Semantic Similarity-Based AI RMF and NIST SP 800-53 Integrated Crosswalk Structured Process

The rapid advancement of AI and digital technologies has introduced complex cyber threats. To manage these threats effectively, the U.S. National Institute of Standards and Technology (NIST) has evolved its Risk Management Framework (RMF), culminating in the 2023 release of the AI RMF 1.0 to address AI-specific risks. However, NIST SP 800-53 Rev.5 does not fully encompass inherent AI risk factors such as bias and lack of explainability, necessitating the integration of AI-specific risk management into existing security frameworks. While organizations like stackArmor have conducted crosswalk research, previous studies often lack quantitative validation and methodological precision. In this study, we propose a hybrid automated crosswalk framework that integrates Term Frequency-Inverse Document Frequency (TF-IDF) and Sentence-BERT to systematically map security controls to AI RMF functions. The methodology follows a two-stage structured process: first, deriving unique keywords for each control family using context-enhanced embeddings and Maximal Marginal Relevance (MMR) to minimize redundancy; and second, employing a hybrid query structure incorporating domain-specific keywords—such as model drift and distributed denial of service (DDoS) against machine learning (ML) infrastructure—to ensure technical granularity. Our approach demonstrated 98.63% consistency with expert-defined mappings and identified 60% more valid controls compared to manual baselines. These findings suggest that the proposed framework significantly enhances the scalability and precision of AI risk compliance, providing a robust foundation for automated, high-fidelity security auditing.