Law / Frameworks / Crosswalk / MIT mitigations to NIST CSF 2.0
The MIT AI Risk Mitigation Taxonomy, mapped to the NIST Cybersecurity Framework
8 of MIT mitigations' controls connect to 2 of NIST CSF 2.0's through 10 laws in 4 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, MIT AI Risk Initiative
- To
- NIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), National Institute of Standards and Technology
- See also
- NIST CSF 2.0 to MIT mitigations, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: mit-ai-risk-mitigations--nist-csf.csv · mit-ai-risk-mitigations--nist-csf.json
Not connected to the NIST CSF 2.0: 15 of MIT mitigations' controls
Short of 2 laws
The same duties reach these and a NIST CSF 2.0 control, in fewer than 2 of the laws we track.
- 4.2 Risk Disclosure: with PR.PS-04 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan; with RS.CO-02 through Artificial Intelligence Risk Management and Security Act of 2026, United States
- 4.3 Incident Reporting: with PR.PS-04 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan; with RS.CO-02 through Artificial Intelligence Risk Management and Security Act of 2026, United States
- 4.5 Third-Party System Access: with PR.PS-04 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan; with RS.CO-02 through Artificial Intelligence Risk Management and Security Act of 2026, United States
- 4.6 User Rights & Recourse: with PR.PS-04 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
No NIST CSF 2.0 control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST CSF 2.0 control.
No law we track reaches these
No duty in the laws we track reaches these controls.
Lines of the scraping and news aggregation laws we track were not read against the NIST CSF 2.0, so none of them connects the two here (how each subject's lines were read).
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the MIT mitigations through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST CSF 2.0 |
|---|---|
| AI | such lines on security, robustness, resilience, vulnerabilities and logs |
| scraping | not read |
| news aggregation | not read |
Every duty line in the AI laws we track has been read against the framework for its subject.
Sources and licenses
MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy