NIST AI Risk Management Assessment Services

A NIST AI Risk Assessment is a structured way to review how a business uses AI and what risks those systems bring.

The assessment uses the NIST AI Risk Management Framework to help find, analyze, measure, and manage AI risks at every stage. The framework has four main steps: Govern, Map, Measure, and Manage. NIST recommends repeating these steps as needed, rather than following them in a strict order.

A NIST AI Risk Assessment can examine internally developed AI systems, third-party AI platforms, generative AI applications, AI-enabled SaaS products, machine learning systems, and AI functionality embedded in existing business applications.

The assessment helps answer practical questions that leaders need to address:

Where is AI being used? What data is being provided to AI systems? What risks could result from inaccurate or manipulated outputs? Which AI vendors have access to sensitive information? Who is accountable for AI decisions? What happens when an AI system produces an unsafe, inaccurate, or unexpected result?

AI brings new risks that traditional cybersecurity programs may not fully cover.

A conventional IT security assessment may determine whether a server is patched or whether an application has an exploitable vulnerability. An AI risk assessment must also consider questions about model dependability, data quality, privacy, transparency, human review, intellectual property, AI vendor dependencies, and the consequences of AI-made decisions.

For example, an employee might enter confidential information into a public AI service without realizing it is stored outside the company’s approved environment. A software team could use AI-generated code without fully reviewing its security. A customer-facing AI application might create inaccurate information that affects business decisions. Or a company could use an AI-enabled product without deciding who is responsible for monitoring its performance.

Because of these risks, managing AI is now an important part of overall business risk management.

The NIST AI RMF gives companies a practical way to manage AI risks and make AI systems more trustworthy. It is based on four main functions: Govern, Map, Measure, and Manage.

Govern: The Govern function establishes the policies, accountability, responsibilities, and organizational structures for managing AI risk.

Tanner Security evaluates whether your company has appropriate leadership oversight, documented AI policies, risk ownership, approval processes, accountability, and processes for managing AI during its lifecycle. Good governance helps companies make consistent decisions about how they get, build, use, and monitor AI.

Map: The Map function focuses on understanding AI systems, their intended uses, the stakeholders affected, operating environments, and possible risks.

Our assessment identifies AI technologies and use cases throughout the company and evaluates how those systems interact with business processes, sensitive information, employees, customers, vendors, and other systems. This mapping matters because many companies do not have a full list of the AI tools they use.

Measure: The Measure function is about assessing and tracking AI risks using different methods, whether based on numbers, descriptions, or both. NIST says this means assessing risk and trustworthiness and monitoring AI systems over time.

Tanner Security evaluates how your company measures AI performance, monitors risk, validates outputs, documents testing, and identifies abnormal behavior.

Manage: The Manage function is about deciding which risks are most important and taking action. NIST says this means focusing resources on the biggest risks and setting up ways to respond to incidents, new risks, and changes as they come up.

Our consultants help companies develop practical remediation strategies and establish processes for managing AI risks throughout the system lifecycle.

We start each project by learning about your business, how you use AI, your technology setup, risk tolerance, the rules you need to follow, and your main goals.

We then develop an inventory of AI technologies being used or considered within the company. This may include generative AI tools, AI-enabled SaaS platforms, internally developed models, machine learning systems, customer-facing AI applications, and AI functionality embedded within existing software.

Once we have mapped your AI, we review risks across many areas of your network. We look at controls like data privacy, cybersecurity, intellectual property, model dependability, AI vendor risk, human review, transparency, business impact, and regulatory exposure.

We review the controls throughout the AI lifecycle that are outlined in the NIST AI framework. These controls would include acquisition, design, development, deployment, use, monitoring, and retirement. The assessment also considers whether appropriate processes exist to validate AI outputs, manage incidents, document decisions, and escalate problems.

In the end, you get a clear assessment of your AI risks, along with recommendations ranked by how likely and serious they are, and what matters most to your business.

Good AI governance makes it clear who is responsible for AI decisions and how those decisions are made.

A mature governance program needs to address how AI tools are approved, what data may be provided to AI systems, which use cases require additional review, how AI vendors are evaluated, who is responsible for monitoring AI systems, and what happens when an AI system produces unexpected or harmful results.

Tanner Security helps businesses evaluate existing AI governance and identify opportunities to improve policies, accountability, oversight, documentation, and executive reporting.

The goal is not to stop employees from using AI. Instead, it is to put enough structure in place so the company can use AI effectively while managing risks.

Generative AI brings its own set of risks that need extra attention.

These may include disclosure of sensitive information, prompt injection, inaccurate or fabricated outputs, intellectual property issues, data leakage, insecure integrations, model manipulation, and inappropriate reliance on AI-generated information.

NIST published the Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) in July 2024 as a companion resource to the AI RMF, addressing risks specifically associated with generative AI.

Tanner Security can include the NIST Generative AI Profile in your assessment if generative AI is a major part of your company’s risk environment.

AI security is closely connected to cybersecurity.

An AI application may depend on APIs, cloud infrastructure, databases, identity systems, third-party services, and sensitive business data. Weaknesses in any of these components can introduce risk into the AI system.

Our assessments consider AI security within the larger technology environment. Depending on scope, this may include access controls, data protection, application security, cloud security, API security, third-party risk, logging, monitoring, and incident response.

By seeing AI as part of the larger technology landscape, businesses avoid treating it as a separate problem.

Many businesses do not build their own AI systems. Instead, they purchase AI-enabled products or rely on third-party platforms, APIs, cloud services, and software vendors.

These relationships add risk because systems may use sensitive data the company does not directly control.

Our assessment evaluates AI vendor relationships, data-sharing practices, contractual considerations, security responsibilities, transparency, and oversight processes. The objective is to help leadership understand which AI risks are being accepted, transferred, or mitigated through third-party relationships.

Tanner Security has over 20 years of experience in cybersecurity risk assessments, and now applies that expertise to AI governance. Our consultants use the same careful approach from cybersecurity, NIST programs, compliance work, penetration testing, and enterprise risk management to address AI challenges.

We are independent and do not sell AI products or promote any particular AI platform. Our job is to provide independent assessments and guidance so leaders can make informed choices about using AI.

That independence matters. Your AI governance should be based on your company’s risks, goals, rules, and real needs—not just what a technology vendor wants.

AI is being adopted quickly. Managing it well should be a priority, not an afterthought.

A NIST AI Risk Assessment can help your business identify where AI is used, understand new risks, set up accountability, and develop practical controls for responsible AI adoption.

Contact Tanner Security today to set up a consultation and learn how a NIST AI Risk Assessment can help your business use AI with more confidence and control.

A NIST AI Risk Assessment and an AI Governance Program are closely related, yet they serve different purposes.

A NIST AI Risk Assessment evaluates your company’s current AI environment and identifies risks, control gaps, governance weaknesses, and areas calling for improvement. It provides leadership with a better understanding of where AI risks exist and how to rank them.

AI governance is the ongoing framework for managing those risks. It establishes policies, responsibilities, approval processes, oversight and monitoring requirements, and accountability for AI across its lifecycle.

A useful analogy is to compare an AI Risk Assessment to an inspection of a company’s security controls. At the same time, AI governance is the ongoing security program that establishes how those controls will be managed and improved.

Many companies begin with an AI Risk Assessment and use the results to develop or strengthen an AI Governance Program. The assessment provides the baseline, while governance establishes the structure for the continuous management of AI risk.

Tanner Security can help with both the assessment and the governance work that follows, giving leadership a practical path from understanding AI risk to managing it effectively.