The NIST Cybersecurity Framework is evolving faster than most security programs can absorb. NIST's National Cybersecurity Center of Excellence is running six projects at the intersection of AI and cybersecurity, developing a Cyber AI Profile that will fundamentally change how you document, assess, and govern AI-related security risks. If you're waiting for the final version before you act, you're already behind.
Why This Matters
Your security program documentation likely doesn't account for AI systems. Your risk register might not capture AI-specific threats, and your governance framework may treat AI like any other technology control, missing entire categories of risk.
The Cyber AI Profile isn't just another compliance checkbox. It's NIST's recognition that AI has become, in the words of NCCoE Director Cherilyn Pascoe, "foundational to cybersecurity." AI is embedded in your detection tools, SIEM, vulnerability management, and increasingly, in adversaries' exploit development workflows.
You can't wait for the final publication. The draft framework is available now, public comment periods are open, and the structure is stable enough to start mapping your current state.
Preparing to Implement the Cyber AI Profile
Before you engage with the Cyber AI Profile, gather these assets:
Current CSF Implementation Documentation: If you've mapped controls to CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), you're ahead. The Cyber AI Profile builds on this structure.
Inventory of AI Systems: This includes:
- AI-powered security tools (EDR, SIEM detection rules, UEBA)
- AI systems your organization develops or trains
- Third-party AI services your teams consume (LLMs, code assistants, data analytics)
- AI agents making autonomous decisions
Enterprise Risk Management Framework: The Profile addresses both enterprise-level risk management and implementation-level controls. Know who owns strategic AI risk decisions in your organization.
Access to NIST Cyber AI Profile Draft Materials: Visit the NCCoE website and download the current draft. Bookmark the public comment portal to track changes.
Stakeholder Map: AI governance isn't just a security issue. You'll need input from data science, legal, compliance, product management, and procurement. Identify who owns AI system decisions in each business unit.
Step-by-Step Implementation
Phase 1: Map Your AI Attack Surface
Start with the Identify function. Create a spreadsheet with these columns:
- System name
- AI type (generative, predictive, autonomous agent, detection algorithm)
- Data sources and training data lineage
- Decision authority (does it recommend or execute?)
- Integration points with production systems
- Current security controls
Catalog everything, including AI in EDR, email filters, and identity platforms. Document whether each system falls into the Profile's three focus areas:
- Cybersecurity of AI systems (securing the AI itself)
- AI for cybersecurity (AI tools you use to defend)
- Risks from AI to cybersecurity (threats enabled by AI)
Phase 2: Assess Against Profile Subcategories
The Cyber AI Profile extends existing CSF subcategories with AI-specific outcomes. For each AI system, walk through the relevant subcategories and score your current state.
Example from the Govern function:
- Do you have AI-specific risk criteria documented?
- Have you defined acceptable use policies for generative AI tools?
- Do you have a process to evaluate AI system trustworthiness before deployment?
Example from the Protect function:
- Are your AI training pipelines isolated from production networks?
- Do you validate the integrity of training data?
- Have you implemented access controls on model parameters and weights?
Mark each as: Not Started, Partially Implemented, or Fully Implemented. Aim for an honest baseline.
Phase 3: Document Human-in-the-Loop Requirements
The Profile emphasizes that human-in-the-loop processes remain critical. For every AI system that makes or influences security decisions, document:
- What decisions require human review
- Response time requirements (can you wait for human approval?)
- Escalation paths when the AI's confidence is low
- Override procedures when humans disagree with AI recommendations
This ensures accountability. When an AI-driven decision leads to a security incident, you need to show you had appropriate human oversight.
Phase 4: Build Your AI Governance Structure
Create a lightweight governance framework before you need it. At minimum, establish:
An AI System Approval Process: Who reviews new AI tools before procurement? What security criteria must they meet? This applies to both vendor tools and internal development.
Testing and Evaluation Standards: Define what "tested" means for AI systems in your environment. Consider:
- Adversarial testing (can attackers manipulate inputs to cause misclassification?)
- Performance metrics under attack conditions
- Behavior in edge cases and novel scenarios
Transparency Requirements: For AI systems that make security decisions, document how they reach conclusions. You should be able to describe the decision logic to an auditor or board member.
Phase 5: Update Your Third-Party Risk Management
Your vendors are deploying AI faster than you are. Update your third-party risk management questionnaires to include:
- What AI systems are embedded in the vendor's product?
- How is training data sourced and validated?
- What testing has been performed on AI components?
- How does the vendor handle AI-specific vulnerabilities?
- What transparency can they provide into AI decision-making?
Add these questions to your vendor review process now.
Validation - How to Verify It Works
You can't validate AI security controls the same way you validate a firewall rule. Use these methods:
Tabletop Exercises with AI Scenarios: Run an incident response exercise where an attacker manipulates your AI detection system to ignore malicious activity. Can your team detect and respond?
Review AI System Logs: Verify that you're capturing decision inputs, outputs, and confidence scores. Test whether you can reconstruct why an AI system made a specific decision three months ago.
Audit Human Override Patterns: If humans are constantly overriding AI recommendations, either your model is poorly tuned or your humans don't trust it. Both are problems.
Test Your AI Inventory Completeness: Ask your security tools vendors which of their features use AI or machine learning. Compare their answers to your inventory. You'll find gaps.
Ongoing Maintenance
AI systems drift. Models degrade as attack patterns evolve. Your implementation can't be static.
Monthly: Review AI system performance metrics. Look for degradation in detection accuracy or increases in false positives.
Quarterly: Update your AI inventory as new tools are deployed. Re-assess high-risk systems against Profile subcategories to track improvement.
Every Six Months: Retrain or update AI models used in security tools. Validate that training data still reflects current threat landscape.
Annually: Conduct a full governance review. Are your AI approval processes working? Are humans still engaged in oversight, or have they become rubber stamps?
Continuously: Monitor NIST's updates to the Cyber AI Profile. The NCCoE is explicitly designing this to evolve with the technology. Subscribe to their updates and participate in comment periods when your organization has relevant experience to share.
Organizations that will struggle with AI security are the ones waiting for perfect guidance. The Profile is stable enough to start now, and mapping your AI systems will surface risks you didn't know you had. Start with your inventory. Everything else follows from knowing what you're actually securing.
