NIST releases a draft Cybersecurity Framework Profile for AI

The source was preliminary guidance

NIST announced a preliminary draft of NISTIR 8596 on December 16, 2025: a Cybersecurity Framework Profile for Artificial Intelligence. The draft adapts CSF 2.0 around securing AI systems, using AI for cyber defense, and thwarting AI-enabled attacks, with a 45-day public comment period. It is a draft, not a final standard. Teams can use it to organize thinking while tracking revisions and avoiding statements that it creates final obligations or proves a completed compliance assessment. The date and draft status should remain attached to any implementation discussion.

Mappings need version and decision context

A draft-profile assessment should retain the document version, comments considered, organization-specific scope, existing control mapping, gap hypothesis, owner, and decision status. AI-specific controls must attach to components that actually exist: training and retrieval data, model artifacts, inference endpoints, agent tools, identities, observability stores, and approval interfaces. Preserve the publication status and internal review date because a later draft may reorganize categories or recommendations. Distinguish work motivated by the draft from work already required by existing commitments. That allows useful learning without confusing an internal choice with an official endorsement.

The two security problems should remain distinct

Protecting AI systems concerns model artifacts, source pipelines, credentials, and serving interfaces. Using AI for cyber defense concerns whether a generated alert or analysis is reliable enough for a particular response. A security assistant may retrieve incident context without authority to block a user or alter network policy. Keep those permissions explicit and review the evidence shown to an analyst. A generic cyber checklist can miss model supply chain, evaluation corpus, prompt injection, and tool execution risks; focusing only on the model endpoint can miss the identities and external systems an agent can reach.

A prototype mapping can remain preliminary

Imagine a hypothetical team mapping a prototype assistant to the draft. It identifies signed model images, tenant-scoped retrieval, tool allowlists, audit retention, and incident response as candidate controls. The mapping is marked preliminary, reviewed during the comment window, and neither claims NIST conformance nor changes production systems. This is a good use of a draft: it makes assumptions visible and produces hypotheses for tests. It is not a reason to publish a static security claim before the team has verified the actual behavior of the software and its dependencies.

Incident evidence should preserve observation and interpretation

A model explanation is a hypothesis an analyst can compare with logs, artifact revisions, and system state. Do not overwrite the original observation when the interpretation is corrected. Feedback requires an owner as well; an attacker or ordinary user should not be able to alter evaluation labels merely by contesting a result. Preserve analyst decisions and reasons for changed classifications. A tabletop can trace a compromised source connector through ingestion, model use, and proposed response, identifying who detects it, who can pause work, and how affected outputs are reviewed. Use synthetic records instead of widening production access.

Versioned evidence makes evolving guidance practical

Track profile revisions, verify each mapped control against a runnable test or operating record, and exercise expired credentials, compromised dependencies, malicious context, and unavailable logging. Run a tabletop from detection through containment and recovery. Independent review should separate implemented controls, proposals, and unknowns. Retain gaps as work items with owners and verification steps. Hypler's SI direction favors inspectable systems that can change responsibly as standards evolve: versioned mappings and evidence, no static compliance claims, and no assertion that a draft alone validates a security posture. The resulting security work remains reviewable as guidance changes.

Hypler analysis

Hypler’s view

Draft guidance is most useful as versioned security work, not as a compliance label. Teams should preserve the exact draft and map its ideas to tested components while leaving legal obligations and current posture claims to the appropriate owners.

Hypler technical analysis

Engineering notes

A Cybersecurity Framework profile for AI can organize security work across systems that use AI, defend with AI, or face AI-enabled attacks. The useful engineering output is a local mapping from AI assets and lifecycle stages to controls, evidence, owners, and open risk, while keeping draft guidance distinct from final requirements.

What to inspect

Asset inventory

Inspect models, datasets, prompts, retrieval stores, tools, identities, endpoints, and monitoring systems with their owners and trust boundaries.

Control mapping

Map each scoped AI risk to an existing or planned cybersecurity control, implementation evidence, validation date, and residual-risk decision.

Revision watch

Record the draft version, public-comment status, assumptions drawn from it, and an owner to reassess mappings when NIST publishes revisions.

Scope and limits. NISTIR 8596 was released as preliminary draft guidance. It is not a final standard, a completed compliance assessment, or a substitute for local threat modeling.

Terms and definitions

Prompt Injection

An attack where untrusted content tries to alter an AI system’s instructions or cause unsafe tool use.

Inference

Using a trained model to produce an output from new input.

Evaluation

A repeatable method for measuring a system against defined quality, safety, or task criteria.

AI Governance

Policies, roles, controls, and review processes that guide how AI systems are selected, used, monitored, and retired.

More on this subject

• NIST updates its adversarial machine learning taxonomy

  NIST published NIST AI 100-2e2025, an update to its voluntary taxonomy and terminology for adversarial machine-learning attacks and mitigations.

• NIST releases AI Risk Management Framework 1.0

  NIST released AI RMF 1.0 as a voluntary framework for managing risks in the design, development, deployment, and use of AI systems.

• NIST publishes the AI RMF Generative AI Profile

  NIST AI 600-1 is voluntary guidance for applying the AI Risk Management Framework to generative AI through Govern, Map, Measure, and Manage.

Related reading

• Platform engineering
• SI agent governance
• Testing and observability