Repository navigation
[FRAMEWORK] NIST AI 600-1 (Generative AI Profile) — first addition on the ratified roadmap #119
Description
Tracking ticket for addition 1 of 3 on the roadmap ratified in #19. SP 800-53 (direct) and the CSA AI Controls Matrix get their own tickets when their turn comes — not now.
Why this one first
NIST AI 600-1 enumerates GenAI-specific risks against the same GOVERN / MAP / MEASURE / MANAGE structure as AI RMF 1.0, which this crosswalk already maps. The work is an extension of existing coverage rather than a framework from scratch, and it is the natural companion to the CSF 2.0 OLIR submission (docs/OLIR_SUBMISSION.md).
Standing conditions from #19
- Verified tier, schema v2 only. Every row lands with relationship, rationale type, rationale and confidence authored. No rows tagged
unreviewedand deferred — no further legacy-tier growth. - Provisional order. The sequence in roadmap: framework additions — NIST AI 600-1, SP 800-53, and the five unmapped references #19 stands until the STRAT-01 competitive teardown lands and may be reordered by it. Re-read roadmap: framework additions — NIST AI 600-1, SP 800-53, and the five unmapped references #19 before starting addition 2 or 3.
Scope of this ticket
Preparation and scoping only. No mapping is authored here — that is security judgment (C4) and belongs to a human reviewer.
Agent-safe work this ticket may cover:
- Register the framework in
data/framework-sources.jsonwith its published version, source URL andcheckeddate. - Transcribe the control/subcategory inventory into
data/frameworks/nist-ai-600-1.jsonfrom the published document, ids in their canonical NIST form, with an id grammar added toscripts/control-ids.jssocheckControlIdShapes()covers it from day one (see Swapped control_id / control_name: 576 mapping rows hold prose where an identifier belongs #35). - Record the denominator in
inventory_completeness, so any gap analysis states what it is a fraction of. - Prepare the empty mapping file(s) under the four source lists with the schema v2 columns in place.
Not in scope: which entry maps to which subcategory, at what relationship and confidence. That is the human step, and it should be reviewed by a framework-owner reviewer per STRAT-04.
Definition of done for the agent half
node scripts/validate.jsclean, with the new registry passing the id-shape guard.- The framework appears in the freshness report with a real
current_version, notnull. - No mapping rows are asserted; the mapping files exist with headers and no authored judgments.
Activity
Prasad-desh commentedon Sep 29, 2026
@emmanuelgjr — I'd like to take the agent-safe half of this (transcription and registration), leaving the mapping judgments to a framework-owner reviewer per STRAT-04. Coming across from #76 / #79 in the data-security repo.
Done locally against
main, ready to open as a PR:data/frameworks/nist-ai-600-1.json— 211 suggested actions across 49 AI RMF subcategories, transcribed from the published PDF (https://doi.org/10.6028/NIST.AI.600-1, July 2024),control_idin NIST's own Action ID formdata/framework-sources.json— registered withcurrent_version: "2024-07". The document carries no revision number, so the version is its publication month. Freshness goes 3 current → 4scripts/control-ids.js— id grammar^(?:GV|MP|MS|MG)-\d{1,2}\.\d{1,2}-\d{3}$, plus three tests, one asserting all 211 registry ids satisfy itinventory_completeness:complete, 211 of 211Verification:
npm run buildpasses.validate.jsat 0 errors / 88 warnings, identical to a clean clone.npm run test:scripts74/76, the two failures (exports.test.mjs,webapp.test.mjs) being pre-existing on unmodifiedmain.stats.jsreports "1 registry/registries carry no mappings — NIST AI 600-1".One transcription detail worth recording. A pattern match over the PDF finds 212 ids, but
GV-1.1-002occurs only in the explanation of the Action ID scheme ("GV-1.1-002 corresponds to the second suggested action for Govern 1.1"). GOVERN 1.1 has exactly one action; the tables define 211. It's noted ininventory_completenessso it doesn't get re-added later.Two calls I'd like you to confirm or overrule:
titlemechanically — first sentence when it is ≤120 chars, else the leading clause, else a word-boundary cut — with the verbatim Suggested Action text always indescription. Nothing is authored, but the rule is mine.nist-ai-rmf.jsonand appear here only asparentvalues. Including them would add 49 non-actions to the denominator thatinventory-completeness.jsexists to protect. CIS does carry its parents (henceREGISTRY_EXTRA_SHAPES), so precedent could cut the other way.And a blocker on the last scope bullet. "Prepare the empty mapping file(s) under the four source lists with the schema v2 columns in place" can't be satisfied as written:
validate.jsenforcesREQUIRED_SECTIONSon every mapping file (Why, Quick-reference, Audience, a per-entry###, References), so three stubs carrying only the v2 header produced 16 errors. A mapping file cannot exist without authored prose, which is what the ticket rules out. I left them out to keep the branch green. Happy to add them with the required sections filled if you'd rather have the scaffolding, but that is authored content and I didn't want to assume.Also worth noting
ast-top10currently holds only MAESTRO, so "the four source lists" is three files in practice unless you want an AST one seeded too.Fine to open the PR?
Prasad-desh commentedon Oct 3, 2026
Correction to the verification numbers in my comment above: they were wrong, and the claim that
exports.test.mjsandwebapp.test.mjsfail on unmodifiedmainis not true.I had not run
npm ci, so both were failing on a missingajvin my own environment. A clean clone is green. With dependencies installed, my change did break one test for a real reason, which is written up in #187.Current numbers are on that PR: 93/93 on the branch against 89/89 on a clean clone of 633c59a, and
validate.jsat 0 errors / 91 warnings matching that clone. Sorry for the noise on the thread.NIST AI 600-1: register the framework and transcribe its 211 suggeste…