NIST Security Frameworks (800-53, CSF, AI RMF)
Definition
NIST (the US National Institute of Standards and Technology) publishes the security frameworks that underpin most US compliance regimes. The three an engineer is most likely to meet are: SP 800-53, a catalog of security and privacy controls used by FedRAMP; the Cybersecurity Framework (CSF), a high-level Identify–Protect–Detect–Respond–Recover model; and the AI Risk Management Framework (AI RMF), guidance for trustworthy AI systems (govern, map, measure, manage).
Why it matters for AI jobs
When AI companies sell to enterprises and government, contracts reference NIST frameworks. Engineers who can read a control ("AU-2 Event Logging") and translate it into a concrete implementation (structured audit events shipped to an immutable store) are rare and valuable. The AI RMF is increasingly cited in AI-governance roles and in customer security questionnaires about model risk.
Key concepts
- Control families — 800-53 groups: AC (access control), AU (audit), IA (identification), SC (system protection), etc.
- Baselines & tailoring — selecting control sets by impact level and adjusting to the system.
- CSF functions — Identify, Protect, Detect, Respond, Recover (+ Govern in CSF 2.0).
- AI RMF core — Govern / Map / Measure / Manage applied to AI-specific risks (bias, misuse, drift).
- Control ↔ engineering mapping — the practical skill: turning control language into systems design.
- Evidence — logs, configs, and screenshots that prove a control is operating.
Learning path
- Read the NIST CSF 2.0 overview first — it is short and gives the mental model.
- Pick 10 800-53 controls across AC/AU/IA/SC families and write one paragraph each on how you would implement them.
- Skim the AI RMF and map its "measure" function to the LLM evaluation practices in this wiki.
- Do a mock exercise: fill out a vendor security questionnaire for an app you built.
- Keep a personal controls-to-mechanisms cheat sheet — it doubles as interview prep for public-sector roles.