Module 6: Industry Standards and Frameworks

Project: Standards Mapping

Next →

Description

We close M6 by producing a Standards Mapping document that connects your system to the controls of the NIST AI RMF (mainly), ISO 42001 (a conceptual mapping), and IEEE 7000 (referenced). This document becomes part of the Responsible AI Framework (M7) and the Ethics Audit (M8).

By the end of this project you'll have:

  • A complete Standards Mapping with NIST AI RMF + ISO 42001 references
  • A gap analysis of which controls you meet vs. which are missing
  • A prioritized action plan to close the gaps
  • A reusable template for future systems

The document template

# Standards Mapping — [System Name]
**Version**: 1.0 | **Date**: 2026-MM-DD | **Reviewer**: [Name]

## Executive Summary
[2-3 sentences on the current coverage]

## Section 1: NIST AI RMF Mapping

### Govern function

| Sub-category | Status | Evidence | Owner | Notes |
|--------------|--------|----------|-------|-------|
| Govern 1.1: AI risk management plan | ✅ | Link to AI Use Policy | Tech Lead | Updated quarterly |
| Govern 1.2: Roles and accountability | ✅ | Accountability matrix | Tech Lead | |
| Govern 1.3: Diverse perspectives | ⚠️ | DEI hiring guidelines | HR | Small team, ongoing |
| Govern 1.4: Stakeholder engagement | ✅ | Feedback collection process | Product Lead | |
| Govern 1.5: Continual improvement | ✅ | Quarterly retros | Tech Lead | |
| Govern 1.6: Sustainability | ⚠️ | Implicit, not documented | Tech Lead | Action item |
| Govern 2.1: External engagement | ❌ | Not formalized | TBD | Plan for Q3 |

### Map function

| Sub-category | Status | Evidence | Owner |
|--------------|--------|----------|-------|
| Map 1.1: Context documented | ✅ | M8-02 system overview | Tech Lead |
| Map 1.2: AI lifecycle phase | ✅ | Production | Tech Lead |
| Map 1.3: Categorization | ✅ | M8 documentation | Tech Lead |
| Map 2.1: Capabilities documented | ✅ | M8-03 RAG design | ML Engineer |
| Map 2.2: Limitations documented | ✅ | M8-03 known limitations | ML Engineer |
| Map 3.1: Impact assessment | ✅ | DPIA document | Tech Lead |
| Map 4.1: Risks identified | ✅ | M6-03 Risk Register | Tech Lead |
| Map 5.1: Continuous identification | ⚠️ | Ad-hoc updates | Tech Lead | Schedule monthly |

### Measure function

| Sub-category | Status | Evidence | Owner |
|--------------|--------|----------|-------|
| Measure 1.1: Risks measured | ✅ | M6-04 metrics pipeline | ML Engineer |
| Measure 2.1: Mitigation effectiveness | ⚠️ | Some baselines | ML Engineer | Need pre/post |
| Measure 3.1: Tracking | ✅ | Datadog dashboard | DevOps |
| Measure 4.1: Trustworthy characteristics | ✅ | M6-04 metrics | ML Engineer |

### Manage function

| Sub-category | Status | Evidence | Owner |
|--------------|--------|----------|-------|
| Manage 1.1: Risks prioritized | ✅ | Risk Register | Tech Lead |
| Manage 2.1: Risk response strategies | ✅ | Per-risk strategy documented | Tech Lead |
| Manage 3.1: Continuous monitoring | ✅ | Monitoring dashboards | DevOps |
| Manage 4.1: Communication | ⚠️ | Internal good, external needs work | Tech Lead | Quarterly reports |

## Section 2: ISO 42001 Mapping (Selected Clauses + Annex A)

### Management System Clauses

| Clause | Description | Status | Evidence |
|--------|-------------|--------|----------|
| 4.1 | Organization context | ✅ | M8-02 |
| 4.2 | Stakeholders | ✅ | M6-03 stakeholder analysis |
| 5.1 | Leadership commitment | ⚠️ | Verbal, not formalized |
| 5.2 | AI policy | ✅ | AI Use Policy v1.0 |
| 5.3 | Roles | ✅ | Accountability matrix |
| 6.1 | Risk planning | ✅ | M6-05 Risk Register |
| 6.2 | AI objectives | ✅ | Defined with metrics |
| 7.5 | Documented information | ✅ | This document + others |
| 8.1 | Operational planning | ✅ | Sprint planning |
| 8.2 | Risk assessment | ✅ | NIST Map |
| 8.3 | Risk treatment | ✅ | NIST Manage |
| 9.1 | Monitoring | ✅ | NIST Measure |
| 9.2 | Internal audit | ❌ | Not formalized; ad-hoc |
| 9.3 | Management review | ⚠️ | Quarterly, informal |
| 10.1 | Continual improvement | ✅ | Retros + lessons learned |
| 10.2 | Corrective action | ⚠️ | Post-mortems but no formal CAPA |

