Repository navigation
[UPDATE] agentic-top10/Agentic_NISTAIRMF.md - 5 NIST AI RMF subcategory IDs used with the wrong meaning (21 rows) #217
Description
File to update
File path:
agentic-top10/Agentic_NISTAIRMF.md: 21 mapping rowsdata/frameworks/nist-ai-rmf.json: subcategory titles (and one missing subcategory)data/entries/ASI*.jsonanddocs/data.js: regenerated from the above
Vulnerability ID(s) affected:
ASI01, ASI02, ASI03, ASI04, ASI05, ASI06, ASI07, ASI08, ASI09, ASI10
What is incorrect or outdated
Five NIST AI RMF subcategory IDs are used in the agentic mapping with the Registry title, meaning of the NIST AI RMF subcategory, and the meaning of the ASI risks not matching. The rows follow the registry titles, which are wrong. In most cases the registry descriptions carry the correct NIST text and contradict the titles.
| ID | Rows | Registry title | Meaning of ASI* | AI RMF subcategory meaning |
|---|---|---|---|---|
| MS-2.5 | 9: ASI01–ASI08, ASI10 | Adversarial testing | Adversarial / security testing (goal hijack, sandbox escape, A2A spoofing, chaos engineering) | The system to be deployed is demonstrated to be valid and reliable; generalisability limits documented |
| MG-2.2 | 7: ASI01, ASI02, ASI03, ASI05, ASI07, ASI08, ASI10 | Risk response - incident | Incident response (containment, rotation, kill switch, root cause) | Mechanisms are in place and applied to sustain the value of deployed AI systems |
| MG-2.4 | 2: ASI06, ASI09 | Risk response - change management | Response to confirmed memory poisoning / detected trust exploitation | Mechanisms to supersede, disengage, or deactivate AI systems |
| MG-3.2 | 2: ASI04, ASI08 | Communication of incidents | Residual supply-chain / cascade risk documented | Pre-trained models are monitored as part of regular monitoring and maintenance |
| MS-4.1 | 1: ASI09 | Measurement results communication | Feedback channels detecting operator over-trust | Measurement approaches are connected to deployment context and informed by domain experts |
21 of the 40 agentic NIST AI RMF rows are affected. The other 6 mapped subcategories (GV-1.6, GV-1.7, MP-2.3, MP-4.1, MP-5.1, MS-2.6) are used correctly.
Related registry problems found while checking the likely corrections:
MS-2.5description merges the first sentence of MEASURE 2.6 with MEASURE 2.5.MS-4.1description is the text of MEASURE 4.2.MG-1.4is titled "Risk treatment resources" (AI RMF 1.0: negative residual risks are documented).MG-3.1is titled "Pre-deployment assessment" (AI RMF 1.0: AI risks and benefits from third-party resources are regularly monitored).MG-4.3(incidents and errors communicated; tracking, response and recovery) is missing from the registry.
What it should say
Proposal: keep each row's content and change its ID to the AI RMF 1.0 subcategory that matches it. In the same PR, correct the registry titles so they describe each ID's actual AI RMF 1.0 meaning.
| Old ID | What the rows currently describe | New registry title for the old ID | Rows (content unchanged) | New subcategory | AI RMF 1.0 text supporting it |
|---|---|---|---|---|---|
| MS-2.5 | Adversarial and security testing: goal hijack, sandbox escape, A2A spoofing, chaos engineering | Validity and reliability demonstrated | ASI01, ASI02, ASI03, ASI04, ASI05, ASI06, ASI07, ASI08, ASI10 | MS-2.7 | "AI system security and resilience … are evaluated and documented." |
| MG-2.2 | Incident response: containment, credential rotation, kill switch, root cause | Value of deployed systems sustained | ASI01, ASI02, ASI03, ASI05, ASI07, ASI08, ASI10 | MG-4.3 | "Processes for tracking, responding to, and recovering from incidents and errors are followed and documented." |
| MG-2.4 | Response to confirmed memory poisoning: audit, content purge, impact assessment | Supersede, disengage or deactivate | ASI06 | MG-4.3 | "Processes for tracking, responding to, and recovering from incidents and errors are followed and documented." |
| MG-2.4 | Response to detected trust-exploitation patterns: operator retraining, interface redesign | Supersede, disengage or deactivate | ASI09 | MG-2.3 | "Procedures are followed to respond to and recover from a previously unknown risk when it is identified." |
| MG-3.2 | Residual supply-chain and cascade risk documented | Pre-trained model monitoring | ASI04, ASI08 | MG-1.4 | "Negative residual risks … to both downstream acquirers of AI systems and end users are documented." |
| MS-4.1 | Feedback channels detecting operator over-trust | Measurement approaches connected to deployment context | ASI09 | MS-3.3 | "Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics." |
Registry changes needed for the new subcategories:
| ID | Current registry state | Change |
|---|---|---|
| MS-2.7 | Correct ("AI system security and resilience") | none |
| MG-4.3 | Missing | Add: "Incidents and errors communicated; tracking, response and recovery" |
| MG-2.3 | "Risk response — recovery" | none (matches) |
| MG-1.4 | "Risk treatment resources" (wrong) | Retitle: "Negative residual risks documented" |
| MS-3.3 | "Feedback mechanisms" | none (matches) |
Also in the registry:
- fix the descriptions of MS-2.5 (currently merges MEASURE 2.6 and 2.5)
- MS-4.1 (currently the text of MEASURE 4.2). MG-3.1's title ("Pre-deployment assessment") is also wrong, although no affected row moves to it. Only the subcategories above were checked; the full set of 85 entries may need the same review.
