Guidance

NIST TEVV-Athlon (draft, Aug 2026)

NIST AI 200-2: TEVV-Athlon Framework for Evaluating AI Systems

6 guidance propositions · 8 connected unified controls

Open NIST TEVV-Athlon (draft, Aug 2026) in the map

Version: NIST AI 200-2 ipd (Initial Public Draft), August 2026
Published: 2026-08-07
Reviewed: 2026-09-10
Amendments: Initial public draft; public comments close 2026-10-06

Initial public draft of a general AI evaluation framework, applicable to agentic systems. These six selected topics cover evaluation design and agent security testing; they are not a complete crosswalk of the publication. NIST-TEVV identifiers are local catalog references, not NIST control numbers. The confidentiality, injection, and tool-abuse topics relate to the lethal trifecta, but the draft does not prescribe an architecture that makes that combination safe or a required testing frequency.

Guidance propositions

“Informs” records a guidance relationship. It does not claim that a unified control satisfies a mandatory requirement.

AI Evaluation and Agent Security Testing

Proposition	Unified control and mapping
NIST-TEVV-01Define evaluation objectives, context, and measurements Source Source pages: NIST AI 200-2 ipd sections 2.1-2.2, pp. 3-6	UC-AI-05 — Set responsible AI development objectives and requirementsInforms UC-AI-07 — Verify, validate, and control AI deployment and changesInforms
NIST-TEVV-02Run evaluations and examine results and limitations Source Source pages: NIST AI 200-2 ipd sections 2.3-2.4, pp. 6-7	UC-AI-07 — Verify, validate, and control AI deployment and changesInforms UC-AI-08 — Log and monitor AI system behavior in operationInforms
NIST-TEVV-03Evaluate AI systems in realistic operating settings Source Source pages: NIST AI 200-2 ipd section 4.3.2, pp. 14-15; Appendix C, pp. 25-26	UC-AI-07 — Verify, validate, and control AI deployment and changesInforms
NIST-TEVV-04Test for disclosure of confidential information Source Source pages: NIST AI 200-2 ipd Appendix B, Table 4, p. 24: Confidentiality attacks	UC-DATA-11 — Control data flows, leakage, and cross-border transfersInforms UC-AI-20 — Prevent harmful, out-of-scope, hallucinated, and over-exposed AI outputsInforms
NIST-TEVV-05Test direct and indirect prompt injection Source Source pages: NIST AI 200-2 ipd Appendix B, Table 4, p. 24: Integrity attacks	UC-VULN-02 — Test security through independent penetration exercisesInforms UC-AI-18 — Defend AI interfaces against adversarial input, injection, and endpoint abuseInforms
NIST-TEVV-06Test agent tool misuse and unauthorized external actions Source Source pages: NIST AI 200-2 ipd Appendix B, Table 4, p. 24: Agent / tool abuse testing	UC-VULN-02 — Test security through independent penetration exercisesInforms UC-AI-19 — Constrain agent actions and tool use to authorized scopeInforms