Compliance · Global, US origin
NIST Frameworks
NIST frameworks are voluntary, but US clients know them well and often ask about them. We map your controls to the NIST Cybersecurity Framework and the NIST AI Risk Management Framework, then help you fix the gaps that matter most.
Who it applies to
Is this law relevant to you?
Organisations that want a recognised structure for security and AI risk, which US enterprise clients often ask for.
Core obligations
What the law asks of you
A plain language summary. Your legal team should confirm how each point applies to your business.
- Govern
- Who owns security and AI risk, the policies, and how it is overseen.
- Identify
- A written record of your assets, data and risks.
- Protect
- Safeguards that make an incident less likely, such as access control, training and encryption.
- Detect
- Monitoring that spots problems early.
- Respond and recover
- Plans to contain an incident and get service back (two separate functions in CSF 2.0).
- AI risk mapping
- Map, measure and manage the risks specific to AI.
How we help
From gap to evidence
- Map your controls to NIST CSF 2.0
- NIST AI RMF profiles for your AI systems
- A plan to close the gaps
- Policies and evidence
- Help answering security questionnaires
Is NIST mandatory?
Not for most private companies. Many US clients use it to assess vendors, though, so aligning with it helps you win and keep their work.
Request a NIST Frameworks assessment
Regulations
Other laws we advise on
Start a conversation
Compliance that holds up in practice.
Start with a short assessment. We tell you which laws apply, what to fix first and what it will take.
A specialist replies within one working day. The first conversation is free.