Introduction

The NIST pack is seven controls, and five of them flag rather than block. That balance is not an accident — it is the framework's own posture rendered as configuration. The AI RMF is a voluntary risk-management framework, not a compliance regime, and a pack built from it observes more than it stops.

Where to find it

AI Governance > Policies > System Policies > NIST AI RMF.

The seven controls

Note: Packs are maintained content, not fixed product surface. The list above was read from the product and may change as the pack is updated. The pack's own Controls tab is always the current list.

How the seven relate to the framework

The AI RMF is organised around four functions — GOVERN, MAP, MEASURE, MANAGE — and seven characteristics of trustworthy AI. A runtime pack can only reach the parts of MEASURE and MANAGE that are observable in traffic. Read against the trustworthy characteristics:

Two flat gaps out of seven, and a third that is weaker than its name suggests. That is the honest map, and it is the same one the framework pages give.

Two of the seven use the prompt-injection check, on different surfaces

This is the most instructive pairing in the pack, and it is easy to miss:

• Jailbreak attempts, on User input — someone typing at the agent, trying to talk it out of its instructions.

• Untrusted retrieved content, on Tool output — instructions hidden in a document, a web page or an API response the agent fetched.

The second is the harder threat and the less obvious one. A user attacking your agent is adversarial and expected; a poisoned document arriving through a retrieval tool is neither, and the agent has no reason to distrust it. Running the same check on both surfaces is the pack making a point worth learning from when you write your own controls.

"The prompt injection you should worry about is not the one a user types. It is the one your own retrieval tool brings back."

Six of the seven are shared with other packs

Only Flag untrusted retrieved content is unique to NIST. The rest are the same control objects bound into ISO 42001 or EU AI Act GPAI as well.

The practical effect: if you already run ISO 42001, adopting NIST adds four controls, not seven — the three shared are Block unapproved model or tool calls, Block secrets in tool input and Flag disparate outcome patterns — and editing any shared one changes both packs at once, silently. See Enabling & Disabling Policies.

A framework you cannot fail

Unlike a regulation, the AI RMF has no compliance obligation, no penalties and no certification. Adopting the pack is not "achieving NIST compliance" — there is no such thing — and it is worth being precise about that internally before someone puts it in a customer letter.

What the pack gives you is a defensible starting set of risk-management controls organised around a respected framework. That is genuinely valuable and it is a different claim.

Adopting it

1. Start here if you have no framework programme yet — Five of seven controls flag, so the pack observes before it interferes. It is the lowest-consequence pack to adopt first.

2. Watch the two blocking controls — Unapproved tool calls and secrets in tool input can stop legitimate work if the pack's assumptions do not match your tools.

3. Expect the flag queue to need reading — A pack that mostly flags is a pack that mostly produces work for a person. That is only governance if someone reads it — see Escalation & Notifications.

4. Point it at assets — It governs nothing until you do.

Operationalizing the AI RMF

• NIST AI RMF Overview

• MEASURE

• MANAGE

• Operationalizing in UnifyApps

Related

• ISO 42001 Pack

• Prompt Injection check

• ISO 42001 vs NIST AI RMF