Step 1 of 5 β’ NIST MAP Function
β
4 Components Identified
1. Understand & Catalog Your AI Architecture
The Plain-English Concept: You cannot govern what you cannot see. Our automated scanner analyzes the target code repository, container dependencies, and runtime environment to produce an exact software & model inventory.
π€
Backbone AI Model
Google Gemini 1.5 Flash
Cloud LLM endpoint accessed via Google Vertex AI API.
β‘
Orchestration Framework
FastAPI + LangChain Core
Retrieval-Augmented Generation (RAG) assistant pipeline.
ποΈ
Knowledge Base Store
FAISS Vector Index
Embeddings database storing enterprise product manuals & FAQs.
π‘οΈ
Regulatory Profile
Moderate Impact Tier
Customer-facing service with access to order history and PII.
π Mapped to:
NIST MAP 1.1
NIST MAP 1.5
EU AI Act Art. 11
ISO 42001 A.6
Step 2 of 5 β’ NIST MEASURE Function
β οΈ 2 Critical Safety Gaps Detected
2. Automated Code & Vulnerability Audit
The Plain-English Concept: Traditional web firewalls cannot stop AI attacks. Our automated auditor performs static code scanning, architecture analysis, and simulated stress tests across all 72 NIST subcategories to uncover vulnerabilities.
CRITICAL GAP
Prompt Injection Vulnerability
(NIST MEASURE 2.6 / MANAGE 2.4)
User input flows directly into model prompts without validation. Attackers can override instructions to extract sensitive database credentials.
CRITICAL GAP
Context PII & Data Leakage Risk
(NIST MANAGE 2.4 / MEASURE 2.5)
Chat memory passes raw customer contact info and credit numbers to external cloud LLM APIs without regex redaction.
MODERATE GAP
Missing Machine-Readable ML-BOM
(NIST MAP 1.5 / EU AI Act Art. 11)
Model weights and supply-chain packages lack a cryptographically signed CycloneDX 1.6 Bill of Materials.
PASSING
Transport Encryption & TLS
(NIST MANAGE 4.1)
All incoming and outgoing traffic uses TLS 1.3 encryption.
Step 3 of 5 β’ NIST MANAGE Function
β οΈ System Unprotected
3. Test Adversarial Attacks & Deploy 1-Click Guardrails
The Plain-English Concept: Test how an attacker tricks the AI assistant. Click one of the sample prompt attacks below, test it against the application, and then click Deploy Drop-In Safety Guardrails to watch our safety bouncer intercept malicious prompts in real time.
π― Adversarial Prompt Sandbox
(Choose a pre-filled query or write your own)
Simulates live execution against FastAPI endpoint with Gemini 1.5
π οΈ Fix the Vulnerability: 1-Click Guardrail Injection
In traditional security audits, engineering teams spend weeks configuring custom interceptors. Our engine automatically injects drop-in NeMo input validation guardrails and PII tokenizers directly into the application pipeline.
Step 4 of 5 β’ NIST GOVERN Function
β³ Pending Executive Sign-Off
4. Executive Governance Sign-Off & Attestation
The Plain-English Concept: AI cannot be legally accountableβhumans must be. Regulators (and the EU AI Act) mandate that designated leadership officially attest to the risk posture and safety controls. Our engine anchors every signature into an immutable SHA-256 ledger.
Anchored to tamper-proof SHA-256 evidence chain
Step 5 of 5 β’ Regulatory Proof
β¨ 5 Standard Deliverables Ready
5. Export Audit Deliverables for Regulators & Board
The Plain-English Concept: Compliance is only as good as the proof you provide to external auditors, regulatory agencies (FTC, EU AI Office), and enterprise customers. The engine instantly packages all findings into industry-standard deliverables.
C-Suite & Board
Executive Summary
ποΈ Preview HTML
Visual briefing with maturity charts, residual risk analysis, and signed executive attestation seal.
Public Disclosure
AI Nutrition Label
ποΈ Preview HTML
Consumer-facing transparency card detailing data sources, safety guardrails, and known limitations.
Supply Chain
CycloneDX ML-BOM
π View JSON
Machine-readable Software & Model Bill of Materials cataloging packages, model weights, and licenses.
Federal / FedRAMP
NIST OSCAL Assessment
π View JSON
Automated security assessment results adhering to the official NIST Open Security Controls format.
