How does AI TRiSM map to NIST AI RMF and ISO 42001?

They operate at different altitudes. NIST AI RMF is a voluntary risk process organized around four functions: GOVERN, MAP, MEASURE, and MANAGE. ISO/IEC 42001:2023 is a certifiable management system standard with Annex A controls and an audit cycle. AI TRiSM is Gartner's vendor-category framing for the tooling that implements both. NIST gives you the method, ISO gives you the certificate, TRiSM gives you the products.

The mapping is close enough to be useful. GOVERN aligns with the ISO 42001 clauses on leadership, AI policy, and roles, and is served by governance platforms and system inventories. MAP aligns with the AI system impact assessment and risk assessment requirements and depends entirely on having a complete inventory. MEASURE aligns with the ISO requirements for performance evaluation and internal audit, and is served by evaluation harnesses and red teaming. MANAGE aligns with operational controls and incident handling, and is served by runtime guardrails and monitoring.

NIST's Generative AI Profile, published as NIST-AI-600-1 in July 2024, extends the four functions to generative systems and is the more directly applicable document for anyone deploying LLM applications.

Where all three strain identically: none was written with autonomous agents in mind. Each assumes a system with a definable boundary, and an agent that composes tools at runtime redraws its boundary on every request.

Akto Argus and Akto Atlas map primarily to MEASURE and MANAGE, supplying the continuous testing evidence and runtime enforcement records that satisfy ISO 42001 performance evaluation clauses.

Use NIST as your operating model and ISO as the audit wrapper. They are not competing choices.