Measure
NIST AI RMF 1.0 · MEASURE function
Quantitative + qualitative risk assessment: testing, benchmarks, monitoring.
What this function means
MEASURE is the analytic function — quantitative and qualitative evidence that the AI system performs as expected, fails safely, and stays within its intended envelope. Vendor security testing, red-teaming, third-party audits, and incident history are the artefacts buyers evaluate here.
How TrustAtlas dimensions support it
Security captures pen-test cadence, red-teaming, vulnerability disclosure, and third-party audit; data handling covers data-loss-prevention posture and retention controls; transparency covers whether measurement results are published.
See methodology for how each dimension is scored across the catalog.
Example NIST categories under Measure
- MEASURE 1: Appropriate methods and metrics are identified
- MEASURE 2: AI systems are evaluated for trustworthy characteristics
- MEASURE 4: Feedback from human inputs is gathered
Drawn from NIST AI RMF 1.0; the catalog evidence below maps onto these categories at the vendor-evaluation layer.
Questions to ask vendors
Use as part of your procurement diligence or as a structured profile-review aid alongside the vendor's TrustAtlas page.
- Provide your most recent SOC 2 Type II report and external pen-test summary, under NDA if needed.
- Do you publish red-team or safety evaluation results for each new model release, and on what cadence?
- What customer-visible telemetry is available (usage, error rates, safety-classifier hit rates, latency distribution)?
- How do you measure model drift in production, and what triggers a re-evaluation or rollback?
Related
- Back to the full NIST AI RMF cross-walk
- OWASP LLM Top 10 cross-walk — the application-security companion framework
- Vendors that claim NIST AI RMF alignment
- TrustAtlas methodology — how the 8 risk dimensions are scored