Name a risk management framework commonly referenced in AI security and its relevance to SecAI+.

• A. NIST risk management framework; relevance includes categorizing assets, implementing controls, continuous monitoring, and authorization.
• B. ISO 27001; relevance includes information security management.
• C. COBIT; relevance includes governance.
• D. CMMI; relevance includes process improvement.

Answer: (A)

The main idea here is applying a structured risk management approach that guides how AI systems are assessed, secured, and monitored throughout their lifecycle. The NIST Risk Management Framework provides that exact path: it starts by understanding what needs protection and how severe the potential impact could be, then selects and implements appropriate security and privacy controls, followed by evaluating their effectiveness, obtaining authorization to operate, and maintaining continuous monitoring. This lifecycle is especially relevant to SecAI+ because AI systems continually evolve—data, models, and deployments change—so risk management must adapt to model risk, data governance, data provenance, supply chain concerns, and privacy considerations. By following RMF, teams establish a repeatable, auditable process that links risk to concrete controls and ongoing oversight, which is why this framework is commonly referenced in AI security contexts. Other frameworks like ISO 27001 focus on broader information security management systems, COBIT emphasizes governance, and CMMI targets process improvement; they’re valuable but don’t provide the same explicit risk-based lifecycle and authorization approach tailored for AI security as RMF.