Skip to content

Commit 530f145

Browse files
eeee2345eeee2345
committed
feat(examples): community AI RMF profile examples in XML (OSCAL 1.2.2)
Four worked-example profiles (baseline, tier 1/2/3) authored as XML in src/examples/profile/xml/, reworked from #333 per the guidance in that thread and the example checklist in #337. JSON/YAML left for the CI/CD pipeline. Each profile imports a placeholder catalog path (../../catalog/xml/ai-rmf_catalog.xml) pending the official NIST AI RMF OSCAL catalog. CC0 1.0; not endorsed by NIST.
1 parent 8646ca9 commit 530f145

4 files changed

Lines changed: 171 additions & 0 deletions

File tree

‎src/examples/profile/xml/ai-rmf-baseline_profile.xml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<profile xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="89e467ba-dc87-5169-a01f-4e4026891f32">
3+
<metadata>
4+
<title>AI RMF Baseline Profile (community example)</title>
5+
<last-modified>2026-05-30T00:00:00.000Z</last-modified>
6+
<version>0.4.0</version>
7+
<oscal-version>1.2.2</oscal-version>
8+
<party uuid="138f77cf-070c-52d6-afcc-4e2f107c1d26" type="organization">
9+
<name>ai-rmf-oscal-catalog community contributors</name>
10+
<remarks>
11+
<p>Community contributors to the ai-rmf-oscal-catalog project. Not produced by, endorsed by, or affiliated with NIST.</p>
12+
</remarks>
13+
</party>
14+
<remarks>
15+
<p>Reference profile that selects all 72 AI RMF subcategory controls (include-all). This profile is the simplest valid pattern, useful when a downstream consumer needs the complete catalog as a single profile and intends to derive a narrower selection by adding exclude-controls entries. It does not impose any tier opinion on the controls. Released under CC0 1.0. Not endorsed by NIST.</p>
16+
</remarks>
17+
</metadata>
18+
<import href="../../catalog/xml/ai-rmf_catalog.xml">
19+
<include-all/>
20+
</import>
21+
<merge>
22+
<as-is>true</as-is>
23+
</merge>
24+
</profile>

‎src/examples/profile/xml/ai-rmf-tier-1-foundational_profile.xml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<profile xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="4e7131ef-207a-5627-b249-65545f110e37">
3+
<metadata>
4+
<title>AI RMF Tier 1 Foundational Profile (community example)</title>
5+
<last-modified>2026-05-30T00:00:00.000Z</last-modified>
6+
<version>0.4.0</version>
7+
<oscal-version>1.2.2</oscal-version>
8+
<party uuid="138f77cf-070c-52d6-afcc-4e2f107c1d26" type="organization">
9+
<name>ai-rmf-oscal-catalog community contributors</name>
10+
<remarks>
11+
<p>Community contributors to the ai-rmf-oscal-catalog project. Not produced by, endorsed by, or affiliated with NIST.</p>
12+
</remarks>
13+
</party>
14+
<remarks>
15+
<p>Tier 1 -- Foundational worked example. Selects 18 controls covering the minimum viable AI risk management surface for low-risk, internal AI use. Includes foundational governance (legal compliance, executive accountability, trustworthy AI integration, AI inventory, role definitions, safety culture, incident sharing); minimum context mapping (intended purposes, task definition, human oversight, impact identification); minimum measurement (metric selection, TEVV documentation, safety and security evaluation); and minimum risk treatment (proceed/no-go determination, risk responses, incident communication). This is a worked example, not a normative baseline. Released under CC0 1.0. Not endorsed by NIST.</p>
16+
</remarks>
17+
</metadata>
18+
<import href="../../catalog/xml/ai-rmf_catalog.xml">
19+
<include-controls>
20+
<with-id>ai-rmf-gv-1.1</with-id>
21+
<with-id>ai-rmf-gv-1.2</with-id>
22+
<with-id>ai-rmf-gv-1.6</with-id>
23+
<with-id>ai-rmf-gv-2.1</with-id>
24+
<with-id>ai-rmf-gv-2.3</with-id>
25+
<with-id>ai-rmf-gv-4.1</with-id>
26+
<with-id>ai-rmf-gv-4.3</with-id>
27+
<with-id>ai-rmf-mp-1.1</with-id>
28+
<with-id>ai-rmf-mp-2.1</with-id>
29+
<with-id>ai-rmf-mp-3.5</with-id>
30+
<with-id>ai-rmf-mp-5.1</with-id>
31+
<with-id>ai-rmf-ms-1.1</with-id>
32+
<with-id>ai-rmf-ms-2.1</with-id>
33+
<with-id>ai-rmf-ms-2.6</with-id>
34+
<with-id>ai-rmf-ms-2.7</with-id>
35+
<with-id>ai-rmf-mg-1.1</with-id>
36+
<with-id>ai-rmf-mg-1.3</with-id>
37+
<with-id>ai-rmf-mg-4.3</with-id>
38+
</include-controls>
39+
</import>
40+
<merge>
41+
<as-is>true</as-is>
42+
</merge>
43+
</profile>

