SP 800-53 Control Overlays for Securing AI Systems COSAiS

Control overlays enable organizations and communities of interest to customize the controls (or control baselines) for a specific technology, system, mission space, and environment of operation. Controls can be selected from the SP 800-53 control catalog, modified to address unique risks or applications, and supplemented to provide application-specific guidance for implementers. The parameter values for assignment and selection operations can also be set.

The NIST RMF (SP 800-37r2) provides a disciplined, structured, and flexible process for managing security and privacy risk. It is designed to be technology neutral so that the methodology can be applied to any type of information system without modification.

The NIST AI RMF is intended to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.

Because the security of AI systems is closely intertwined with the security of the IT infrastructure on which they run and operate, the frameworks can be used concurrently.

Organizations are not required to use the provided overlays.

The overlays are provided as a resource that can be used as a starting point for cybersecurity considerations for organizations using AI and AI developers.

Based on feedback, NIST will start the first use case with the goal of issuing a public draft for comment in early FY26, one use case at a time. A public workshop will also be held in the Q1 FY26 for ongoing stakeholder engagement. Plans for the overlays, working drafts and related topics will discussed as part of a community effort in the NIST AI Overlay Slack Collaboration channel.

Feedback on the overlays can also be sent to [email protected].

The overlays will be designed to address specific risks to different types of AI usage in conjunction with an organization’s cybersecurity risk management program and existing control implementation.

Organizations may utilize the AI RMF Playbook and the Control Overlays for Securing AI Systems by borrowing as many – or as few – suggestions as apply to their industry use case or interests.