# NIST AI RMF and red teaming: what AI 100-1 and AI 600-1 say

Source: https://airedteamingservices.com/guides/nist-ai-rmf-and-red-teaming/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

NIST AI RMF red teaming: what AI RMF 1.0 and the Generative AI Profile (AI 600-1) say, with suggested action IDs mapped to Govern, Map, Measure and Manage.

> **Short answer:** NIST AI RMF 1.0 (AI 100-1) does not use the term red teaming, but its MEASURE 2.7 subcategory asks you to evaluate and document AI security and resilience. The Generative AI Profile (AI 600-1) names red teaming directly, defines it, and lists suggested actions such as MS-2.7-007 for prompt injection and data poisoning. Both documents are voluntary.

NIST has two documents that matter for AI red teaming. AI RMF 1.0 (NIST AI 100-1) sets the risk process. The Generative AI Profile (NIST AI 600-1) adds red-teaming guidance for generative AI. Both are voluntary, and neither is a certification. This page quotes each one, with action IDs you can map your test plan to.

## What does NIST AI RMF 1.0 say about red teaming?

AI RMF 1.0, published 26 January 2023, does not use the term "red team". We searched the PDF text for it and found no match. It covers the same ground through the MEASURE function. Subcategory MEASURE 2.7 reads: "AI system security and resilience ... are evaluated and documented." (The full sentence adds "as identified in the MAP function".)

That sentence is the hook for security testing. It asks you to evaluate security and resilience and to keep the record, but it does not say how. A red team, a penetration test or an automated scan can each produce part of that record.

AI RMF 1.0 has four functions: GOVERN, MAP, MEASURE and MANAGE. MEASURE 2.6 covers regular safety evaluation. MAP 5.1 covers the likelihood and size of each impact. MANAGE 2.3 covers procedures to respond to a risk you did not know about before.

## What does the Generative AI Profile say?

AI 600-1, published 26 July 2024, names red teaming and defines it. The definition reads: "A structured testing exercise used to probe an AI system to find flaws and vulnerabilities such as inaccurate, harmful, or discriminatory outputs, often in a controlled environment and in collaboration with system developers."

The profile says red teaming "can be performed before or after AI models or systems are made available to the broader public; this section focuses on red-teaming in pre-deployment contexts." It lists four types: general public, expert, combined, and GAI-led (generative AI testing generative AI). It adds that red-teaming results "should be given additional analysis before they are incorporated into organizational governance and decision making."

The profile also says the quality of results depends on the red team's expertise and background, and it asks for domain expertise and awareness of the deployment context. That matches how we scope: the tester needs to understand your product as well as the model.

The red-teaming section sits in Appendix A, section A.1.5 (Structured Public Feedback). The profile was written under a 2023 executive order. We did not check what happened to that order. The NIST page for AI 600-1 was last updated 8 April 2026.

## Which suggested actions mention red teaming?

AI 600-1 gives numbered "suggested actions", each tied to an RMF subcategory. These actions name red teaming or adversarial exercises:

| Function | Action ID | What the action says (shortened) | Use in a test plan |
|---|---|---|---|
| GOVERN | GV-3.2-002 | Consider roles for test and evaluation, validation and red-teaming of GAI systems | Name who owns the red team and who receives findings |
| GOVERN | GV-4.1-002 | Set policies for risk measurement with standardized protocols and structured public feedback such as AI red-teaming or independent external evaluations | Write a test policy: when you test and who may test |
| MAP | MP-5.1-005 | Conduct adversarial role-playing exercises, GAI red-teaming, or chaos testing to find anomalous or unforeseen failure modes | Include abuse and misuse scenarios as well as attacks |
| MEASURE | MS-1.1-008 | Define use cases and contexts where structured human feedback such as red-teaming helps most | Pick high-impact use cases first |
| MEASURE | MS-1.3-002 | Use internal and external evaluations, red-teaming and impact assessments with people who know the context of use | Add independent testers |
| MEASURE | MS-2.7-007 | Perform AI red-teaming to assess resilience against abuse to attack other systems, GAI attacks (for example prompt injection), and ML attacks (adversarial examples, data poisoning, membership inference, model extraction, sponge examples) | Core security test list |
| MEASURE | MS-2.10-001 | Conduct AI red-teaming on privacy issues: training data output, model extraction, membership inference, disclosure of personal or confidential information | Data leakage tests |
| MEASURE | MS-2.8-002 | Document the instructions given to data annotators or AI red-teamers | Keep the tester briefing in the record |
| MANAGE | MG-1.3-002 | Monitor whether risk controls work and keep working, for example via red-teaming and field testing | Retest after fixes |

