# NIST AI RMF: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each NIST AI RMF clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / NIST AI RMF

# NIST AI RMF: the php2shell risks it governs

For AI used to find flaws and AI used to report on them: who governs it, what it can reach, and how to switch it off.

**Full name** NIST AI Risk Management Framework 1.0 (AI 100-1) · **Publisher** US National Institute of Standards and Technology · **Version** 1.0, January 2023 · [the official text](https://doi.org/10.6028/NIST.AI.100-1)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **GOVERN-1.1** | Legal and regulatory requirements involving AI are understood, managed and documented | *no risk mapped* |  |
| **GOVERN-6.1** | Policies address AI risks from third-party entities | [R08 Frontier AI finds critical flaws faster than maintainers can fix them](../../../grc/risks/r08/index.html) **20** critical | [OpenAI (Patch the Planet)](../../../grc/stakeholders/openai/index.html) |
| **MEASURE-2.7** | AI system security and resilience are evaluated and documented | [R08 Frontier AI finds critical flaws faster than maintainers can fix them](../../../grc/risks/r08/index.html) **20** critical [R10-1 Prompt injection through captured material](../../../grc/risks/r10-1/index.html) **12** high | [OpenAI (Patch the Planet)](../../../grc/stakeholders/openai/index.html), [The editor](../../../grc/stakeholders/newsroom-editor/index.html) |
| **MANAGE-2.4** | Mechanisms exist, with assigned responsibility, to supersede, disengage or deactivate an AI system | [R10 This newsroom's own agents are steered, leak or mislead](../../../grc/risks/r10/index.html) **12** high | [The editor](../../../grc/stakeholders/newsroom-editor/index.html) |


---
site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/nistairmf/index.html