NIST Compliance: Requirements, Frameworks & How to Get Compliant

“NIST compliant” sounds like a single status an organization can achieve. In practice, the term is more complicated.

NIST compliance generally means aligning an organization, system, process, or security program with a specific NIST framework, publication, control set, or NIST-based requirement. There is no single universal NIST compliance program and no general certificate issued by NIST declaring an organization compliant with everything NIST publishes.

That distinction matters because different NIST resources address different objectives. The NIST Cybersecurity Framework 2.0 supports cybersecurity risk management. NIST SP 800-53 provides security and privacy controls. NIST SP 800-171 addresses protection of Controlled Unclassified Information in relevant nonfederal environments. The NIST AI Risk Management Framework focuses on risks associated with artificial intelligence.

Some frameworks are primarily voluntary guidance. Other NIST-based requirements may become applicable through government contracts, procurement terms, customer requirements, supply-chain arrangements, organizational policies, or other obligations.

The key is to identify exactly which NIST resource applies before assessing compliance.

NIST Compliance at a Glance

NIST compliance is not one universal certification. It usually means meeting, implementing, or aligning with a particular NIST framework, publication, control set, or NIST-based requirement.

This table is a navigation guide rather than a determination of legal or contractual applicability.

What Is NIST Compliance?

What “NIST compliance” means

The National Institute of Standards and Technology develops standards, frameworks, technical publications, guidelines, measurement methods, and other resources used across cybersecurity, privacy, AI, and technology risk management.

As a result, “NIST compliance” only becomes meaningful when the applicable resource and scope are identified.

An organization might be seeking to align its cybersecurity program with CSF 2.0, implement selected SP 800-53 controls, satisfy contractual requirements involving SP 800-171, or use NIST AI RMF to strengthen AI governance.

These are different objectives. They should not be treated as interchangeable forms of one universal NIST program.

A useful question whenever someone asks whether an organization is “NIST compliant” is:

Compliant with which NIST framework, publication, revision, and scope?

Is NIST compliance mandatory?

Not universally.

NIST states in its official Cybersecurity Framework FAQs that it is not a regulatory agency and that most organizations use the CSF voluntarily. NIST also explains that the Framework can become required in particular contexts, including certain government uses or supply-chain relationships.

The same distinction matters across other NIST publications. A NIST-based requirement may become relevant through federal contracts, procurement conditions, customer requirements, internal organizational policies, supply-chain arrangements, or another applicable obligation.

For example, NIST's SP 800-171 Rev. 3 publication addresses protection of Controlled Unclassified Information, or CUI, in relevant nonfederal systems. NIST explains that its security requirements are intended for use by federal agencies in contractual vehicles or other agreements with nonfederal organizations.

The correct conclusion is therefore not simply “NIST is mandatory” or “NIST is voluntary.”

Applicability depends on the specific NIST framework or publication and the obligations affecting the organization.

Implementing a NIST framework also does not automatically establish compliance with GDPR, the EU AI Act, SOC 2, CMMC, ISO/IEC 42001, or every cybersecurity and privacy law.

Is there a NIST compliance certification?

There is no universal “NIST compliance certificate.”

Organizations need to distinguish several concepts.

Adoption means selecting a framework or publication for use.

Implementation means putting relevant outcomes, controls, policies, and processes into operation.

Assessment means evaluating whether those measures have been implemented appropriately.

Evidence means maintaining records that support claims about implementation.

Independent assessment means involving another party where external validation is required or useful.

Certification refers to a formal certification scheme where one actually exists.

NIST specifically states in its CSF FAQs that it does not offer certifications or endorsements for CSF-related products, implementations, or services and does not operate a CSF conformity assessment program.

Organizations should therefore avoid broad claims such as “NIST certified” unless they are referring accurately to a specific legitimate assessment or certification arrangement.

Which NIST Framework Applies?

Choosing the right resource is one of the most important parts of NIST compliance.

Using the wrong framework can produce extensive documentation without addressing the organization's actual risk or obligation.

