nist-ai-rmf

What it does

The skill functions as an expert advisor on the NIST AI Risk Management Framework (AI RMF 1.0). It is intended to help organizations identify, assess, and manage risks across the AI lifecycle (design through decommission) by applying the four core functions: GOVERN, MAP, MEASURE, and MANAGE, with emphasis on trustworthiness characteristics and alignment to related standards. The output format emphasizes task-type tailored deliverables (organizational profiles, action plans, policy drafts, risk registers, cross-framework mappings, or general questions) and requires citing specific function+category+subcategory (e.g., GOVERN 1.1, MAP 4.2, MEASURE 2.3). It also instructs that outputs should reflect the AI RMF Playbook for suggested actions and that risk registers should include third-party/vendor-model dependency as a dedicated row. It notes that the AI RMF is voluntary, outcome-based, and not a compliance checklist, and that all seven trustworthiness characteristics inform risk assessment across functions. The skill explicitly references the companion Playbook structure mirrored in references/rmf-core.md for concrete next steps.

How it works

• It positions itself as an expert advisor on AI RMF 1.0 and the companion Playbook.
• It requires responses to be formatted according to task type, with outputs tied to specific framework categories (e.g., GOVERN 1.1, MAP 4.2, MEASURE 2.3).
• It mandates including the seven trustworthiness characteristics as a framing device for risk assessment and evaluation across outputs.
• It instructs that risk registers must include a dedicated third-party/vendor-model dependency row as a first-class risk.
• It provides a structured approach for different tasks (organizational profiles, action plans, policy drafts, risk registers, cross-framework mappings, general questions).
• It references the AI RMF Playbook as the source of suggested actions and requires adherence to its structure for concrete steps.

When to use it

Use this skill whenever questions involve NIST AI RMF, AI risk management, AI trustworthiness, GOVERN/MAP/MEASURE/MANAGE functions, AI RMF Playbook, AI risk profiles, responsible AI, bias management, transparency, explainability, reliability, safety, AI risk assessment, incident response, or alignment to EU AI Act, ISO 42001, or NIST CSF via AI RMF. Trigger even if the user doesn’t say 'skill'.

What it can touch

The skill declares tools: "claude-code". It instructs outputs to cite specific function+category+subcategory and to align with the Playbook’s suggested actions.

Caveats

• The AI RMF is described as voluntary and non-prescriptive, not a compliance checklist.
• Outputs must be framed around the four core functions and seven trustworthiness characteristics.
• Third-party/vendor-model dependency must be included as a risk entry in risk registers.
• Any policy or action recommendations should be grounded in the explicit categories/subcategories and the Playbook guidance; no speculative claims beyond stated framework content.