NIST AI RMF Explained Simply: Managing AI Risk Like a Restaurant

 The NIST AI Risk Management Framework (AI RMF) is a voluntary playbook for building and running AI responsibly, organized into four functions: Govern, Map, Measure and Manage. This post explains each one with a restaurant analogy, so you can use the framework without reading the full document.

The big idea: a health inspection for AI

Imagine you are opening a restaurant. Before serving a single plate, you would ask: is the kitchen safe, could anyone get food poisoning, and who answers if something goes wrong? The AI RMF asks the same questions about AI systems.

A risk framework is a shared language and process for answering three things: what could go wrong, how bad would it be, and what do we do about it? NIST, the US standards body behind it, published AI RMF 1.0 in January 2023 so that organizations of any size can talk about AI risk in the same terms.

Two things to know up front. It is voluntary, so no one can be "NIST AI RMF certified". And it is not a checklist you finish once: it is a cycle you keep running as your AI, your data and your users change.

The four functions at a glance

The framework's core is four functions. Govern sets the rules and runs underneath everything; Map, Measure and Manage are repeated as your AI changes. The example column follows one case through all four: a hospital using AI to read X-rays.

Govern: the restaurant owner

Govern answers "who is in charge here?" before anything else. It covers the culture, policies and accountability that decide how AI gets built and used, and NIST treats it as cross-cutting: it applies to the other three functions rather than coming first and ending.

Questions to ask:

• Who is accountable when an AI decision goes wrong?
• Which written policies guide how we build and buy AI?
• How do we make responsible AI the normal way of working, not an extra step?

Example: a bank adopts a rule that every AI loan decision must be explainable to the customer and audited each quarter. That one sentence assigns ownership, sets a standard and creates a check.

Map: the health inspector's survey

Map is about context. Before you build or buy, write down what the AI is supposed to do, who it touches and where it could hurt someone. Most AI incidents come from a gap here: a system used on people, or in conditions, its builders never considered.

Questions to ask:

• What is this system for, and what is it explicitly not for?
• Who are the affected users and communities, including people who never chose to use it?
• What could go wrong in this specific setting?

Example: a hospital notes that its X-ray AI will read scans of elderly patients, that a missed finding can delay cancer treatment, and that the model was trained mostly on data from one population. That is a map: a list of risks to test next.

Measure: the kitchen thermometer

Measure turns the worries from Map into numbers. A cook does not guess whether the chicken is cooked; they check the temperature. Likewise, test your AI for accuracy, bias, robustness and failure modes, and write down the results.

Questions to ask:

• How does performance differ across groups of people?
• How does it behave on unusual or adversarial inputs?
• How does it fail, and how often?

Example: the hospital finds its model is 94% accurate overall but only 78% accurate for patients over 75. The overall number hid the problem; the breakdown exposed it, and now there is a figure to act on.

Manage: the safety protocol board

Manage decides what to do about the risks you measured. For each one you can reduce it, accept it knowingly, transfer it, or stop the project. Then you keep watching, because the AI, its data and its users will drift.

Questions to ask:

• Which risks are highest priority, and what is the fix for each?
• Who monitors the system after launch, and what do they look for?
• What is our plan when something goes wrong?

Example: the hospital requires a radiologist to review every scan for patients over 70 until accuracy for that group passes 90%. It also assigns someone to track the numbers monthly, and writes down who can switch the system off.

The goal: seven traits of trustworthy AI

The four functions exist to help you build AI that has seven characteristics. These are NIST's own terms, shown here with a plain-English reading and a restaurant version.

Generative AI and what is changing in 2026

AI RMF 1.0 is still the current version, and NIST says it is being revised as part of the White House AI Action Plan, with no date given. Until the revision lands, cite 1.0 and check NIST's page before you publish anything that depends on the version.

Two companion pieces matter now:

• Generative AI Profile (NIST AI 600-1), published July 26, 2024. It maps suggested actions for generative AI back to Govern, Map, Measure and Manage, and names twelve risks that are unique to or made worse by generative AI. Confabulation (what most people call hallucination) and data privacy are two of them.
• Critical infrastructure profile: on April 7, 2026 NIST released a concept note for an AI RMF profile on trustworthy AI in critical infrastructure. It is a concept note, not a finished profile.

