Guide

AI Platform Compliance and NIST Cybersecurity Standards Guide

The NIST Cyber AI Profile (NIST IR 8596, preliminary draft published December 2025) is a Community Profile built on Cybersecurity Framework 2.0 that surfaces the highest-priority cybersecurity outcomes for organizations deploying or using AI. It doesn't replace existing guidance; it layers AI-specific priorities onto the six CSF functions. The threat data explains why: 13% of organizations experienced an AI-related security incident, 97% of those breached lacked proper AI access controls (IBM 2025), shadow AI adds an average $670,000 to breach costs, and CrowdStrike reports an 89% year-over-year increase in AI-enabled attacks, driving average eCrime breakout time down to 29 minutes.

Key takeaways

NIST IR 8596 extends CSF 2.0 with three AI focus areas, Secure, Defend, and Thwart, each mapped to the six CSF functions
Traditional security programs miss AI-specific risks: prompt injection, data poisoning, model drift, adversarial inputs
Compliance is voluntary but treated as a de facto benchmark by regulators in healthcare, insurance, and financial services
The biggest gap for most enterprises is runtime enforcement: continuously monitoring, governing, and auditing AI behavior in production

What are the three AI focus areas?

Secure, protecting AI systems themselves: models, training data, pipelines, and the applications around them
Defend, using AI to strengthen cyber defense: detection, triage, and response
Thwart, defending against AI-enabled attacks: adversaries using AI for phishing, malware, and speed

How do the six CSF 2.0 functions apply to AI?

Govern: AI risk ownership, policy, and inventory (the new CSF 2.0 function, and the one AI stresses most). Identify: know every model, agent, and data flow. Protect: access controls, data guardrails, and least privilege for AI. Detect: monitor AI behavior, not just infrastructure. Respond: AI-specific incident containment at the execution layer. Recover: restore governed operation with tightened policy.

Which AI-specific risks does the profile target?

Prompt injection, data poisoning, model drift, adversarial inputs, sensitive data exposure through prompts and outputs, and ungoverned agent actions, risks that exist at inference time and therefore evade configuration-oriented security tooling.

A practical NIST compliance checklist for AI platform teams

Inventory all AI systems, models, and agents; assign AI risk ownership under Govern; enforce access controls and data guardrails in the inference path; monitor model and agent behavior continuously; log every interaction with policy context (evidence for both NIST alignment and the AI RMF's provenance expectations); and rehearse AI incident containment. Trussed AI's control plane implements the runtime half of this list as a drop-in proxy, enforcement, monitoring, and audit evidence with sub-20ms overhead.

How does the profile align with the NIST AI RMF?

CSF 2.0 + Cyber AI Profile covers cybersecurity outcomes; the AI RMF covers trustworthy-AI risk management (validity, bias, transparency). They share the Govern center of gravity and complement each other, most regulated enterprises map both onto one control set.

Frequently Asked Questions

Is the Cyber AI Profile mandatory? No, voluntary, like CSF itself. But regulators and enterprise customers in regulated sectors increasingly treat NIST alignment as the baseline.

We're CSF-aligned already, how much is new? The functions are familiar; the new work is AI-specific controls in the inference path: prompt/output guardrails, agent authorization, behavior monitoring, and per-interaction evidence.

Where should we start? Inventory and runtime visibility, you can't apply the profile to AI systems you can't see or trace.

Related resources