If you've been in a vendor security review, an RFP response, or a board risk conversation about AI in the last two years, there's a decent chance someone has said the words "NIST AI RMF" without explaining what it actually is. This post is that explanation.

If you had met me a few years ago, you probably wouldn’t have guessed I’d end up in cybersecurity and governance, risk and compliance (GRC). I started my career in sales, not in tech. I was more familiar with targets, territories and trade promotions than with risk registers and ISO standards. But looking back, every step in my journey quietly pushed me toward GRC and cybersecurity—even when I didn’t realize it.