NIST Cybersecurity Framework 2.0

The NIST Cybersecurity Framework 2.0 was published on February 26, 2024. NIST describes it as guidance that organizations of any size, sector, or maturity can use to understand, assess, prioritize, communicate, and manage cybersecurity risk.

Its six Functions are:

1. Govern

2. Identify

3. Protect

4. Detect

5. Respond

6. Recover

The addition of Govern is an important distinction from the earlier CSF 1.1 structure.

CSF 2.0 is outcome-oriented. NIST explicitly states that the Framework does not prescribe how organizations must achieve those outcomes. It instead provides a taxonomy of cybersecurity outcomes and connects users with additional implementation resources.

That is why treating CSF 2.0 as a universal checklist is a mistake. NIST's own FAQ says there is no recommended checklist of actions that every organization must follow.

Organizations can also use Organizational Profiles to describe current and desired cybersecurity outcomes. Comparing a Current Profile with a Target Profile can support gap identification and prioritization.

CSF Tiers provide additional context about the rigor of cybersecurity risk governance and management. They should not be presented as an official NIST compliance percentage or a universal maturity score.

NIST SP 800-53

NIST SP 800-53 Rev. 5 provides a broad catalog of security and privacy controls for information systems and organizations.

According to NIST's Computer Security Resource Center, the controls are designed to address diverse risks including hostile attacks, human error, natural disasters, structural failures, and privacy risks. NIST describes the controls as flexible and customizable within an organization-wide risk-management process.

Its control families cover areas including:

• access control;

• awareness and training;

• audit and accountability;

• configuration management;

• incident response;

• risk assessment;

• system and information integrity;

• supply-chain risk management;

• privacy.

That does not mean every organization must implement every SP 800-53 control.

NIST explains that the catalog addresses requirements that can arise from mission and business needs, laws, executive orders, regulations, policies, standards, and guidelines. The controls selected therefore need to reflect the organization's particular context and applicable requirements.

CSF 2.0 and SP 800-53 can serve complementary purposes. CSF organizes high-level cybersecurity outcomes, while detailed controls may support achievement of relevant outcomes.

NIST SP 800-171

NIST SP 800-171 Rev. 3 addresses protection of the confidentiality of Controlled Unclassified Information when that information resides in applicable nonfederal systems and organizations.

Revision 3 was published in May 2024 and superseded Revision 2.

NIST states that the requirements apply to components of nonfederal systems that process, store, or transmit CUI, as well as components that provide protection for those systems. The requirements are intended for federal agencies to use in contractual vehicles or other agreements with nonfederal organizations.

SP 800-171 is therefore particularly relevant to organizations operating in applicable federal contracting and supply-chain environments.

It should not be portrayed as a universal security baseline that every private company is legally required to implement.

NIST AI Risk Management Framework

For organizations developing, deploying, acquiring, or using AI, NIST AI RMF addresses a different category of risk.

The official NIST AI RMF 1.0 publication was released on January 26, 2023. NIST describes it as a voluntary, non-sector-specific, and use-case-agnostic framework designed to help organizations manage AI risks and support trustworthy and responsible AI.

Its four Core Functions are:

• Govern

• Map

• Measure

• Manage

These should not be confused with the six Functions of CSF 2.0.

There is also an important freshness point for organizations using the framework in 2026. NIST currently states on its AI Risk Management Framework page that AI RMF 1.0 is being revised. AI RMF 1.0 remains the published framework while that revision is in progress.

A terminology point that prevents confusion

NIST AI RMF is not the same thing as the broader NIST Risk Management Framework.

AI RMF specifically addresses artificial intelligence risk.

NIST also maintains a Risk Management Framework for information systems associated with publications such as SP 800-37.

When a contract, policy, assessor, or customer refers simply to “NIST RMF,” organizations should confirm which framework is actually intended.

NIST Compliance Requirements: What Do Organizations Need to Do?

