NIST adds AI roles, prioritization to upcoming cyber profile draft

NIST is pivoting from framework abstraction to implementer toolkit mode. The upcoming initial public draft of the Cyber AI Profile will add AI roles, prioritization guidance, and expanded coverage of agentic AI, zero trust, and supply-chain considerations, all in direct response to contractor feedback that the December 2025 preliminary draft was too vague to act on.

The AI roles are the headline addition. Drawn from the AI Risk Management Framework's "AI Actor Tasks," they're designed to assign accountability for AI-related cybersecurity activities across job functions and service boundaries. MITRE's Julie Snyder, the Cyber AI Profile team lead, told the 930gov summit on July 28 that the roles address the question contractors kept asking during the spring working sessions: who is responsible for these things? For primes and subcontractors staring down AI compliance obligations they can't delegate, that question has been the source of implementation paralysis since the preliminary draft landed with over 1,400 comments and no clear ownership structure.

The draft also takes on the "everything is important, nothing is important" problem. Snyder said prioritization guidance will give organizations a pragmatic starting point, not hard rules, but enough structure to cut through the noise. The profile will add a "basic tips" section for teams that don't know where to begin, and the whole thing will ship as an Excel workbook, a format choice that itself signals practicality over polish.

What's still missing: a release date. Snyder offered only "pretty soon." And the open questions from the working sessions (whether AI roles will be prescriptive or advisory, whether prioritization translates into mandatory baseline controls) will determine whether this draft becomes the de facto compliance reference in federal RFPs or just a better-organized conversation starter. For contractors betting the former, the Excel file can't arrive soon enough.