If you build with large language models, the practical move is to run the four functions on your system, then use the Generative AI Profile as the risk list for the Map and Measure steps.

Where to start: a first-month checklist

Start small: one AI system, four weeks, one action per function. Pick the system that could do the most harm if it failed.

• Govern: list every AI system and AI-powered vendor tool in use, and name one accountable owner for each.
• Map: write a one-page profile of your riskiest system covering its purpose, who it affects and the worst realistic failure.
• Measure: choose two or three measures, such as accuracy for each user group and the count of harmful outputs, and run the first test.
• Manage: decide when a human must review the output, who monitors it after launch, and who can switch it off.
• Review: put a 90-day re-check on the calendar, because the cycle only works if it repeats.

Sources

• NIST AI Risk Management Framework: release dates, revision notice and the critical infrastructure concept note.
• NIST AI 600-1, Generative AI Profile: the generative AI companion to the framework.

Useful ChatGPT Tips for Visual Learners or Content Creators

 I happened to see a Tiktok post by an influencer today and she shared few ChatGPT tips to summarize books in visual one-pager summary.

What you need to do: just upload the cover image of the book that you want to get the summary from and type these prompts into ChatGPT.

So I tried with this book Tiny Experiments by Anne-Laure Le Cunff which currently is in my to-read list. I got the cover image below from Amazon.

And here are the results of each prompt for comparison (tested using my free subscription of ChatGPT).

/mindmap - simple summary visualization

/sketchnotes - handwritten style note

/flashcards - The result I got is different from the video that influencer shared, but I guess this is useful for when you're studying for exam

/educationalcomics - cute comic content

I think above prompts are really useful, especially for someone who are like me, visual learners. 

AI Training You Can Take To Upskill Yourself

AI is the buzzword today, even in cybersecurity field. As tech professionals need to constantly upskill themselves, it is timely for us to learn AI too.

Don't know where to start? Here are the compilation of AI training courses you can take (will update from time to time):

Microsoft AI Skills Navigator (free) 

AWS Agentic AI Demonstrated (free)

Anthropic Academic (free)

Google Beginner: Introduction to Generative AI (free)

This learning path contains 5 courses:

• Introduction to Generative AI (45 mins)
• Introduction to Large Language Models (1 hour)
• Introduction to Responsible AI (15 mins)
• Prompt Design in Agent Platform (1 hour)
• Responsible AI: Applying AI Principles with Google Cloud (2 hours)

How You Can Get Started in Cybersecurity Field

As the technology advances, cybersecurity has gained popularity and increased demand in recent years. Many media have reported that there are lack of cybersecurity professionals and many jobs have gone unfilled. If you're interested to join the cybersecurity field, here are the key steps you should do to get started:

1. Understand the Basics of Cybersecurity

Before diving into specialized areas, it’s important to have a solid understanding of what cybersecurity is and its role in protecting digital assets. Focus on these foundational concepts:

• Confidentiality, Integrity, and Availability (CIA Triad): The core principles of cybersecurity.
• Types of Cyber Threats: Malware, phishing, ransomware, and social engineering.
• Basic Networking: Understand IP addresses, TCP/IP, DNS, VPNs, firewalls, and routers.

2. Get Familiar with Key Tools & Technologies

To be effective in the field, you need hands-on experience with the tools that cybersecurity professionals use. Some important tools to explore include:

• Firewalls and Intrusion Detection Systems (IDS).
• Encryption tools for data protection.
• Security Information and Event Management (SIEM) platforms like Splunk or ELK Stack.
• Vulnerability scanners such as Nessus or OpenVAS.
• Penetration testing tools like Metasploit, Burp Suite, or Wireshark.

3. Choose a Specialization

Cybersecurity is a vast field, so narrowing down a specific area of interest can help. Some common specializations include:

• Network Security: Protecting the network infrastructure and preventing unauthorized access.
• Application Security: Securing software and applications from vulnerabilities.
• Incident Response: Managing and responding to security breaches and incidents.
• Threat Intelligence: Analyzing and understanding cyber threats and their origins.
• Compliance and Risk Management: Ensuring organizations meet legal and regulatory requirements (e.g., GDPR, HIPAA).