There is no universal set of NIST compliance requirements that applies identically to every organization.

The required work depends on the selected framework, organizational scope, risk environment, external obligations, and desired outcomes.

Define the applicable scope

Start by determining what the NIST initiative covers.

Scope may include information systems, networks, applications, data, business processes, AI systems, cloud services, organizational units, suppliers, and service providers.

Poorly defined scope weakens the rest of the assessment because teams cannot reliably determine which risks, controls, systems, and owners should be evaluated.

A scope statement should also identify meaningful exclusions and the reasoning behind them.

Establish governance and accountability

Controls and policies need accountable owners.

Organizations should determine who approves risk decisions, who implements safeguards, who manages exceptions, who monitors performance, and who reports material risks to management.

Governance documentation may include policies, role assignments, approval authorities, risk-acceptance processes, reporting procedures, escalation paths, and oversight responsibilities.

For AI systems, accountability may span technical, legal, privacy, cybersecurity, compliance, risk, procurement, and business functions.

Identify and assess risks

A NIST-based program should be informed by actual risk rather than treated as a documentation exercise.

Depending on context, assessment may examine assets, threats, vulnerabilities, business impacts, privacy concerns, system dependencies, supply-chain risks, third-party exposure, and AI-specific impacts.

For organizations governing AI, an AI risk assessment can connect identified risks to intended use, affected parties, potential impacts, safeguards, testing, monitoring, and risk-treatment decisions.

Risk findings should then be prioritized according to their significance rather than treated as equally important.

Implement appropriate controls and safeguards

Controls should respond to applicable requirements and identified risks.

Depending on context, safeguards may involve access management, logging, configuration controls, security monitoring, incident response, supplier oversight, data governance, training, testing, change management, resilience, or AI governance.

The objective is not to implement every possible safeguard.

It is to select and operate measures appropriate to the organization's obligations, systems, scope, and risk.

Monitor, assess, and improve

NIST alignment should not end when an initial remediation project is completed.

Systems change. Suppliers change. New vulnerabilities emerge. AI models and use cases evolve. Organizational priorities shift.

Periodic assessment, testing, monitoring, issue management, management review, and corrective action help keep implementation aligned with the organization's current risk environment.

How to Become NIST Compliant: Step-by-Step Process

Step 1: Identify the applicable NIST framework or publication

Start with the reason the organization is pursuing NIST compliance.

Use CSF 2.0 when the main objective is organization-wide cybersecurity risk management.

Consider SP 800-53 where detailed security and privacy controls are relevant.

Assess SP 800-171 where CUI and applicable federal agreements are involved.

Use NIST AI RMF when the objective is managing AI risk.

If a customer, contract, policy, or government requirement names a specific publication, that requirement should guide framework selection.

Step 2: Define the scope

Document which systems, applications, data, processes, business units, AI systems, suppliers, and organizational boundaries are included.

Clear scope prevents different teams from assessing different environments under the same compliance claim.

Step 3: Perform a current-state assessment

Determine what is already in place.

Review existing policies, procedures, technical safeguards, governance arrangements, risk assessments, training, supplier processes, monitoring, incident management, control testing, and supporting documentation.

For CSF 2.0, NIST provides dedicated CSF 2.0 Quick-Start Guides covering Organizational Profiles, Tiers, small businesses, supply-chain risk management, enterprise risk management, and other implementation topics.

Step 4: Conduct a NIST gap analysis

Compare the current environment with applicable framework outcomes, requirements, controls, target states, or contractual expectations.

A useful gap register distinguishes between issues such as:

• control not implemented;

• implementation incomplete;

• documentation missing;

• control ineffective;

• ownership unclear;

• testing insufficient;

• evidence unavailable;

• risk unresolved.

“Not documented” and “not implemented” are different weaknesses and may require different remediation.

Step 5: Create a remediation plan

Prioritize findings according to risk and applicability.

Each remediation action should identify the issue, risk or requirement affected, responsible owner, priority, expected completion date, necessary resources, and target outcome.