‎src/examples/profile/xml/ai-rmf-tier-2-customer-facing_profile.xml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<profile xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="fbf184b9-7b07-5d86-b6d6-76f51ef53777">
3+
<metadata>
4+
<title>AI RMF Tier 2 Customer-Facing Profile (community example)</title>
5+
<last-modified>2026-05-30T00:00:00.000Z</last-modified>
6+
<version>0.4.0</version>
7+
<oscal-version>1.2.2</oscal-version>
8+
<party uuid="138f77cf-070c-52d6-afcc-4e2f107c1d26" type="organization">
9+
<name>ai-rmf-oscal-catalog community contributors</name>
10+
<remarks>
11+
<p>Community contributors to the ai-rmf-oscal-catalog project. Not produced by, endorsed by, or affiliated with NIST.</p>
12+
</remarks>
13+
</party>
14+
<remarks>
15+
<p>Tier 2 -- Customer-facing worked example. Selects 55 controls (Tier 1 plus 37 additions). Designed for AI systems whose outputs reach external customers or end-users. Adds controls for fairness and bias evaluation, explainability and interpretability, privacy risk, accountability and transparency, post-deployment monitoring, continual improvement, third-party accountability, and external feedback mechanisms. Excludes specialised controls that are contextually specific (e.g., environmental impact MEASURE 2.12, deep third-party contingency GOVERN 6.2, unknown-risk recovery MANAGE 2.3, human-subjects-protection MEASURE 2.2). This is a worked example, not a normative baseline. Released under CC0 1.0. Not endorsed by NIST.</p>
16+
</remarks>
17+
</metadata>
18+
<import href="../../catalog/xml/ai-rmf_catalog.xml">
19+
<include-controls>
20+
<with-id>ai-rmf-gv-1.1</with-id>
21+
<with-id>ai-rmf-gv-1.2</with-id>
22+
<with-id>ai-rmf-gv-1.3</with-id>
23+
<with-id>ai-rmf-gv-1.4</with-id>
24+
<with-id>ai-rmf-gv-1.5</with-id>
25+
<with-id>ai-rmf-gv-1.6</with-id>
26+
<with-id>ai-rmf-gv-1.7</with-id>
27+
<with-id>ai-rmf-gv-2.1</with-id>
28+
<with-id>ai-rmf-gv-2.2</with-id>
29+
<with-id>ai-rmf-gv-2.3</with-id>
30+
<with-id>ai-rmf-gv-3.1</with-id>
31+
<with-id>ai-rmf-gv-3.2</with-id>
32+
<with-id>ai-rmf-gv-4.1</with-id>
33+
<with-id>ai-rmf-gv-4.2</with-id>
34+
<with-id>ai-rmf-gv-4.3</with-id>
35+
<with-id>ai-rmf-gv-5.1</with-id>
36+
<with-id>ai-rmf-gv-5.2</with-id>
37+
<with-id>ai-rmf-gv-6.1</with-id>
38+
<with-id>ai-rmf-mg-1.1</with-id>
39+
<with-id>ai-rmf-mg-1.2</with-id>
40+
<with-id>ai-rmf-mg-1.3</with-id>
41+
<with-id>ai-rmf-mg-1.4</with-id>
42+
<with-id>ai-rmf-mg-2.1</with-id>
43+
<with-id>ai-rmf-mg-2.2</with-id>
44+
<with-id>ai-rmf-mg-2.4</with-id>
45+
<with-id>ai-rmf-mg-3.1</with-id>
46+
<with-id>ai-rmf-mg-4.1</with-id>
47+
<with-id>ai-rmf-mg-4.2</with-id>
48+
<with-id>ai-rmf-mg-4.3</with-id>
49+
<with-id>ai-rmf-mp-1.1</with-id>
50+
<with-id>ai-rmf-mp-1.2</with-id>
51+
<with-id>ai-rmf-mp-1.3</with-id>
52+
<with-id>ai-rmf-mp-1.6</with-id>
53+
<with-id>ai-rmf-mp-2.1</with-id>
54+
<with-id>ai-rmf-mp-2.2</with-id>
55+
<with-id>ai-rmf-mp-2.3</with-id>
56+
<with-id>ai-rmf-mp-3.1</with-id>
57+
<with-id>ai-rmf-mp-3.5</with-id>
58+
<with-id>ai-rmf-mp-4.1</with-id>
59+
<with-id>ai-rmf-mp-4.2</with-id>
60+
<with-id>ai-rmf-mp-5.1</with-id>
61+
<with-id>ai-rmf-mp-5.2</with-id>
62+
<with-id>ai-rmf-ms-1.1</with-id>
63+
<with-id>ai-rmf-ms-2.1</with-id>
64+
<with-id>ai-rmf-ms-2.10</with-id>
65+
<with-id>ai-rmf-ms-2.11</with-id>
66+
<with-id>ai-rmf-ms-2.3</with-id>
67+
<with-id>ai-rmf-ms-2.4</with-id>
68+
<with-id>ai-rmf-ms-2.5</with-id>
69+
<with-id>ai-rmf-ms-2.6</with-id>
70+
<with-id>ai-rmf-ms-2.7</with-id>
71+
<with-id>ai-rmf-ms-2.8</with-id>
72+
<with-id>ai-rmf-ms-2.9</with-id>
73+
<with-id>ai-rmf-ms-3.1</with-id>
74+
<with-id>ai-rmf-ms-3.3</with-id>
75+
</include-controls>
76+
</import>
77+
<merge>
78+
<as-is>true</as-is>
79+
</merge>
80+
</profile>

