Findings are tagged with the specific GenAI Profile action identifier
Export packages bundle the inventory + scan history + finding evidence per action..
NIST AI 600-1 Compliance Mapping
NIST AI 600-1, the Generative AI Profile of the AI Risk Management Framework, defines suggested actions across GOVERN, MAP, MEASURE, and MANAGE functions for organisations building or deploying generative AI.
Last reviewed July 2026
Why NIST AI 600-1 evidence is hard
An auditor works from a framework control list; a scan produces a finding list. Without a mapping between the two, each finding has to be translated onto the controls by hand before an audit.
How Penaxtra maps to NIST AI 600-1
Penaxtra evidence aligns to MEASURE (continuous testing), MANAGE (response to findings), and supporting MAP (asset inventory) and GOVERN (policy) actions.
NIST AI 600-1 capabilities
Audit-ready PDF export with control IDs attached
JSON export for GRC ticketing systems
Configurable audit retention from 1 day to 10 years
Cross-framework overlaps reduce duplicate evidence collection
NIST AI 600-1 control coverage
A model-output hallucination flag maps to NIST AI 600-1 MEASURE-2.9 (information integrity) and MANAGE-1.3 (response planning).
Controls in this framework
Each control has a dedicated page: what it covers and how Penaxtra tests and evidences it.
GV-1.1 Legal and regulatory requirements involving AI are understood
GV-3.2 Accountability for AI risk is established
GV-4.1 AI risk management is integrated into broader enterprise risk
MG-3.2 Risks are tracked through to remediation
MG-AI-3.4 AI system incidents are logged + auditable
MP-2.3 AI system data sources are documented
MP-5.1 AI risk impacts on individuals + groups are documented
MS-1.1 Approaches for AI risk measurement are documented
MS-2.3 AI system performance is evaluated regularly
MS-3.3 Risk responses are reviewed periodically