A water utility wants to structure AI controls using NIST AI RMF. What is the sound approach?
Select an answer to reveal the explanation.
Short Explanation
NIST AI RMF isn’t poster art. Map Govern, Map, Measure, and Manage onto the water utility’s real control catalog so each function has teeth.
Full Explanation
NIST AI RMF becomes useful for a water utility when its Govern, Map, Measure, and Manage functions are mapped onto the utility’s concrete AI control catalog—policies, risk assessments, metrics, monitoring, incident response, and change management. That mapping turns a national framework into operational controls for SCADA-adjacent analytics, customer-facing GenAI, or predictive maintenance models, with clear owners and evidence artifacts for each function. Utilities can then show regulators and boards how governance intent is implemented, measured, and improved.
Ignoring Govern/Map/Measure/Manage and inventing unrelated buzzwords only fails because idiosyncratic language does not create comparable, auditable control coverage. Applying the RMF only to paper forms and never to AI systems fails by concept: the framework targets AI system risk, not paper bureaucracy theater. Using the RMF solely as wall art with no control mapping fails operationalization—posters do not produce inventories, metrics, or management actions.
Exam caveat: mapping functions to controls does not require renaming every existing utility control; it requires traceability from RMF functions to the controls that satisfy them. Operational check: maintain a crosswalk from Govern/Map/Measure/Manage to named controls, owners, and evidence (for example, inventory, impact assessments, monitoring dashboards, and change tickets), and review gaps quarterly with the utility GRC or AI governance forum.