1.2 — The Four Core Functions
The NIST AI RMF Core consists of four functions that provide a structure for managing AI risks. These functions are not sequential — they operate concurrently and iteratively throughout the AI system lifecycle. The GOVERN function is cross-cutting, meaning it underpins and informs all other functions.
GOVERN — Organizational Policies and Culture
GOVERN establishes and maintains the organizational policies, processes, procedures, and structures for AI risk management. This is the cross-cutting function that informs and is informed by the other three. Key activities include defining roles and responsibilities, establishing risk tolerances, creating accountability structures, and fostering an organizational culture of responsible AI. GOVERN has 6 categories (GV-1 through GV-6) covering policies, accountability, workforce diversity, organizational culture, and stakeholder engagement.
MAP — Context and Risk Framing
MAP creates context for framing risks related to an AI system. This function helps organizations understand the AI system's purpose, its users, the operational environment, and the potential impacts. Mapping involves identifying and classifying the AI system, understanding its intended and unintended uses, documenting data provenance, and assessing the legal and regulatory landscape. MAP has 5 categories covering system context, requirements, benefits/costs, and risk identification.
MEASURE — Analysis and Monitoring
MEASURE employs quantitative, qualitative, or mixed methods to analyze, assess, benchmark, and monitor AI risks and their impacts. This includes selecting and applying appropriate metrics, conducting testing and evaluation (including adversarial testing and red-teaming), tracking identified risks over time, and comparing system performance against established benchmarks. MEASURE has 4 categories covering metrics selection, evaluation, and tracking.
MANAGE — Response and Communication
MANAGE allocates risk resources and implements plans to respond to, recover from, and communicate about AI risks. This function includes prioritizing risks based on impact and likelihood, implementing mitigation strategies, establishing incident response procedures, and continuously monitoring the effectiveness of risk treatments. MANAGE has 4 categories covering risk prioritization, treatment, and communication.
GOVERN is the only cross-cutting function — it is NOT part of the MAP→MEASURE→MANAGE sequence. Exam questions often test whether you understand that GOVERN underpins all other functions. Also remember: the functions are concurrent and iterative, not sequential or one-time activities.