Evaluating Control-Based AI Governance in Cybersecurity GRC Programs: An Expert Assessment Study

This study proposes and evaluates the Lifecycle-Integrated AI Governance Control Framework (LIAGCF), a Design Science Research artifact that maps 16 administrative, technical, and operational AI governance controls across seven lifecycle phases. Each control aligns to NIST AI RMF core functions and NIST SP 800-53 control families within a unified enterprise cybersecurity GRC architecture. Structured expert review (N = 10) validated NIST AI RMF structural alignment (9 of 10) and confirmed SP 800-53 control family assignments as technically defensible (7 of 10). Lifecycle coverage was validated as comprehensive, and the framework was affirmed as a meaningful contribution to AI governance scholarship. Theoretically, the LIAGCF addresses a documented structural gap as the first lifecycle-integrated, control-categorized governance framework to operationalize both NIST AI RMF core functions and NIST SP 800-53 control families within a unified architecture, bridging the persistent disconnect between strategic AI risk oversight and operational cybersecurity enforcement. In practice, the LIAGCF equips GRC practitioners, CISOs, and federal risk management program leads with a standards-aligned, auditable governance structure that operationalizes AI risk management intent as assignable, lifecycle-anchored controls, with designated implementation artifact requirements.