Cryptographic Proof
Evidence Bundle ZIP
π₯ Download ZIP
Complete verifiable zip archive containing the immutable ledger, audit traces, and signed policies.
Ready to Inspect the Full 72-Control Auditor Console?
You have experienced the 5-step executive workflow. Now switch to the deep technical view to inspect individual NIST AI RMF subcategories, edit policy documents, or run custom archetype evaluations.
Recommended Demo Journey: 4 Quick Steps
Experience how developers, compliance officers, and auditors collaborate on AI governance
Step 1 β’ Technical Scans
π§ Inspect 72 Controls
Filter across GOVERN, MAP, MEASURE, and MANAGE. View automated technical scans like
MAP 4.1 with pip-audit SHA-256 evidence.
Step 2 β’ Governance Docs
π Review AI Policies
Read the 9 auto-generated governance policies tailored to this RAG system: System Card, AI Use Policy, and Incident Response Playbook.
Step 3 β’ Live Simulation
βοΈ Sign GOVERN 1.1
Simulate human compliance sign-off. Enter your name, commit with SHA-256, and watch the readiness dials increment live!
Step 4 β’ Compliance Exports
π¦ Audit Deliverables
Preview the standalone Executive HTML brief, FDA-style AI Nutrition Label, CycloneDX 1.6 ML-BOM, and NIST OSCAL 1.1 JSON.
0%
Overall
0 / 72 Met
0%
Govern
0 / 19 Met
0%
Map
0 / 18 Met
0%
Measure
0 / 22 Met
0%
Manage
0 / 13 Met
Subcategories Breakdown
--
MET / PARTIAL / GAP
Evidence Records
--
Cryptographically Hashed (SHA-256)
Target Architecture
--
Provider / Model Profile
Ledger Integrity
VALIDATED
Last Snapshot: Now
ποΈ Auditor Deliverables & Compliance Hub
5 Regulatory Standards
Instant 1-click preview and download of regulatory audit deliverables generated from this snapshot
Executive HTML
Executive Summary
ποΈ Preview HTML
Self-contained styled report with maturity charts and executive attestation sign-offs.
Transparency
AI Nutrition Label
ποΈ Preview Label
FDA-style consumer transparency card detailing datasets, bias audits, and guardrails.
CycloneDX 1.6
ML-BOM (JSON)
π₯ Download JSON
Machine-readable ML Bill of Materials: model components, FAISS vector index, SHA-256 hashes.
NIST OSCAL 1.1
OSCAL Profiles
π₯ Assessment Results
Open Security Controls Assessment Language Assessment Results & Component Definitions.
Ed25519 Signed
Evidence Bundle
π¦ Download ZIP
Complete cryptographic .ZIP archive with digital signature manifest and all audit logs.
Priority Next Compliance Actions
Ranked by risk tier weight, category impact, and missing evidence
| Subcategory | Function | Statement & Priority Rationale | Est. Effort | Action |
|---|---|---|---|---|
| Loading next actions... | ||||
Compliance Readiness History
Historical trajectory from workspace/ledger_history.jsonl
| Timestamp (UTC) | Action | Actor | Readiness | Subcategory Counts (Met / Partial / Gap) |
|---|---|---|---|---|
| Loading progression history... | ||||
Project Setup & Archetype Interview
Configure system scope, risk tiers, and tailor canonical AI RMF subcategories
Loading NIST AI RMF subcategories...
Workspace Docs
Loading documents...
Select a document
Document Review Attestation:
Sign compliance attestation citing this document as formal evidence.
Comprehensive Compliance Artifacts & Export Engine
Generate machine-readable standards (OSCAL, CycloneDX) and executive audit deliverables
Executive Deliverable
Executive Compliance Summary
Stand-alone styled HTML report with functional maturity breakdowns, leadership attestation sign-offs, and risk matrices.
NIST OSCAL 1.1
Machine-Readable Profiles
Complete NIST Open Security Controls Assessment Language exports: Component Definitions, Assessment Results, and POA&M.
CycloneDX 1.6
Machine Learning BOM
Standardized Software/ML Bill of Materials containing model architecture, datasets, dependencies, and SHA-256 hashes.
Consumer Transparency
AI Nutrition Label
FDA-style model facts card disclosing training datasets, bias audits, autonomy boundaries, and safety guardrails.
Cryptographic Bundle
Signed Evidence Bundle
Complete cryptographic archive containing all evidence artifacts, compliance ledger, manifest, and SHA-256 signatures.