09
Standards crosswalk
How this guide lines up with frameworks and rules your institution already follows. Existing controls still apply. The last column shows what agents add.
| Standard or requirement | What it covers | Where in this guide | What agents add |
|---|---|---|---|
| NIST AI RMF · Govern | Policies, roles, accountability, and a culture of risk management. | Dimensions 1–3; Governing tiers; RACI template | A named owner for every agent, including ones inside vendor platforms; decision rights for switching an agent off. |
| NIST AI RMF · Map | Context, intended use, and impacts identified before deployment. | What is an AI agent (arrival pathways); intake checklist | Record which actions the agent can take, in which systems, and on whose behalf. |
| NIST AI RMF · Measure | Testing, evaluation, and tracking of identified risks. | Evaluating; pilot plan | Test actions as well as answers: wrong writes, unintended messages, loops, and handoffs between agents. |
| NIST AI RMF · Manage | Prioritize, respond to, and recover from risks over time. | Governing tiers; Doing (monitor, retire) | Rollback for agent actions, an emergency off switch, and sunset criteria. |
| NIST AI 600-1 Generative AI Profile | Risks specific to generative AI, such as confabulation, information security, and data privacy. | Six lenses; data-access worksheet | Prompt injection and over-broad tool permissions become action risks, not just output risks. |
| FERPA and campus privacy policy | Limits on disclosing education records. | Data & reach lens; data-access worksheet | Least-privilege access per agent, and logs showing which records an agent read or changed. |
| GLBA Safeguards Rule | Security program for student financial information. | Data & reach lens; vendor due diligence | Treat financial-aid agents as in scope for the institution’s information security program. |
| Accessibility (ADA Title II, Section 504, WCAG 2.1 AA) | Accessible digital services for students and the public. | Equity check; Evaluating | Agent interfaces and agent-generated content meet the same standard; a human alternative stays available. |
| Information security standards | Identity, access control, logging, and incident response. | Governing tiers; registry fields | Agents get their own identities and credentials, not shared or borrowed human accounts. |
| Procurement and vendor contracts | Due diligence, data terms, and exit rights. | Vendor due diligence | Ask whether agent features can be turned off, scoped, audited, and kept out of model training. |
| Academic governance and integrity policy | Faculty authority over curriculum, assessment, and academic integrity. | Pedagogy & integrity dimension; scenarios | Faculty consultation before agents act in courses; clear rules on outside agents doing coursework. |
This crosswalk is a planning aid, not legal advice. Check requirements with your privacy, security, accessibility, and counsel offices. Sources: NIST AI Risk Management Framework (AI 100-1, 2023) and Generative AI Profile (AI 600-1, 2024).