4. Obtain Relevant Certifications

Certifications help validate your skills and demonstrate your competence to potential employers. Some well-recognized cybersecurity certifications include:

• CompTIA Security+: A great entry-level certification that covers the basics of cybersecurity.
• Certified Information Systems Security Professional (CISSP): For professionals with more experience.
• Certified Ethical Hacker (CEH): Focuses on penetration testing and ethical hacking.
• Certified Information Security Manager (CISM): Focuses on managing and governing cybersecurity programs.
• Cisco Certified CyberOps Associate: Useful for those interested in network security.

5. Hands-On Practice

Cybersecurity is a practical field that requires hands-on skills. Set up a home lab or use online platforms to practice real-world scenarios. Some options include:

• TryHackMe and Hack The Box: Interactive platforms with labs for practicing penetration testing and other skills.
• Build a Home Lab: Set up virtual machines and test security tools and configurations in a controlled environment.
• Open Source Tools: Play with open-source tools like Wireshark, Snort, or Kali Linux to improve your practical knowledge.

6. Stay Current with Threats and Trends

Cybersecurity is a constantly evolving field, with new threats emerging every day. To stay ahead:

• Follow Cybersecurity Blogs and News Sites: Sources like Krebs on Security, Dark Reading, and Threatpost will help you stay informed.
• Participate in Forums: Join cybersecurity communities like Reddit’s r/cybersecurity, or specialized forums like StackExchange or InfoSec World.
• Attend Conferences & Webinars: Look for events like Black Hat, DEF CON, RSA, or local meetups to network and learn.

7. Build a Network

Building relationships with other professionals in the industry is vital for your growth:

• LinkedIn: Engage with cybersecurity professionals on LinkedIn to learn from their experiences.
• Local Meetups: Join local groups to meet people in person and exchange ideas.
• Mentorship: Find a mentor in the field who can offer advice and help you grow.

8. Understand Cybersecurity Governance & Risk

As a leader, it's crucial to understand how to align cybersecurity strategies with business goals:

• Cybersecurity Frameworks: Familiarize yourself with standards like NIST, ISO 27001, and the CIS Controls.
• Risk Management: Understand how to assess, mitigate, and manage cybersecurity risks in an organization.
• Compliance: Learn about laws and regulations like GDPR, HIPAA, and PCI-DSS.

9. Consider the Soft Skills

While technical skills are vital, soft skills are equally important for a successful cybersecurity career:

• Communication Skills: You’ll need to explain complex technical issues to non-technical stakeholders.
• Problem-Solving: Cybersecurity is about solving puzzles and identifying vulnerabilities.
• Teamwork: Collaboration with other IT professionals, executives, and departments is key.
• Attention to Detail: Cybersecurity requires a keen eye for identifying even the smallest security gaps.

10. Seek Entry-Level Opportunities

Start with entry-level roles to build experience. Some possible starting positions include:

• Security Analyst: Monitoring and analyzing security systems.
• Network Administrator: Managing and securing network infrastructure.
• Incident Responder: Responding to and investigating security incidents.
• SOC Analyst: Working in a Security Operations Center to monitor for threats.

11. Invest in Continuous Learning

The cybersecurity landscape is always changing, so continuous education is essential. Regularly take courses, read books, and participate in webinars to enhance your skills and stay relevant.

Conclusion

Cybersecurity is a dynamic, high-demand field, and getting started involves both acquiring the necessary technical expertise and developing a broader understanding of security concepts. It requires dedication, a continuous learning mindset, and the ability to adapt to new challenges. By following these steps, newcomers can lay a solid foundation and eventually build a successful career in cybersecurity.

Books I Used to Get My Cybersecurity Certifications

Disclaimer: I'm a big fan of Mike Chapple books and I've been using his books to prepare for all my three cybersecurity certifications CISSP, CCSP, CISM. I read the whole official study guide books and usually start to do the practice questions from the practice tests books 1 month before the actual exam day.

You can find the link to get the books from Amazon on each link.

