Your Cybersecurity Framework (CSF) was created before generative AI became a staple on every developer's desktop, before agentic systems began making autonomous decisions, and before your Security Operations Center (SOC) started using AI-powered detection tools that aren't fully understood.
The NIST Cyber AI Profile addresses this gap by mapping AI-specific risks to CSF 2.0. This isn't just theoretical. With over 1,400 comments during the public review, the security community has made it clear: AI governance must integrate with existing cybersecurity practices, not stand alone.
This checklist helps you evaluate if your current cybersecurity framework accounts for AI risk. Each item maps to CSF 2.0 functions and includes what effective implementation looks like.
Prerequisites
Before you start:
- Document which systems in your environment use AI, including shadow AI deployments.
- Identify who owns AI governance decisions in your organization.
- Access your current CSF implementation documentation.
- Understand the difference between AI systems you build, buy, and integrate.
AI Governance Integration Checklist
1. Inventory AI Systems Across All Deployment Models
Document every AI system your organization uses, including:
- Vendor-provided AI tools (SaaS platforms with embedded AI)
- Internally developed models
- Open-source AI frameworks
- Browser extensions and desktop AI assistants (shadow AI)
Effective implementation: A living inventory categorizing each system by risk level, data access, decision authority, and whether it operates autonomously or requires human approval.
2. Define Accountability for AI Cybersecurity Outcomes
Assign clear ownership for AI-related security decisions, including:
- Approval of new AI tool deployments
- Ownership of risk when an AI system makes a security decision
- Whether you need a Chief AI Officer or if this responsibility sits with your CISO
- How existing governance bodies incorporate AI decisions
Effective implementation: A RACI matrix showing who is Responsible, Accountable, Consulted, and Informed for AI security decisions, with documented escalation paths for unexpected AI outcomes.
3. Establish Testing Requirements for AI Security Tools
If you deploy AI for security purposes, document:
- How you validate the AI system's decisions
- Performance metrics you track
- Testing for adversarial inputs or model poisoning
- Rollback procedures if the system degrades
Effective implementation: Documented test cases for normal and adversarial scenarios, with clear thresholds for mandatory versus optional human review.
4. Implement Human-in-the-Loop Controls for High-Risk Decisions
Identify which AI decisions require human approval:
- Access grant/deny decisions
- Security policy changes
- Incident response actions
- Data classification or handling changes
Effective implementation: Workflow documentation showing where AI recommendations pause for human review, with criteria for automatic execution.
5. Map AI Risks to CSF 2.0 Functions
For each AI system in your inventory, document how it affects:
- Identify: Changes to asset inventory or risk profile
- Protect: Enforcement of access controls or security policies
- Detect: Identification of threats or anomalies
- Respond: Automated response actions
- Recover: Participation in restoration or continuity
Effective implementation: A matrix showing each AI system mapped to CSF functions, with documented controls for each intersection point.
6. Address Supply Chain Integrity for AI Components
For AI systems you didn't build in-house:
- Request AI Bills of Materials (AIBOM) from vendors
- Document training data sources and model provenance
- Verify cryptographic signatures on model files
- Track model versions and updates
Effective implementation: Vendor contracts requiring AIBOM disclosure, with procedures for validating model integrity before deployment and after updates.
7. Control Insider Threats Specific to AI Systems
AI creates new insider threat vectors:
- Prompt injection to extract sensitive data
- Model manipulation through poisoned training data
- Exfiltration through AI-generated summaries or reports
- Privilege escalation via AI-assisted social engineering
Effective implementation: Updated insider threat monitoring that includes AI interaction logs, with alerts for unusual prompts, excessive data queries, or attempts to manipulate model behavior.
8. Establish Transparency Requirements
Document how you'll explain AI decisions to:
- Auditors reviewing security controls
- Incident responders investigating AI-assisted breaches
- Regulators requiring accountability
- Affected users when AI denies access or flags behavior
Effective implementation: Logging that captures not just the AI's decision but the inputs, confidence scores, and reasoning path, stored in a tamper-evident format for audit purposes.
9. Plan for Agentic AI Governance
If you deploy or plan to deploy agentic AI:
- Define boundaries for autonomous action
- Establish monitoring for out-of-scope behavior
- Document rollback procedures
- Set clear limits on data access and system permissions
Effective implementation: A separate risk assessment for agentic systems that treats them as privileged users, with corresponding access controls, monitoring, and time-bound permissions.
10. Keep Taxonomy Consistent Across Teams
Adopt standard terminology for AI risk discussions:
- Use consistent definitions for "model," "training data," "inference"
- Align with NIST AI Risk Management Framework (AI RMF) terminology
- Document your organization's AI risk categories
- Train security, development, and risk teams on shared vocabulary
Effective implementation: A glossary mapping your internal terms to NIST standards, referenced in all AI governance documentation and training materials.
Common Mistakes
Treating AI as just another application. AI systems require different controls because they make probabilistic decisions, can be manipulated through adversarial inputs, and often operate with broad data access.
Waiting for perfect guidance. Technology changes faster than standards. Implement adaptive controls now rather than waiting for prescriptive requirements that will be outdated when published.
Ignoring shadow AI. Your developers are using AI coding assistants. Your analysts are using ChatGPT. Your executives are using AI meeting summarizers. If you don't inventory and govern these tools, you can't manage the risk.
Assuming vendors have solved AI security. Vendor-provided AI tools inherit your organization's risk profile the moment they access your data. Due diligence requirements apply.
Next Steps
- Schedule a workshop with security, risk, and AI stakeholders to review this checklist.
- Identify your three highest-risk AI deployments and audit them against items 1-10.
- Document gaps in a risk register with assigned owners and remediation timelines.
- Join NIST's Cyber AI Profile community of interest to track updates to the guidance.
- Review your findings quarterly as AI capabilities and threats evolve.
Your cybersecurity framework needs to account for AI risk whether or not you've formally adopted AI systems. The AI is already here.
