Method

The NIST AI Risk Management Framework, published as NIST AI 100-1 on January 26, 2023, organizes AI risk management under four functions: govern, map, measure, and manage. Govern is cross-cutting and applies across the whole of an organization's risk management process. Map, measure, and manage apply to particular systems and particular stages of their lifecycle. A readiness score is reported against those four rather than as one figure standing in for everything.

In the platform, the per-function result lives in a JSON column on the secure score record called risk_categories, keyed on exactly those four strings: govern, map, measure, and manage. Each key holds its own score on the same 0 to 100 scale as the overall number, plus a written summary explaining that sub-score. All four are required. A submitted score missing one of them is rejected at validation rather than stored half-formed, which is why a score always decomposes rather than usually decomposing.

Because those keys are fixed rather than free text, an overall number can be taken apart after the fact. A reader can move from the headline figure to four sub-scores and four summaries, and from there into the gap register, where every finding carries the function it belongs to and, where one was supplied, the specific NIST subcategory it maps to, in the form GOVERN 1.1 or MEASURE 2.7. Those identifiers are checked against a stored copy of the AI RMF taxonomy rather than accepted as written. An identifier that does not exist in the taxonomy is discarded, and where a valid subcategory contradicts the function that was assigned alongside it, the function is corrected from the taxonomy. The model does not get to invent a NIST reference.

Assessments themselves run at executive, department, and individual level, so a department carries its own result instead of being averaged into an organizational number it had little part in producing.

The score is computed from what is in the organization's own records at the moment it is taken. The platform assembles the assessments with their completion rates, the questions with an aggregate of the answers given to each, the departments with their membership counts, and the ideas submitted with their vote counts. That context is sent to the model together with a system prompt that specifies the exact output structure and includes the AI RMF taxonomy as a reference for subcategory selection.

What comes back is a JSON object holding an overall score, a confidence figure, written reasoning, the four per-function entries, and a list of gaps. Each gap carries a title, a description written in terms of organizational impact, a severity of critical, high, medium, or low, the function it belongs to, an optional NIST subcategory, recommended safeguards, and candidate tooling. The overall score and the confidence figure are clamped into the 0 to 100 range on the way in. If the response cannot be parsed, or arrives without a score, no number is stored. The record is marked complete with a null score, the raw response is retained for inspection, and a parse warning is attached to the record. Nothing is substituted for the missing number.

A reviewer then enters their own score on the same scale, with optional notes. Where both readings exist, the final score is a fixed weighted blend of the two, the model's score multiplied by 0.6 plus the reviewer's multiplied by 0.4, rounded to an integer. Sixty percent of the result is the model's reading and forty percent is the reviewer's. Those weights are constants in the code rather than a per-organization setting, and they are visible at the point they are applied, since the adjustment screen prints both of them and the multiplication that produces the result, recalculating live as the reviewer moves the slider. Where only one of the two readings exists, that reading becomes the final score directly, rather than being averaged against a placeholder.

Gaps can afterward be marked as addressed, which applies a further adjustment weighted by severity. Each gap carries a weight according to how severe it is, counting 4 for critical, 3 for high, 2 for medium, and 1 for low. The credit is the combined weight of the addressed gaps divided by the combined weight of the whole register, multiplied by a maximum of 15 points and rounded, then added to the blended score, with the total capped at 100. Closing every gap on a register therefore moves a score by at most 15 points, and closing the critical ones moves it further than closing the same number of low ones. That adjustment is stored separately in the record's metadata alongside the number of gaps closed and the total, so movement caused by gap closure can be distinguished from movement caused by a fresh reading. Each gap also records who marked it addressed and when.

The model's part is bounded before it runs. The four functions are fixed, the subcategory vocabulary is validated against a stored copy of the taxonomy, and the context it works from is assembled by the platform rather than retrieved by the model. What it contributes is a reading of the reported data: a number, a confidence figure, four sub-scores with summaries, written reasoning, and a gap register with severities and safeguards.

Review is gated by role. Adjusting a score requires a consultant or a company administrator, and the request is refused outright while a generation is still in flight. The reviewer supplies their own score on the same scale and may attach notes explaining it. Through the fuller edit path they can also rewrite all four sub-scores and their summaries and rebuild the gap register from scratch. A reviewer is working from things the assessment data does not contain: which answers were optimistic, which department was thinly represented in the response set, which control exists in a policy document and is not practiced by anyone.

Both readings occupy their own columns and neither overwrites the other. The model's number, its confidence, and its reasoning sit in ai_score, ai_confidence, and ai_reasoning. The reviewer's sit in consultant_score and consultant_notes. The final score is a third column derived from them. As the record moves from generating to AI complete to final, the model's original figures survive that transition untouched, and both readings render on the same screen rather than one replacing the other in the interface. Every adjustment additionally writes an activity log entry naming the person who made it and the score that resulted.

