Prioritize findings by impact and exploitability

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R31 — NIST AI RMF Manage function

   R42 — NIST GenAI Profile risk treatment

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Triage all red-team findings from Days 89–92 by impact severity and exploitability. Remediate the highest-risk code/config flaws across P1–P3 and promote every confirmed attack into the permanent D8 CI regression gate.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 93 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Remediated code commits, passing D8 regression run, and updated residual-risk register.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R31NIST AI RMF 1.0↗ nist.gov

  Govern, Map, Measure, and Manage functions; risk ownership, measurement, and lifecycle documentation.

• R42NIST AI RMF GenAI Profile↗ doi.org

  NIST AI 600-1: generative AI risks and suggested actions for confabulation, privacy, information integrity, and value chain.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST
  AI Risk Management Framework | NIST

  The Govern, Map, Measure, Manage structure you triage against, so each red-team finding lands in a function with a named owner rather than a flat bug list.

  R31checked 2026-11-11
• videoIBM Technology · 8:49
  Mastering AI Risk: NIST’s Risk Management Framework Explained

  Walks the four RMF functions and how they connect, giving you the vocabulary to score impact and exploitability consistently across P1 to P3.

  R31checked 2026-11-11
• videoApplied AI · 54:48
  Using the NIST AI Risk Management Framework // Applied AI Meetup October 2023

  A practitioner session on actually applying the RMF, useful for turning confirmed attacks into measurable, repeatable CI regression checks rather than one-off reports.

  R31checked 2026-11-11
• articleNIST (NIST AI 600-1)
  Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile

  The GenAI profile's suggested actions for confabulation, data privacy, information integrity and value-chain risk, which is how you justify severity for AI-specific findings.

  R42moved 2026-11-11
• docsNIST AI Resource Center
  5. AI RMF Core

  The subcategory-level outcomes behind each function, the granularity you need to attach a specific test artifact to each control you claim to meet.

  R31checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.