NIST AI RMF Alignment CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise is implementing the NIST AI RMF's Govern function. The organization has a decentralized structure where business units operate semi-independently. The AI governance team wants to ensure consistent risk management across units while respecting their autonomy. Which approach best balances these competing needs?

   • AEstablish a centralized AI risk policy framework with mandatory minimum standards, while allowing business units to tailor operational procedures to their context.
   • BDelegate all AI risk governance to each business unit, with no central oversight, to maximize autonomy.
   • CCreate a single, highly detailed governance manual that all units must follow exactly, eliminating local variation.
   • DAppoint a single AI risk officer with sole authority to make all AI risk decisions for every unit.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational corporation is adopting the NIST AI RMF across its subsidiaries, which operate in different regulatory environments. The central risk team wants to ensure that each subsidiary can address local requirements while maintaining enterprise-wide consistency. How should the organization use RMF profiles and tiers?

   • AAssign each subsidiary a tier based on its size, regardless of its risk context.
   • BDevelop a target profile for the enterprise and allow each subsidiary to create its own current profile and select tiers that reflect its local context.
   • CUse only the Govern function and ignore profiles because they are optional.
   • DCreate a single mandatory profile for all subsidiaries to ensure uniformity across the enterprise.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A university is implementing the NIST AI RMF for its admissions AI tool. The provost wants to ensure that governance activities are not just documented but actively used in decision-making. Which practice best embodies the Govern function's emphasis on accountability?

   • ACreate a detailed governance policy document and store it in the university's policy library.
   • BAssign the AI governance role to the IT helpdesk manager as an additional duty.
   • CAllow the AI vendor to manage all governance because they have the most expertise.
   • DEstablish a cross-functional AI governance committee that meets quarterly to review risk reports and make decisions on AI system changes.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A startup is adopting the NIST AI RMF for its first AI product. The team is small and has limited risk management experience. Which use of profiles and tiers would be most appropriate for this startup?

   • AStart with a lower tier that matches its current capabilities, and use a current profile to identify gaps toward a target profile that is realistic for its size.
   • BAdopt the highest tier immediately to ensure maximum risk management rigor.
   • CUse a single enterprise profile without considering the startup's specific context.
   • DSkip profiles and tiers because they are optional and the startup needs to move fast.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is integrating the NIST AI RMF with its existing ISO 31000 risk management framework. The company wants to avoid duplication of effort. Which approach best achieves this integration?

   • ARun the NIST AI RMF and ISO 31000 as parallel, independent processes to ensure thoroughness.
   • BMap the NIST AI RMF functions to ISO 31000 processes, and use the existing ISO 31000 risk register and reporting channels for AI risks.
   • CReplace ISO 31000 with the NIST AI RMF for all risk management, including non-AI risks.
   • DUse the NIST AI RMF only for AI systems and ISO 31000 for everything else, with no cross-referencing.
   Reveal Solution Discussion Select an answer first