What are the four key functions of the NIST AI RMF?

• A. Govern, Map, Measure, Manage
• B. Define, Assess, Implement, Verify
• C. Plan, Do, Check, Act
• D. Monitor, Analyze, Report, Remediate

Answer: (A)

The main concept being tested is understanding the four functional areas defined by the NIST AI RMF and how they guide AI risk management. The four functions are Govern, Map, Measure, and Manage.

Govern sets the tone and accountability for AI risk. It involves establishing policies, leadership oversight, roles, responsibilities, and risk tolerance so there is clear ownership of how AI systems are developed and used.

Map is about creating a clear view of the AI system within its broader context. This means outlining system boundaries, data flows, interfaces, dependencies, and where risks could arise across the lifecycle, so you know what to consider and protect.

Measure focuses on assessing risk and performance through appropriate metrics. It includes monitoring fairness, bias, accuracy, robustness, privacy, security, and other relevant factors, turning qualitative concerns into quantitative signals that guide decisions.

Manage is the action-oriented part: implementing mitigations, controls, and improvements, and integrating risk responses into development, deployment, and ongoing governance. It ensures that identified risks are addressed and that risk management evolves with the AI system.

Other option sets resemble different process models like a Plan-Do-Check-Act cycle or generic assessment stages, which don’t align with the four-purpose structure of the NIST AI RMF.