> **Note:** We shortened the action text. Read the full wording in the [AI 600-1 PDF](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) before you quote an action in a customer response.
## How do the four functions map to an AI red team engagement?

Each function maps to a stage of the work. The mapping is our reading, not NIST text.

1. GOVERN: before testing. Write who may authorize a test, who owns findings, and what the stop conditions are. See the [scoping guide](/guides/how-to-scope-an-ai-red-team/).
2. MAP: scope and threat model. List the use cases, users, data sources and tools, and what can go wrong in each. This becomes the test scope.
3. MEASURE: the test itself. Run the tests for MS-2.7-007 and MS-2.10-001. Record test conditions, attempts and observed behavior.
4. MANAGE: fix and retest. Rank findings by impact, assign fixes, retest, and monitor. MANAGE 2.3 also asks for a response procedure when a new risk appears.

## Which NIST document names the attacks?

NIST AI 100-2 E2025 (March 2025) is the adversarial machine learning taxonomy. It gives each attack an ID. NISTAML.018 is prompt injection and NISTAML.015 is indirect prompt injection. NISTAML.035 is prompt extraction and NISTAML.039 is compromising connected resources.

Section 3.4.4 of that document says: "Because current mitigations do not offer full protection against all attacker techniques, application designers may design systems with the assumption that prompt injection attacks are possible if a model is exposed to untrusted input sources." We take the same position: we test where an injection would cause harm, and we do not promise to prevent it. [MITRE ATLAS](/guides/mitre-atlas/) catalogs the attack techniques.

## What should you tell a customer who asks for NIST AI RMF alignment?

Say what you did, and link each claim to evidence. A short, honest answer might read: "We map our AI risk process to the four AI RMF functions. We ran a scoped red team in [month], covering prompt injection, data leakage and tool misuse. The report lists test conditions, findings and retest results."

NIST runs no certification, so do not say "NIST certified" or "NIST compliant". The [frameworks page](/frameworks/) shows how we map findings to OWASP, ATLAS and NIST. [EU AI Act red teaming](/guides/eu-ai-act-red-teaming/) covers the EU view. To start a scoped test, use the [scoping form](/scoping/).

## Questions

### Is the NIST AI RMF mandatory?

No. NIST describes AI RMF 1.0 as voluntary, rights-preserving, non-sector specific and use-case agnostic. A customer, regulator or contract may still ask you to follow it. Check the exact wording of that request, not the general reputation of the framework.

### Can you be certified against the NIST AI RMF?

No. NIST publishes the framework and profiles but no certification scheme. Be careful with any vendor that sells an "AI RMF certificate". You can map your controls and test evidence to the framework and say so in your own documents.

### Is the AI RMF being updated?

NIST's AI RMF page says AI RMF 1.0 is being revised as part of the White House AI Action Plan. As of November 2026 we found no final revision. NIST also published a concept note on 7 April 2026 for a profile on critical infrastructure. Check the NIST page before you cite a version.

### Where do the attack names such as prompt injection come from in NIST documents?

NIST AI 100-2 E2025 is a separate publication, the adversarial machine learning taxonomy. It gives each attack an ID, for example NISTAML.018 for prompt injection and NISTAML.015 for indirect prompt injection. AI 600-1 and AI 100-1 use plainer language.

## Sources

- [NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0), publication page](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10)
- [NIST AI 100-1 (PDF)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf)
- [NIST AI 600-1: Generative AI Profile, publication page](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence)
- [NIST AI 600-1 (PDF)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)
- [NIST AI Risk Management Framework page (revision notice)](https://www.nist.gov/itl/ai-risk-management-framework)
- [NIST AI 100-2 E2025: Adversarial Machine Learning taxonomy](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf)