MS-1.1 Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for…
Approaches and metrics for measurement of AI risks enumerated during the Map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented. Measurement approaches are selected against the risks that mapping produced, most significant first, and anything left unmeasured is named as unmeasured rather than silently omitted.
Source: NIST AI RMF 1.0, MS-1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST AI RMF 1.0 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- The selected measurement approaches and metrics, traced to mapped risks · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- An explicit record of risks and characteristics that will not or cannot be measured, with reasons · Document repository
- Evidence the selection was implemented rather than only planned · Document repository
governing documentDocuments that govern the control
- The prioritisation showing the most significant risks addressed first · Document repository
First move
Common gaps auditors find
- Metrics chosen from what the tooling already emits rather than from the mapped risks
- Unmeasured characteristics simply absent, so their absence reads as a pass
- Selection documented with no evidence of implementation
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMP-5.2 Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback… · MS-1.2 Appropriateness of AI metrics and effectiveness of existing controls is regularly assessed and updated…