluntary and organized around four functions:
- Govern: accountability, policy, and culture
- Map: context and impact
- Measure: risk and control evaluation
- Manage: prioritized response and improvement
It isn't a certification. Adapt it to your risk tolerance, sector obligations, and existing controls. NIST also published a Generative AI Profile (AI 600-1) in July 2024.
ISO/IEC 42001
Published in 2023, this is a management-system standard for establishing, maintaining, and improving an AI management system. It supports documented policies, roles, lifecycle processes, and continual improvement.
Independent bodies, not ISO, perform voluntary certification, and that certification covers the management system, not the AI product. It doesn't replace threat modeling or technical controls.
CSA AI Controls Matrix
AICM v1.1 (June 2026) is a vendor-neutral catalog of 247 control objectives across 18 domains. It maps to ISO 42001, NIST AI RMF, and BSI AIC4.
Teams commonly use it for:
- Shared-responsibility analysis and control ownership
- Data lineage and model security
- Incident response and vendor assessments
Remember that shared responsibility is not shared accountability.
NIST Security Controls and Draft Guidance
NIST is extending SP 800-53 to AI through control overlays, now under the COSIS project. Published materials are a concept paper (August 2025) and a January 2026 discussion outline, not finalized overlays.
The Cyber AI Profile (NIST IR 8596) is an initial preliminary draft built on CSF 2.0. Treat both as direction, not requirements, and recheck their status before relying on them.
Technical Threat and Testing References
- OWASP Top 10 for LLM Applications 2025, plus a separate Top 10 for Agentic Applications 2026
- MITRE ATLAS, an adversary-technique knowledge base (16 tactics and 120 techniques in the 2026.09 data release)
- NIST AI 100-2 E2025, the adversarial machine learning taxonomy
These help teams find attack paths and test weaknesses. They don't provide governance, accountability, or board reporting.
Vendor Frameworks
AWS's Generative AI Security Scoping Matrix, Cisco's AI Security and Safety Framework, and Google's SAIF are useful architecture and implementation guidance. Use them to inform design on those platforms. Don't let one cloud or model provider define your enterprise risk program. If you do, switching vendors means rebuilding governance.
How to Choose and Combine Frameworks
Start with your use cases, risk exposure, regulatory obligations, existing frameworks, and cloud architecture. Popularity is a poor selection criterion.
Think in Layers
| Layer | Example resources |
|---|---|
| Governance and management system | NIST AI RMF, ISO/IEC 42001 |
| Enterprise controls | CSA AICM, NIST SP 800-53 |
| Threat modeling and testing | OWASP, MITRE ATLAS, NIST AI 100-2 |
| Vendor assurance | Third-party risk program, SOC 2 reports |
| Executive reporting | Scorecard, escalation thresholds |
Map to What You Already Run
Don't build disconnected AI-only processes. Extend NIST CSF, ISO 27001, SOC 2, privacy, third-party risk, and incident-response programs. ISO explicitly allows 42001 to align with ISO 27001.
Mappings have limits, though. One published AI RMF to ISO 42001 crosswalk targets the draft standard, not the final 2023 edition, so verify before reuse.
Selection Criteria
Compare candidates on:
- Scope and lifecycle coverage
- Control specificity
- Sector relevance
- Cloud and vendor applicability
- Evidence requirements and auditability
- Ease of explaining to executives
Avoid Checkbox Adoption
For every deferred control, document:
- Rationale for the deferral
- Compensating safeguards
- Residual risk
- Executive who accepts it
Give exceptions an expiry date. A temporary control with no end date becomes policy.
How to Operationalize an AI Risk Management Framework
1. Build the Inventory and Ownership Model
Inventory the full AI footprint before you set controls:
- Approved and unapproved tools, models, and APIs
- Datasets, agents, and retrieval stores
- Vendors, affected systems, and data classifications
- Business owners for each system
Exporting SSO app catalogs from Okta, Entra ID, or Google is a fast first pass at shadow AI.
Assign accountable owners across security, technology, legal, privacy, risk, product, data science, procurement, and the business function that uses each system.
