Confirm the AI RMF applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
AI governance · NIST
NIST AI Risk Management Framework 1.0
Govern, map, measure and manage AI risk, including the AI your staff already use without asking.
Rather skip the call? Get a fixed-fee NIST AI RMF quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry NIST AI RMF, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no NIST AI RMF package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the NIST AI RMF-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what NIST AI RMF expects you to have in place.
- An AI inventoryEvery model, tool and vendor service in use, including the ones staff adopted without asking.
- GovernanceWho owns AI risk, a policy for acceptable use, and a review path before a new use goes live.
- Risk mappingFor each use: what data goes in, who is affected, what could go wrong and how you would know.
- MeasurementTesting for accuracy, bias, security and drift, with results recorded.
- Human oversightA person who can intervene, and a way for affected people to question a decision.
- Transparency and recordsDocumentation of the system, its limits and its training or supplier lineage, kept current.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for NIST AI RMF
The AI RMF is voluntary, like the CSF, and it is the structure regulators, insurers and ISO 42001 all point to. Four functions: Govern, Map, Measure, Manage.
We start with an inventory of the AI in use, write the policy, assess the risky uses and set the human approval points.
Map the AI in use: tick what is true
Tick what applies and we show where the four functions start for you.
The steps
Six steps from "does NIST AI RMF apply to us?" to evidence you can show
The whole NIST AI RMF journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- AI tools inventoriedPassing
- Policy acknowledged by staffPassing
- Approval points in placePassing
- Vendor terms reviewedPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for NIST AI RMF
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What NIST AI RMF costs, in plain numbers
Here is what is published, with who published it and when.
$0The framework. NIST publishes the AI RMF and its generative AI profile free of charge.Source: NIST AI Risk Management Framework (2024)
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on NIST AI RMF, in plain words.
Questions
NIST AI RMF questions we get every week
Is the NIST AI RMF mandatory?
No. It is voluntary guidance. It matters because buyers, insurers and regulators use it as the reference point when they ask how you govern AI, and because it gives a small team a structure instead of a blank page. Following it is evidence of reasonable care.Source: NIST AI Risk Management Framework
What is the Generative AI Profile?
NIST AI 600-1, published in July 2024, applies the framework to generative AI. It names risks such as confabulation, data privacy, information security and harmful content, and lists actions for each under the four functions. It is the most practical part of the framework for a business adopting chat assistants.Source: NIST AI 600-1
Where should a small business start?
With Govern and Map. Write an acceptable use policy, name an owner, and list the AI tools staff actually use, including personal accounts, from your sign-in and web logs. Then classify the data going into them. Our free AI readiness check gives you your starting stage in three minutes.Source: NIST AI Risk Management Framework
How does it relate to ISO/IEC 42001?
The AI RMF tells you what good AI risk management looks like; ISO/IEC 42001 is a certifiable management system that makes it auditable. They fit together, and our assessment reports against both so the same evidence serves a customer questionnaire and a future certification.Source: ISO, ISO/IEC 42001:2023
Does the AI RMF cover AI agents?
Its functions apply to any AI system, including agents that take actions. For agents the Measure and Manage functions matter most: limit what each agent can reach, require approval for risky steps, log every action and be able to pause it. That is how we run our own AI Workforce agents.
Do you certify NIST AI RMF compliance?
No. We do not certify, and the regulator, examiner or independent auditor for NIST AI RMF has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with NIST AI RMF?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do NIST AI RMF separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in AI governance: ISO 42001 · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for NIST AI RMF.
Book the demo and see how one control set carries NIST AI RMF and everything else you owe. Or leave your details and an engineer replies within one business day.