NIST Cyber AI Profile (IR 8596)
Cyber-AI CSF profileNIST IR 8596 - Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile) · National Institute of Standards and Technology (NIST), with NCCoE and MITRE contributors
NIST IR 8596 is a qualitative CSF 2.0 community profile naming cybersecurity outcomes to pursue when AI is a target, a defensive tool, and an adversary capability. This AITBM-authored crosswalk offers one multi-dimensional, time-aware way to measure selected outcomes; NIST does not prescribe or endorse ERS.
| Cyber AI Profile Focus Area / CSF Function | Primary AITBM Sub-Metrics | Evidence Use / Notes |
|---|---|---|
| Secure: securing AI systems | Ro-1Ro-4Cn-1Cn-2Cn-4Pr-1Pr-2 | Select applicable security and exposure tests; no generic ERS |
| Defend: AI-enabled cyber defense | Tr-3Tr-1Tr-2Ro-3 | Assess the AI defender as a system; no generic ERS |
| Thwart: thwarting AI-enabled attacks | Ro-1Ro-2 | Drives CRM upward; faster evidence decay |
| GOVERN | Tr-3 | Governance posture sets assessment depth |
| IDENTIFY | Tr-4 | Architecture classification; provenance/AIBOM |
| PROTECT | Cn-1Cn-2Cn-4Cn-5Ro-1Ro-4 | The protective IVP sub-metrics |
| DETECT (model drift, data poisoning) | Ro-2Ro-3Ro-4Tr-3 | Drift and poisoning named explicitly |
| RESPOND | Cn-2 | Remediation feasibility; containment during response |
| RECOVER (compromised weights/data) | Tr-4 | Clean-lineage restoration requires provenance |
Key findings
- The Profile brings agentic, multi-agent, inter-agent authentication, and least-agency outcomes into scope. This crosswalk maps those outcomes to Cn-5 and the agentic architecture profile; the numeric weights remain AITBM design choices.
- The 'Thwart' lens flows through ORP (As elevator) and ACI (faster Tf decay) rather than IVP: AI-enabled adversaries should raise Attack Surface Exposure (e.g. 0.50 to 0.80), lifting N_elevated and CRM - operational and temporal dimensions a qualitative profile cannot express numerically.
- Coverage is strongest where AITBM's Robustness and Containment axes live (Secure): 8/23 sub-metrics strong, 10/23 partial, and 5/23 gaps (Fa-1, Fa-3, Fa-4, Pr-4, Cn-7). The Fairness axis sits outside a cybersecurity profile's scope; the draft provides no Cn-7 execution-budget measurement.
- IR 8596 remains an Initial Preliminary Draft (December 16, 2025) and does not prescribe a quantitative score or residual-risk floor. This crosswalk shows how AITBM can translate selected CSF outcomes into a comparable, confidence-graded ERS; NIST does not designate AITBM as a common denominator.