Collapsing the two into a single number would erase the distance between them, and that distance is itself a finding. A reviewer who marks a score well below the model's is making a specific statement about the gap between what was reported and what is true, and that statement is only legible while both numbers remain visible. Keeping both also keeps provenance answerable long after the fact. A year later the record still shows what the model produced, which model produced it, what the reviewer concluded, who that reviewer was, and when each was recorded. A number that has been reconciled down to one value can answer none of those questions, and a score whose provenance cannot be reconstructed is a number rather than a finding.

Every score is stored with the timestamp of its creation, and the history list, the trend indicator, and the trend chart all read from that timestamp. The trend carries the previous score together with the date that previous score was taken, rather than a bare direction of travel. Alongside each score, a snapshot records the state of the organization at the moment of the reading, including how many assessments and how many departments existed and the exact time the context was assembled. The generation record retains the system prompt that was sent, the input context that went with it, and the identifier of the model that answered.

The subject of the measurement changes underneath it. Tools in use, the vendors behind them, and the organization's own staffing all move between readings. So does the model doing the reading, which is why its identifier is stored on the generation record and not assumed. The framework has moved as well: AI RMF 1.0 was published in January 2023, and NIST released the Generative AI Profile, AI 600-1, in July 2024, mapping the same four functions onto a set of risks the original document did not enumerate. A reading taken before a change of that kind and a reading taken after it are answering slightly different questions, and only the dates make that visible.

Re-measurement is a stage of the working cycle rather than an exception to it, and the dated series is what makes a second reading useful at all. Comparison is the whole return on taking a score twice. An undated number can be reported, but it cannot be compared, and it cannot survive the first person in the room who asks when it was taken.

A score measures what was reported, not what is running. The inputs are assessment answers, completion rates, department membership, and submitted ideas. No system is scanned, no network traffic is observed, no model is tested, and no configuration is read. An organization whose respondents describe controls they do not actually operate will be scored as described. Consultant review is the correction for that, and it is a human correction rather than a second measurement.

Coverage is a property of the number, not a footnote to it. A score computed while most responses are still outstanding will still return a number, which is why the completion rate travels with the record. The confidence figure deserves the same caution: it is the model's own estimate of its confidence, produced in the same pass that produced the score. It is not a measured error rate, and there is no calibration behind it.

A score is not a certification, and it is not an audit opinion. The AI RMF is voluntary guidance, and scoring against it does not establish conformity with any law, standard, or contractual obligation. Neither is a score predictive. A high number describes reported governance practice at one point in time and says nothing about whether an incident will occur, or when.

Scores are not comparable between organizations. There is no normalization, no peer cohort, and no benchmark population behind the figure. Two organizations arriving at the same number have been read against the same framework by the same method, which is a much weaker statement than being in the same condition. The only comparison a score properly supports is against that same organization's earlier scores. One further caution belongs here. A score can climb by as much as 15 points because gaps were marked as addressed rather than because a new reading was taken, and marking a gap addressed is an assertion by the person who marked it, recorded with their name against it for exactly that reason.

What we measure is the set of responses to the assessments, read against the four functions of the AI RMF and expressed as an overall score, four sub-scores with written summaries, and a register of gaps carrying severities, NIST subcategory references, and recommended safeguards. That is the extent of the measurement. Everything else on a score record is provenance rather than measurement.

What we record is deliberately more than the number. Each score keeps the model's reading, its confidence figure, and its written reasoning, along with the reviewer's score and notes, the derived final score, the date, the identifier of the model that answered, the prompt and input context that produced the reading, and a snapshot of what existed at the time. Gap closures record who closed what and when, and every change writes its own activity log entry. We hold to this so that any number on any report can be walked backward to the material that produced it.

What we will not claim is equally definite. We publish no accuracy figure for the model's scoring, because we have not measured one, and we will not estimate one for the sake of having it. We offer no benchmark, no industry average, and no peer ranking. We name no client and describe no engagement, which is a confidentiality commitment rather than a shortage of work to point at. We put no specimen score on a public page. The landing page shows the four function names and a statement of method instead of a sample number, on the reasoning that a figure a visitor cannot verify is worth less than a method they can check. And we do not claim that holding a score prevents an incident.

Where the method fails, we record the failure rather than papering over it. An unparseable model response produces a null score and a retained raw response rather than a substituted guess. A single available reading becomes the final score on its own rather than being blended with a stand-in. Where this site describes something under development rather than in use, we say which one it is.