NIST AI RMF vs NIST Cybersecurity Framework 2.0: Do You Need Both?

If your organisation builds or uses AI, you almost certainly need both. The NIST Cybersecurity Framework 2.0 manages risk to your systems and data. The NIST AI Risk Management Framework manages the risks AI creates for people, including bias, unreliable outputs, opacity and misuse, that a security programme was never designed to catch. They share a "Govern" function and a common structure, so the practical answer is not two programmes but one, with an AI layer on top of your cyber baseline.

This guide explains what each framework covers, where they overlap, where they leave gaps, and how to run them together without duplicating work. It reflects the state of both frameworks as of late October 2026, including NIST's new Cyber AI Profile.

The one-sentence difference

That last phrase is the key. A perfectly secured hiring model can still discriminate. A chatbot with flawless access controls can still invent facts. CSF 2.0 has no language for those failures. The AI RMF does.

NIST AI RMF vs CSF 2.0 at a glance

How the functions line up

Both frameworks are built the same way: functions, then categories, then subcategories with outcomes. That makes them easy to run side by side. Here is how the AI RMF's four functions relate to CSF 2.0's six.

Where each framework leaves a gap

What CSF 2.0 misses about AI

The AI RMF defines seven characteristics of trustworthy AI. CSF 2.0 directly addresses only one of them.

What the AI RMF misses about security

The AI RMF names "secure and resilient" as a characteristic but does not tell you how to run a security programme. It has no detailed guidance on asset management, identity and access, vulnerability management, logging, incident response or recovery. It assumes you have those already, which is exactly what CSF 2.0 provides.

The real-world evidence shows what happens when either side is missing. IBM's 2025 Cost of a Data Breach report found that 13% of organisations had experienced an attack affecting their AI models or applications. Of those, 97% lacked proper AI access controls. Across the 600 organisations studied, 63% had no AI governance policies, and high levels of shadow AI added USD 670,000 to the average breach cost.

Missing access controls is a CSF failure. Missing AI governance policies is an AI RMF failure. Most organisations hit by AI incidents had both.

The bridge NIST is building: the Cyber AI Profile

NIST knows organisations need both. On 16 December 2025 it released a preliminary draft of the Cyber AI Profile (NIST IR 8596), which applies CSF 2.0's functions, categories and subcategories to AI. It covers three focus areas:

Comments closed on 30 January 2026, and the next step is an initial public draft. NIST is also developing SP 800-53 control overlays for AI systems. A concept paper was published in August 2025, and a first discussion draft for predictive AI followed in January 2026.

Is the AI RMF changing?

Yes, but slowly. In July 2025, America's AI Action Plan recommended revising the AI RMF to remove references to misinformation, diversity, equity and inclusion, and climate change. NIST confirms the framework is being revised as part of that plan. As of October 2026, however, version 1.0 remains the current framework and no revised draft has been published.

Meanwhile, NIST keeps building on top of it. The Generative AI Profile (NIST AI 600-1) identifies 12 risks unique to or worsened by generative AI, such as confabulation, information security and harmful bias, and gives suggested actions for each. In April 2026, NIST released a concept note for an AI RMF profile on trustworthy AI in critical infrastructure.

Do you need both? A quick decision guide

For most organisations past the experimentation stage, the answer is both. Adopt CSF 2.0 as the enterprise baseline, then use the AI RMF for every AI system that affects people. Neither framework is certifiable. If you need a certificate to show buyers, ISO/IEC 27001 and ISO/IEC 42001 are the certifiable counterparts, and both map well to the NIST frameworks.

How to run both without double work: a 6-step plan

1. Build one Govern function

   One risk committee, one policy set and one accountability map. Add AI-specific roles, such as an AI risk owner for each system, rather than a separate AI governance silo.

2. Extend your asset inventory to AI

   Add every AI system, model, dataset, third-party AI service and AI feature to the inventory you keep for CSF Identify. This becomes your AI RMF Map starting point.

3. Add AI risks to your risk register

   Use the same scoring method, with new risk types: bias, invalid outputs, unexplainable decisions, confabulation and misuse. Map each to an AI RMF subcategory.

4. Add AI testing to your assurance cycle

   Run validity, bias and robustness testing (AI RMF Measure) alongside vulnerability scans and penetration tests (CSF Protect and Detect). For generative AI, use the Generative AI Profile's suggested actions.

5. Extend incident response to AI incidents

   Add playbooks for AI-specific events, such as a model producing harmful output, data poisoning or prompt injection, to your CSF Respond and Recover processes.

6. Report one combined profile

   Show leadership a single view: CSF tier and target profile, plus AI RMF coverage for each high-impact AI system. Track the Cyber AI Profile so you can adopt it as it matures.

Common mistakes to avoid

• Assuming your CSF programme covers AI because AI runs on your infrastructure
• Running the AI RMF in a separate team with its own risk register
• Treating the Cyber AI Profile as a replacement for the AI RMF
• Claiming you are "NIST certified". Neither framework offers certification.
• Citing a revised AI RMF version that NIST has not published

A prompt to map an AI system to both frameworks

Paste in a description of one AI system to get a combined gap analysis. Use it as a working draft for your risk and security teams.

You are a risk lead experienced with NIST CSF 2.0 and NIST AI RMF 1.0
(including the Generative AI Profile, NIST AI 600-1).

AI system to assess:
[purpose, users, people affected, model type (predictive or
generative), in-house or third-party, data used, where it is
deployed, decisions it influences]

Our existing controls:
[paste security controls, policies, testing and monitoring practices]

Produce:
1. A table of our controls mapped to CSF 2.0 functions and categories.
2. A table of AI risks for this system, each mapped to an AI RMF
   function (Govern, Map, Measure, Manage) and to the affected
   trustworthiness characteristic.
3. Gaps where we have security controls but no AI-specific coverage,
   especially validity, bias, explainability and safety.
4. Gaps where we have AI governance but weak security, especially
   access control, logging and incident response.
5. If the system is generative, which Generative AI Profile risks
   apply and one suggested action for each.
6. The top 5 actions to close the biggest gaps, ranked by risk.

Use only what I provide. Mark anything uncertain as UNKNOWN.

CSF 2.0 keeps attackers away from your AI. The AI RMF keeps your AI from hurting the people it serves. Mature organisations stopped choosing between them a while ago. — Kumail Mehdi

Frequently asked questions

Sources

• NIST — AI Risk Management Framework 1.0 (NIST AI 100-1)
• NIST — Cybersecurity Framework 2.0 (CSWP 29)
• NIST — Generative AI Profile (NIST AI 600-1)
• NIST — AI Risk Management Framework programme page
• NIST — Cyber AI Profile, IR 8596 preliminary draft
• NIST — SP 800-53 control overlays for AI systems project
• White House — America's AI Action Plan (July 2025)
• IBM — 2025 Cost of a Data Breach: navigating AI