Page 160 - CyberSecurityEssentialsEnglish

Video: Introduction to the NIST AI Risk

Management Framework, an Explainer Video
Why the risks of an AI system are managed as a

continuing cycle tied to context, rather than
settled by a single approval.
Duration: about 10 minutes | Level: Introductory

Learning objective: Place a task on a scale of
impact before deciding how much verification it
needs.

Source: National Institute of Standards and
Technology [22].
https://www.nist.gov/video/introduction-nist-ai-

risk-management-framework-ai-rmf-10-
explainer-video
Verified: June 6, 2026

4.2 The 4D Framework: From a Request to a Defensible Decision

◆ Key idea: four questions before, during, and after use.
Define the task and the risks, delegate only the appropriate part, discern the acceptable

from the doubtful by verification, and finally document the tool, the sources, the
changes, and the decision. The framework is not a bureaucratic procedure; it is a way of
reducing random review and focusing on the points that matter.

The define stage begins before the tool is opened. What result is required? Who is the user?

What is the data? What is the impact of error? And what is the criterion of success? Once
these are clear, the level of risk can be set, instead of treating every task as equal.

In the delegate stage we determine the part the system can help with and the limits of its
authority. It may suggest alternatives, draft text, or extract fields, but the final decision,

external communication, or the modification of sensitive data may require human approval.
Delegation is not a binary choice between use and refusal; it is a matter of degree.

In the discern stage we test the output rather than merely reading it. We separate the claims,

look for the sources, check the figures, compare the coverage, test bias and edge cases, and
bring in an expert when the subject exceeds the user’s own knowledge.

To document means keeping enough information for someone to understand what
happened: the tool or model, the date of use, the material entered or a description of it, the

resulting version, the sources, the human changes, and the reviewer or decision owner. Not
every use needs a long file; the level of documentation should match the impact of the task.

159