A water utility board understands NIST Cybersecurity Framework categories but is new to AI controls. How should security present AI program coverage?

Mapping AI security program controls to familiar NIST CSF categories for better board understanding and consistency with existing cyber governance is the communication strategy that anchors AI governance in the board's existing framework. The water board receives quarterly reports on cybersecurity mapped to NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover); AI security can use the same lens. For example: 'Model inventory and performance baselines' map to Identify; 'Access controls and monitoring for AI systems' map to Protect; 'AI drift detection and incident alerts' map to Detect; 'AI incident response procedures' map to Respond. This familiar framework reduces cognitive load for the board and connects AI governance to existing oversight mechanisms. Mapping AI model performance benchmarks to familiar NIST CSF categories gives the board a narrow technical slice instead of program coverage: benchmarks show how models score on accuracy or other metrics, not whether AI security controls across Identify, Protect, Detect, Respond, and Recover are in place and operating. The familiar categories would carry performance numbers rather than governance insight, so the board could not assess the breadth of the utility's AI security program or its accountability. Mapping AI incident response playbooks to familiar NIST CSF categories covers only the Respond slice of the program: playbooks detail response procedures, so the board would miss Identify, Protect, Detect, and Recover coverage needed to oversee the full AI security program. Unified framework mapping ensures coherence. Mapping AI regulatory compliance attestations to familiar NIST CSF categories shows compliance status rather than program coverage: attestations confirm that regulatory checkboxes are met, not whether the utility's own AI security program controls are designed and operating across the CSF functions. NIST provides standard definitions that prevent miscommunication. Operational check: remap the utility's AI security program against NIST CSF functions. For each function (Identify, Protect, Detect, Respond, Recover), list 1-3 AI-specific activities (e.g., under Identify: 'maintain AI model inventory and performance baselines'). Present this mapped version to the board at the next cyber-risk committee meeting.