Changing which control a row points to is a mapping judgment, so these changes need a named reviewer before merging.
Source / evidence
Primary source:
NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), Tables 3 (MEASURE) and 4 (MANAGE), and section 3.3 (Secure and Resilient): https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
Date of source:
January 2023. AI RMF 1.0 is still the current version, and the file cites it (lines 15 and 863). The registry was last synced 2026-04-10.
Severity of issue
- Critical — incorrect mapping that could lead a practitioner to the wrong control
- High — missing important control or incomplete coverage
- Medium — outdated reference, new CVE not yet cited
- Low — minor wording improvement
Are you willing to submit a PR?
- Yes
- No — please assign to a maintainer
Context: found while scoping the verification-methods pilot (#191, #216), which therefore links only to the 6 correctly used subcategories. Same class of issue as #189.
Activity
Prasad-desh commentedon Oct 7, 2026
@a-moskvin are you taking this one? It overlaps your verification pilot, so I don't want to cut across #216.
If it is open, I would offer to do the half that needs no mapping judgment, matching the split that worked on #187.
Registry corrections against AI RMF 1.0. The title and description fixes you list are verifiable line by line against NIST AI 100-1 rather than being judgment calls: MS-2.5's description merging MEASURE 2.6 and 2.5, MS-4.1 carrying MEASURE 4.2's text, MG-1.4 and MG-3.1 titled wrongly, and MG-4.3 absent. I would transcribe each from the published PDF, add MG-4.3, and extend the check to all 85 entries rather than only the ones in scope here, since you note the wider set may have the same problem.
The 21 row re-pointings I would leave alone. You are right that changing which control a row cites is a mapping judgment, and per STRAT-04 that belongs to a framework-owner reviewer. Same reason #187 registered and transcribed NIST AI 600-1 without asserting any mapping rows.
One data point on MG-4.3 being missing: while transcribing NIST AI 600-1 for #187 I found four subcategories cited as parents that do not resolve against
nist-ai-rmf.json— MG-4.3, MP-3.4, MS-2.12 and MS-2.13 — because the registry only holds subcategories that existing mappings cite. MG-4.3 is the one your 21 rows need, so adding it unblocks part of this regardless of who does the re-pointing.Happy to take it, or to leave it with you and just supply the AI RMF 1.0 transcriptions if that is more useful.
a-moskvin commentedon Oct 8, 2026
Thanks, @Prasad-desh , please take the registry part. Extending the check to 85 entries is much better than the 11 I covered.
Leaving the 21 row re-pointings for a reviewer makes sense. The table in my issue stands exactly as a proposal for review. I would be happy to draft the row changes as a separate PR once you fix the registry, so the reviewer sees them all on a correct registry.
If needed, happy to review your PR against AI RMF 1.0. #216 links only to the six subcategories that are already correct, so there's no overlap with it.
data: re-transcribe the NIST AI RMF registry from AI RMF 1.0 (#219)
emmanuelgjr commentedon Oct 9, 2026
Cross-reference: #219 has landed, so the registry now carries the published AI RMF 1.0 text for every id, including MG-4.3. The same five subcategories are also misused in 54 LLM and DSGAI rows, now tracked in #220, along with the two MP-3.5 rows #219 flagged. A reviewer would ideally take #217 and #220 together so all three files stay consistent.
a-moskvin commentedon Oct 11, 2026
While reviewing #216 against the corrected registry (#219), I found that the remaining 19 rows I left out initially have the same problem. These are the rows under GV-1.6, GV-1.7, MP-2.3, MP-4.1, MP-5.1 and MS-2.6. My original note said those six subcategories were used correctly. That was wrong: I had checked only the registry titles, not the row labels and text.
So, all 40 agentic NIST AI RMF rows need a row-by-row review. Some may keep their ID and only need the label corrected; others may need a different subcategory. #220 (LLM and DSGAI) probably needs a similar review, I haven’t checked it. None of the recent PRs touched markdown files
*_NISTAIRMF.md.I’m happy to draft the new mapping for Agentic: for each of the 40 rows, the current ID and label, a proposed AI RMF 1.0 subcategory, and the NIST text that supports it, for a reviewer to check.
Related: #216 links verification methods to some of these rows, so I’ll hold it until the rows are corrected.