City GRC wants framework structure for AI risks already identified. What mapping best applies NIST AI RMF thinking?
Select an answer to reveal the explanation.
Short Explanation
NIST AI RMF isn’t wallpaper. Map risks into Measure and Manage with real control owners—not decorative covers or “nobody owns this.”
Full Explanation
City GRC applying NIST AI RMF thinking to already-identified AI risks should map those risks to Measure and Manage activities with named control owners. The RMF’s value in municipal practice is operational: measure risk characteristics and control performance, then manage treatments with accountability. Mapping identified risks into Measure/Manage workstreams with owners converts framework vocabulary into executable governance rather than shelfware.
Using NIST AI RMF only as a decorative cover page fails by concept because branding without mapped activities produces no risk reduction. Skipping measurement and jumping straight to undocumented acceptance fails because acceptance without measurement is uninformed and unaccountable. Assigning every AI risk to “nobody” so ownership stays vague fails because Manage functions require named parties who can implement and attest controls.
Exam caveat: Map/Measure/Manage/Govern are interrelated; this item emphasizes Measure and Manage with owners for risks already identified—Govern still sets policies, but ownership gaps break the loop. Operational check: for each register entry, record Measure metrics and Manage treatments, assign a primary owner and due date, and report residual risk to the AI governance body on a fixed schedule.