The plan should prioritize meaningful risk rather than simply closing the easiest documentation gaps.

Step 6: Implement controls and governance processes

Implementation may require technical safeguards, updated policies, governance changes, training, supplier controls, monitoring capabilities, testing, or formal risk decisions.

Controls need to operate in the real environment, not exist only in written documentation.

Step 7: Document compliance evidence

Evidence helps organizations support claims about what has actually been implemented.

These are examples rather than universal NIST evidence requirements.

The appropriate evidence depends on the framework, outcome, control, contractual requirement, and organizational environment.

Step 8: Assess and validate implementation

Evaluate whether safeguards and processes are appropriately designed and operating as intended.

Validation may involve internal review, control testing, technical testing, management review, or independent assessment where appropriate.

External auditing is not automatically required simply because an organization uses a NIST framework.

For example, SP 800-171 Rev. 3 is accompanied by SP 800-171A Rev. 3, which provides procedures for assessing its security requirements. NIST explicitly identifies that relationship on the SP 800-171 publication page.

Step 9: Continuously monitor and improve

Track changes in risks, systems, suppliers, controls, incidents, assessment findings, business priorities, and relevant NIST publications.

For AI programs, NIST AI RMF implementation should similarly be treated as ongoing risk management across the AI lifecycle rather than a one-time mapping exercise.

NIST's AI Resource Center describes the framework as a resource intended to support the operationalization of AI risk management and notes that the AI RMF Playbook provides suggested actions and documentation practices.

Before telling a customer that you are “NIST compliant”

When a customer, auditor, procurement team, or business partner asks whether the organization is NIST compliant, clarify four points first:

1. Which NIST framework or publication are they referring to?

2. Which version or revision applies?

3. Which systems, data, business units, or suppliers are in scope?

4. What assessment or evidence do they expect?

These questions prevent a broad marketing claim from being mistaken for a precise compliance statement.

Organizations looking to strengthen their understanding of NIST-based AI risk management can explore AGC's NIST AI Risk Management Framework Training.

NIST Compliance for AI Systems

Organizations using AI may need to manage risks extending beyond conventional cybersecurity concerns.

AI-related risks can involve reliability, privacy, security, safety, transparency, accountability, misuse, harmful bias, human oversight, and impacts on individuals or organizations.

NIST AI RMF provides a voluntary structure for identifying and managing these risks.

The four NIST AI RMF Functions

Govern establishes organizational policies, accountability, roles, processes, oversight, and structures for managing AI risk.

Map establishes context and identifies relevant risks, intended uses, affected parties, assumptions, impacts, and system characteristics.

Measure focuses on analyzing, assessing, testing, benchmarking, and monitoring identified AI risks.

Manage involves prioritizing identified risks, selecting responses, allocating resources, tracking treatment, and supporting continuing improvement.

Organizations using NIST AI guidelines should connect these activities to actual governance decisions and evidence rather than convert the framework into an inflexible checklist.

NIST describes AI RMF 1.0 as voluntary and designed for organizations of different sizes, sectors, and levels of capability, which is why implementation needs to reflect organizational context.

NIST AI RMF and generative AI

For generative AI, NIST published NIST AI 600-1, the Generative Artificial Intelligence Profile on July 26, 2024.

NIST describes the document as a cross-sectoral profile and companion resource to AI RMF 1.0. It is designed to help organizations identify risks associated with generative AI and consider actions for managing those risks according to their objectives and priorities.

Organizations using generative AI can therefore use AI RMF as the broader risk-management structure while considering the profile where generative-AI-specific risks are relevant.

The profile does not create a separate universal generative AI compliance requirement.

NIST Compliance vs. ISO/IEC 42001

NIST vs ISO 42001 is not a comparison between two identical compliance systems.

NIST AI RMF is a voluntary framework for managing AI risk.

ISO/IEC 42001:2023 is an international management-system standard. ISO describes it as specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System within an organization.

Certification is another important distinction.

