Crosswalk your lab's controls to NIST AI RMF, ISO/IEC 42001 and OECD

short · 45 min · Objective 4.3

Task

Map the controls that actually exist in your lab to the four NIST AI RMF functions, to the ISO/IEC 42001 management-system clauses and to the OECD values, with evidence for each that a check can find on disk. Then write a short applicability note for the lab system, including the lesson's key variant: the same app repurposed to rank job applicants.

Steps

  1. Create lab/crosswalk.csv with header control_id,control,evidence,nist_function,iso42001_clause,oecd_value. evidence is a path relative to ~/secai-lab that exists, such as lab/raci.csv, logs/gateway.jsonl or gateway/gateway.py.
  2. List at least twelve controls your lab really has: the loopback binding, the isolation proof, the gateway log, the canary, snapshots, the regression set, the policy, the RACI, the use register, the risk register, the model card, the intake questions.
  3. Set nist_function to GOVERN, MAP, MEASURE or MANAGE using the lesson's test: owners and policy are Govern, intended use and context are Map, evaluation and testing are Measure, acting on a risk is Manage. Cover all four, with at least two controls each.
  4. Set iso42001_clause to one of context, leadership, planning, support, operation, performance_evaluation or improvement, and oecd_value to one of inclusive_growth, human_rights, transparency, robustness or accountability.
  5. Write lab/applicability.md with seven level-two headings: ## Role, ## Use, ## EU AI Act tier, ## Where outputs reach, ## What must be proved, ## Variant: the same app ranks job applicants, ## Not legal advice. In the variant, say which tier the repurposed use would fall in and whether repurposing moves provider obligations onto the organisation doing it.
  6. Under ## What must be proved, separate what the lab system must do (nothing, as a private study system) from what it has chosen to adopt, and say which instrument would answer each of three requests: a customer wanting independent assurance, a partner asking for NIST AI RMF alignment, and a board asking what values the programme upholds.

Verify

cd ~/secai-lab
python - <<'EOF'
import csv, os
rows = list(csv.DictReader(open("lab/crosswalk.csv", encoding="utf-8")))
F = ["GOVERN", "MAP", "MEASURE", "MANAGE"]
ISO = {"context", "leadership", "planning", "support", "operation",
       "performance_evaluation", "improvement"}
OECD = {"inclusive_growth", "human_rights", "transparency", "robustness", "accountability"}
print(len(rows), "controls;", {f: sum(r["nist_function"] == f for r in rows) for f in F})
print("bad NIST function:", [r["control_id"] for r in rows if r["nist_function"] not in F])
print("bad ISO clause:", [r["control_id"] for r in rows if r["iso42001_clause"] not in ISO])
print("bad OECD value:", [r["control_id"] for r in rows if r["oecd_value"] not in OECD])
print("evidence that does not exist:", [r["control_id"] for r in rows if not os.path.exists(r["evidence"])])
secs, cur = {}, None
for line in open("lab/applicability.md", encoding="utf-8"):
    if line.startswith("## "):
        cur = line[3:].strip()
        secs[cur] = ""
    elif cur:
        secs[cur] += line.lower()
print(len(secs), "applicability sections")
v = secs.get("Variant: the same app ranks job applicants", "")
print("variant names high risk and provider:", "high" in v and "provider" in v)
p = secs.get("What must be proved", "")
print("names 42001, NIST and OECD:", all(k in p for k in ("42001", "nist", "oecd")))
print("disclaimer section present:", "Not legal advice" in secs)
EOF

Twelve or more controls with every function at two or more; empty function, clause, value and evidence lists; seven sections; and three True lines. An evidence path that does not exist is a control you have described rather than built.

Notes

The crosswalk is the lesson's combination pattern in miniature: NIST as the working method, the ISO/IEC 42001 clauses as the management-system container, the OECD values as shared vocabulary. Notice what none of it does. Mapping a control to a voluntary framework creates no legal compliance, and the applicability note is where you practise saying so plainly.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.