 CISSP Official Study Guide (link included)

Read on how I prepared for my CISSP exam here

CISSP Official Practice Tests (link included)

I recommend to do practice tests around 1 month before the exam day.

CCSP Official Study Guide (link included)

Read on how I prepared for my CCSP here

CCSP Official Practice Tests (link included)

CISM Official Study Guide (link included)

My other post:

Things I do to stay relevant in tech/cybersecurity industry

Things I Do to Stay Relevant in the Tech/Cybersecurity Industry

 I have been working in tech industry for more than 10 years and the past few years in Cybersecurity space. It's been a great journey so far. But tech and cybersecurity industries are like our galaxy. There are so many categories inside them and so much things to learn (this what excites me actually, everyday is learning day).

It's undeniable, the industry is so fast evolving everyday. There's always new innovations appear on the market. That's why, we, tech/cybersecurity workers, need to stay relevant as well. Here are few ways that I do to stay relevant in the fast-moving tech and cybersecurity industry.

1. Connect with people and follow relevant organisations/groups on LinkedIn

I got so much benefits from my circle on LinkedIn. I got to know about new vulnerabilities or new features update or relevant events from posts that my circle member posted or liked or shared. You'll be surprised by how information-rich your LinkedIn feed can be. 

2. Join relevant physical events and network with fellow professionals

I personally joined my professional body's local chapter and I've learned a lot from other experts. I got so much other opportunities as well which I wouldn't get if I never join the chapter, like hosting relevant events locally and regionally, both physically and virtually. And, it has expanded my network too, which I am grateful for. When I was affected by layoff last year, there were so many people reached out to me and extended their help.

3. Keep checking on job vacancies although you're not looking for a change

I always do this until now. Not only I get the glimpse of the salary market, but also what are the skills needed in the market for my current role or my next target role. This will help me to prepare on what skills to polish for the next 1-2 years time. By then, when I'm in the lookout for new job/opportunity, I know that I'm ready for my jump.

Hope my above two cents are useful for you. I'm interested to know what other ways you do to stay relevant in your industry. Feel free to share!

The importance of cybersecurity awareness programs and it can be your first defense against cyber attacks

 Cyber attacks are getting sophisticated and growing in numbers everyday. Small medium businesses and healthcare are the new target of the cyber threat actors. Big companies are not escaping from attacks as well. A lot of cyber attacks in form of phishing and social engineering have been the main concern in the industry. This is why it's important that all staffs in your company are well-equipped with knowledge of various cyber attacks and how to protect themselves and the company. Cybersecurity awareness programs, if done in consistent and right way, can provide the company with strong defense against various cyber attacks.

There are few things that company can start doing in boosting the cybersecurity posture, such as having effective phishing campaigns, launching periodic cybersecurity awareness newsletter, reviewing and socializing company's security policies, and holding targeted cybersecurity training for specific groups of staff.

Effective Phishing Campaigns

In order to have effective phishing campaigns, they must take recent trending topics and are designed as close as possible to the actual email so staffs would naturally think that they are legitimate and "fall" for the suggested actions, such as clicking links, opening attachments or providing their credentials. Once the campaign ends, you can then send campaign closure email to all staffs and put some "hints" to help them identify phishing emails.

Cybersecurity Awareness Newsletter

It's good to have periodic newsletter about various domains in cybersecurity and remind all staffs on company's acceptable use policy. With these newsletters, all staffs will be reminded on what can and what can't be done when they are under your company's employment period and handling company's data.

Company's Security Policies

Policies are important to be established within the company as operational guidelines to safeguard the company's business continuity. Policies usually contain general clauses and standard or procedure documents can be created to have more detailed information related to the policies.

Targeted Cybersecurity Training Programs

Various training programs can be set with relevant content for different groups of people in the company. For example, you can setup secure coding practice workshop for developer team or third-party risk assessment workshop for procurement or sourcing team.

Cybersecurity awareness programs can be your first defense method in countering cyber threats. You can always start small by creating few basic policies, publishing some security related newsletters or posters, or launching a few simple phishing campaigns. Once you have done the first steps, you can review the results and consider improvements for next steps.