‎src/examples/profile/xml/ai-rmf-tier-3-high-risk_profile.xml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<profile xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="497b917c-c836-56e6-9b3e-8635c156a6af">
3+
<metadata>
4+
<title>AI RMF Tier 3 High-Risk Profile (community example)</title>
5+
<last-modified>2026-05-30T00:00:00.000Z</last-modified>
6+
<version>0.4.0</version>
7+
<oscal-version>1.2.2</oscal-version>
8+
<party uuid="138f77cf-070c-52d6-afcc-4e2f107c1d26" type="organization">
9+
<name>ai-rmf-oscal-catalog community contributors</name>
10+
<remarks>
11+
<p>Community contributors to the ai-rmf-oscal-catalog project. Not produced by, endorsed by, or affiliated with NIST.</p>
12+
</remarks>
13+
</party>
14+
<remarks>
15+
<p>Tier 3 -- High-risk worked example. Selects all 72 controls (include-all) with the explicit framing that AI in regulated or safety-critical contexts (healthcare, finance, government, infrastructure, autonomous transport) requires the full AI RMF surface area. Differs from the baseline profile only in narrative framing. The same selection (all 72 controls) but with the explicit position that exclusions are not appropriate for high-risk deployment contexts. This is a worked example, not a normative baseline. Released under CC0 1.0. Not endorsed by NIST.</p>
16+
</remarks>
17+
</metadata>
18+
<import href="../../catalog/xml/ai-rmf_catalog.xml">
19+
<include-all/>
20+
</import>
21+
<merge>
22+
<as-is>true</as-is>
23+
</merge>
24+
</profile>

0 commit comments

Comments
 (0)