### Annex A Controls (sample)

| Control | Status | Notes |
|---------|--------|-------|
| AI policy | ✅ | |
| AI risk assessment | ✅ | NIST Map function |
| Bias and fairness controls | ✅ | M2 bias audit toolkit |
| Privacy and data protection | ✅ | M3 + M5 GDPR checklist |
| Transparency and explainability | ✅ | Citations + decision explanations |
| Human oversight | ✅ | Human-in-the-loop for high-impact decisions |
| AI lifecycle management | ⚠️ | Could be more formalized |
| Information security | ✅ | M20 of the original path |
| Reliability and resilience | ✅ | M21 system design + M5 reliability |

## Section 3: IEEE Standards Referenced

| Standard | Applicable | Status |
|----------|------------|--------|
| IEEE 7000 (Ethical design) | Yes | ✅ Process followed |
| IEEE 7001 (Transparency) | Yes | ✅ Level 3 |
| IEEE 7002 (Privacy) | Yes | ✅ Aligned via the GDPR work |
| IEEE 7003 (Bias) | Yes | ✅ M2 deliverable |
| IEEE 7010 (Well-being) | Marginal | ⚠️ Implicit |

## Section 4: Gap Analysis

### Critical Gaps (Address before next quarter)
1. **9.2 Internal audit (ISO)**: No formal audit cycle. Plan to implement in Q3.
2. **Govern 2.1 NIST (External engagement)**: Not formalized.

### High Priority Gaps (Address within 2 quarters)
1. **Measure 2.1 (Effectiveness)**: Need pre/post measurements for the mitigations
2. **Manage 4.1 (External communication)**: Quarterly reports to clients
3. **5.1 ISO (Leadership commitment)**: Formalize with a CEO signature

### Medium Priority Gaps
1. Map 5.1: schedule monthly risk identification
2. 10.2 ISO: a formal CAPA process

### Low Priority / Accept
1. Govern 1.6 sustainability: implicit, document if requested
2. IEEE 7010 well-being: marginal applicability

## Section 5: Action Plan

| Action | Priority | Owner | Target | Status |
|--------|----------|-------|--------|--------|
| Implement a formal internal audit (annual) | Critical | Tech Lead + DPO | 2026-Q3 | Planning |
| External engagement process (industry, regulators) | Critical | Tech Lead | 2026-Q3 | Started |
| Pre/post measurement of mitigations | High | ML Engineer | 2026-Q3 | Active |
| Quarterly external reports | High | Tech Lead | 2026-Q2 | Active |
| CEO formal commitment letter | High | CEO | 2026-Q2 | Pending |
| Monthly risk identification review | Medium | Tech Lead | Ongoing | Active |
| CAPA process formalization | Medium | Tech Lead | 2026-Q4 | Planning |

## Section 6: Review Schedule

- **Monthly**: review risk identification, update the register
- **Quarterly**: review the NIST mappings, update the controls
- **Semi-annually**: review the ISO mapping, update the controls
- **Annually**: full re-mapping document, external audit

---

How to work through the project

I suggest (~3 hours):

  1. Set up the template (15 min)
  2. NIST Govern mapping (30 min)
  3. NIST Map mapping (20 min)
  4. NIST Measure mapping (20 min)
  5. NIST Manage mapping (20 min)
  6. ISO 42001 mapping (30 min)
  7. IEEE references (10 min)
  8. Gap analysis + Action plan (30 min)

Evaluation criteria

Your mapping is production-ready if:

  • Every NIST AI RMF sub-category has a status (✅/⚠️/❌) and evidence
  • The ISO 42001 mapping covers Clauses 4-10 at minimum
  • The relevant IEEE standards are referenced
  • The gap analysis distinguishes critical/high/medium/low
  • The action plan has owners and target dates
  • A review schedule is defined

Connection with the following modules

This mapping is a direct input for:

  • M7 (Responsible AI Framework): the ethics checklist is built on these controls
  • M8 (Ethics Audit): the audit applies this mapping to verify ongoing compliance

Work you do here saves work in M7-M8.

Evidence of success when you finish M6

You'll know you finished well if:

  • ✅ The mapping is complete for the NIST AI RMF (4 functions)
  • ✅ The ISO 42001 mapping covers the clauses + a sample of Annex A
  • ✅ The gap analysis has priorities
  • ✅ The action plan has owners
  • ✅ You realize you already meet many controls via the path

Module 6 complete

You learned:

  • ✅ The NIST AI RMF — the most practical framework
  • ✅ The 4 functions (Govern, Map, Measure, Manage) in detail
  • ✅ The IEEE 7000 series as a conceptual complement
  • ✅ ISO 42001 as a certifiable management system
  • ✅ Practically mapping your system to these standards

Standards aren't bureaucracy — they're frameworks that organize your work and make your governance credible.

Next module

Module 7 — Building a Responsible AI Framework. The Phase 3 final stretch: you consolidate EVERYTHING into a reusable Responsible AI Framework you apply to every future project.

Resources

  1. NIST AI RMF Crosswalks — mappings to other standards.
  2. ISO 42001 Annex A controls.
  3. AI Verify Project — a testing toolkit.
  4. NIST AI RMF Playbook — detailed implementation guidance.
← PreviousISO 42001: AI Management SystemNext →Introduction to the Responsible AI Framework