Tier 2 · fixed-price engagement
NIST AI RMF alignment review
Govern, Map, Measure and Manage, scored against the systems you actually run rather than the ones your policy describes.
Who this is for
A US organization asked to show a risk process rather than a certificate, where there is no certification to obtain.
Fixed price
$7,500
- Duration
- 2 weeks
- Deposit
- $1,400
- Other currencies
- €6,900 · £5,790 · S$9,900
- Catalog
- T2-06
Thirty minutes with the engineer who would run the work, before any paperwork.
The work, stage by stage
In order, with what happens at each stage and what it produces. The timings are the ones the catalog prices, not an estimate written for this page.
Inventory the systems in scope
Days 1 to 2
Which AI systems exist, what each one decides or produces, and who depends on the output. The review is scored per system, so an inventory that is wrong makes every later score wrong.
Score GOVERN
Days 3 to 4
Accountability, policy, workforce and the risk culture actually in place: who owns an AI risk decision, where that is written down, and what happens when the owner disagrees with the delivery date.
Score MAP
Days 5 to 6
Context and categorisation per system: intended use, foreseeable misuse, affected people, and the assumptions the system was built on that nobody has revisited.
Score MEASURE
Week 2, first half
What is instrumented and what is asserted. Whether a stated accuracy, groundedness or fairness property has a test behind it, how often that test runs, and whether anyone sees the result.
Score MANAGE
Week 2, second half
Response and recovery: how a risk is prioritised, who can stop a system, what the rollback path is, and whether any of it has been exercised rather than written.
Write it up and walk it through
On delivery
Scores per function with the evidence behind each, the three things worth fixing first, and a call on the document.
Everything that arrives, listed
The contents of the document, and the artifacts that come with it. If something here would not be useful to you, say so before we start and the scope changes.
- A score per function, Govern, Map, Measure and Manage, per system in scope, with the evidence for each score
- The subcategory-level findings behind each score, so a reader can disagree with a specific judgement rather than the total
- A prioritised list of what to fix first, ordered by risk reduction per unit of effort
- The system inventory the review was scored against, reusable as your own register
- A note on what the framework does not reach for your systems, since it supplies a risk method rather than an obligation
What this covers, and who takes the rest
Stated up front, because scope is what derails an engagement in week two rather than at the proposal.
Inside this engagement
- Every AI system named in the agreed inventory, scored individually
- The risk process as practised, including where it is bypassed under deadline
- Instrumentation: whether a claimed property has a test behind it
Handled separately
Named so you can plan and budget for it, whether we do it or somebody else does.
- Building the evaluation suite a MEASURE finding calls for, which is its own engagement
- Certification, which this framework does not offer and no body issues against it
Start with a call, not a proposal.
Thirty minutes, straight to the engineer who would run the work. We will tell you if a smaller engagement answers your question, or if nothing here does.
Typical reply within one business day · Engagements start at $2,500
Fixed price · 2 weeks