2. Govern and Map: Tiers and Gates
Define risk tiers, approval gates, decision rights, intended and prohibited use, human oversight, and escalation thresholds.
Require a documented impact assessment for higher-consequence uses:
- Customer-facing decisions
- Sensitive data processing
- Regulated workflows and financial actions
- Employment decisions
- Healthcare-related use
- Physical-world effects
ISO/IEC 42005:2025 offers guidance on AI impact assessment.
3. Measure: Test and Collect Evidence
Layer your testing:
- Model validation and data lineage checks
- Access-control testing
- Prompt-injection and jailbreak testing
- Privacy and data-leakage testing
- Adversarial testing
- Output-quality and bias evaluation where relevant
- Monitoring for drift or changed vendor behavior
Benchmarks have limits. NIST notes that laboratory results may not extrapolate to deployment, so treat them as inputs, not proof of safety.
Pick about ten key controls and run monthly evidence checks with named owners.
4. Manage Residual Risk
Apply operational controls that keep residual risk within appetite:
- Least-privilege access
- Model and vendor change management
- Human approval for high-impact actions
- Rollback plans and incident playbooks
- Continuous monitoring
When an AI incident occurs, reconstruct:
- The prompt or input
- Model and version
- Data accessed
- Tools called
- Action taken and the authorization chain
- Business impact and remediation decision
OWASP recommends tamper-evident, time-stamped logs to make that possible.
5. Make It Inspectable
Use a stable dashboard and a time-bound plan. Track owners, overdue decisions, high-priority findings, control-test results, exceptions, incidents, and vendor changes. Leave out disconnected technical trivia that does not change a decision.
Tyson Martin supports boards and executive teams as a board advisor or interim/fractional CISO, clarifying decision rights and escalation thresholds and building a measurable 90-day plan with owners.
What Boards and Executives Should Measure
Questions Directors Need Answered
- Where is AI used?
- What can it access?
- Who approved it?
- What could fail?
- How quickly can we contain it?
Reporting should connect AI systems to business processes, sensitive data, regulatory obligations, customers, revenue, resilience, and reputation. Deloitte also suggests asking whether management has defined AI risk appetite.
A Concise Scorecard
- Inventory coverage
- Share of high-risk use cases with documented approvals
- Control-testing completion
- Unresolved high-severity issues
- Access-review results
- Vendor-assurance status
- Incident-response readiness
- Monitoring coverage
Benchmarks help interpret maturity, but none proves safety. NACD's 2025 survey found 36.30% of boards had adopted an AI governance framework, while 62.33% reserved full-board AI discussion time. Adoption and agenda time are different indicators.
Escalation Rhythms
Separate management action from board oversight:
- Escalate immediately: threshold breaches, incidents involving sensitive data or regulated workflows, repeat exceptions.
- Regular committee report: trends, exceptions, vendor changes, test results.
- Risk acceptance: specify who accepts low risk, who accepts medium risk, and what must reach the board.
Verify remediation with evidence and due dates. For public companies, SEC rules require disclosure of material cyber incidents within four business days of determining materiality, so decision rights must be settled before an incident.
Frequently Asked Questions
What are some examples of AI security risks?
Common examples include prompt injection, sensitive-data leakage, unauthorized model or tool access, data poisoning, model theft, supply-chain compromise, insecure agents, harmful outputs, and weak monitoring.
Can AI do risk assessments?
AI can help identify, classify, and prioritize risks. Accountable people must still validate context, business impact, evidence quality, and risk acceptance.
What are the four types of AI risk?
No universal four-part taxonomy exists. A practical grouping is security, privacy, safety and reliability, and fairness or societal impact, with legal and operational risk tracked separately.
Is the NIST AI Risk Management Framework mandatory?
No, it's voluntary. Contracts, sector rules, state or federal obligations, customer expectations, or internal policy may still require specific controls.
How do organizations implement an AI security and risk management framework?
Build an AI inventory, assign owners, and tier risks. Map frameworks to existing controls, apply lifecycle controls, then test, monitor, prepare incident response, collect evidence, and review with executives on a recurring schedule.