ISO's official ISO 42001 explained guidance states that ISO/IEC 42001 certification is voluntary. Organizations may seek independent confirmation that their AI management system meets the standard's requirements, but ISO itself does not certify organizations. Certification is conducted by independent certification bodies.

NIST AI RMF and ISO/IEC 42001 can nevertheless complement each other.

An organization might use NIST AI RMF to structure AI risk-management activities within a broader AI management system. However, implementing AI RMF does not automatically demonstrate conformity with ISO/IEC 42001.

The reverse is also true. ISO/IEC 42001 certification does not automatically establish alignment with every NIST AI RMF outcome.

How to Measure NIST Compliance

There is no official universal NIST compliance percentage.

Measurement should reflect the selected framework, defined scope, applicable obligations, risk objectives, and implementation goals.

Useful indicators can include:

• applicable outcomes or controls addressed;

• unresolved gaps;

• high-risk findings;

• overdue remediation actions;

• corrective-action status;

• control-testing results;

• policy and procedure coverage;

• open exceptions;

• recurring assessment findings;

• monitoring results.

For CSF 2.0, Current and Target Profiles can support comparison between current and desired cybersecurity outcomes.

For detailed controls or requirements, organizations may track implementation status, assessment findings, remediation progress, recurring weaknesses, and evidence quality.

For AI RMF, organizations can evaluate whether their governance, mapping, measurement, monitoring, and management activities are improving their ability to identify and address AI risk.

Metrics should support decisions.

They should not create an unsupported “NIST compliance score” merely because management wants a single number.

Common NIST Compliance Mistakes

1. Treating NIST as one certification

Different NIST frameworks and publications have different purposes. There is no universal NIST compliance certificate.

2. Choosing the wrong framework

Cybersecurity outcomes, detailed security controls, CUI requirements, federal risk-management processes, and AI risk management are not interchangeable.

3. Treating the framework as a checklist

NIST's CSF guidance explicitly rejects the idea that every organization should follow the same universal checklist. Implementation should reflect the organization's risks and circumstances.

4. Ignoring organizational risk

Controls should be connected to actual risks, systems, business objectives, and applicable requirements.

5. Failing to preserve evidence

A policy may describe what should happen without demonstrating that the process actually operates.

6. Implementing controls without ownership

Controls need accountable owners, review responsibilities, escalation procedures, and decision authority.

7. Treating AI risk as cybersecurity alone

AI governance can involve security, privacy, reliability, safety, accountability, transparency, human impacts, and other risks.

8. Ignoring third parties and supply chains

Cloud services, contractors, software providers, AI vendors, and other dependencies may affect organizational risk and compliance scope.

9. Treating compliance as a one-time project

Changes to systems, suppliers, threats, business processes, AI models, and applicable requirements can make previous assessments outdated.

10. Making unsupported “NIST certified” claims

Organizations should describe the exact framework, publication, scope, assessment, or implementation status rather than use ambiguous certification language.

NIST Compliance Checklist

The following is a practical checklist based on the guidance in this article. It is not an official NIST checklist.

• Identify the applicable NIST framework or publication.

• Confirm the relevant version or revision.

• Define organizational and system scope.

• Identify applicable systems, data, processes, AI, and third parties.

• Identify and assess relevant risks.

• Establish governance and accountability.

• Assess existing controls and processes.

• Conduct a gap analysis.

• Prioritize remediation according to risk.

• Implement appropriate safeguards and governance processes.

• Document implementation evidence.

• Validate controls and processes.

• Address assessment findings.

• Establish continuous monitoring.

• Review changes to relevant NIST publications.

• Continually improve the program.

Final Takeaway

NIST compliance is not one universal certification. It means identifying which NIST framework, publication, control set, or NIST-based requirement applies and then demonstrating appropriate implementation within a defined scope.

A defensible approach begins with framework selection, scope definition, current-state assessment, gap analysis, risk-based remediation, evidence, validation, and continuous monitoring.