Adapting the NIST Cybersecurity Framework for Artificial Intelligence Risk: A Critical Review of the Cyber AI Profile

Artificial intelligence (AI) is increasingly embedded in enterprise software, yet the adequacy of existing cybersecurity governance for AI-enabled systems remains uncertain. This critical literature review examines whether the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0, particularly the draft Cyber AI Profile, can close the gap between cybersecurity guidance and organizational practice. The review synthesizes recent academic research on CSF implementation and maturity with NIST publications, industry surveys, and practitioner guidance. It considers three issues: the framework-practice gap in existing CSF implementations, the extension of the CSF to risks introduced by AI, and the boundary between AI-specific cybersecurity risk and broader AI risk. The reviewed literature suggests that the Cyber AI Profile offers useful considerations and cross-references, but it does not fully translate the speed, scale, autonomy, and unpredictability of AI into explicit organizational outcomes. Its focus areas emphasize securing AI systems, using AI for defense, and countering AI-enabled attacks, while providing less direct guidance for third-party AI embedded across common business applications. The paper concludes that the draft profile is a net benefit but does not close the guidance-practice gap. Organizations should combine the CSF with the NIST AI Risk Management Framework, clarify governance ownership, and use maturity-based implementation approaches, particularly where resources are limited. Further empirical research is needed to test whether these extensions improve risk reduction in practice.