From 9b5fc7dc6057f660f9720977a7f962ff34c30425 Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Fri, 18 Sep 2026 04:33:19 -0400 Subject: [PATCH] Fix #35: parse control identifiers by framework grammar, not by column MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `parseControlTable()` tried `looksLikeId()`, which rejects every identifier containing a space — `Req 6.2.4`, `Art. 9`, `§5.3` — then fell through to "column 0 is the id". On 611 rows that wrote the requirement prose into `control_id` and the identifier into `control_name`, so an id could not be followed back to its framework and the control-level join resolved by luck. scripts/control-ids.js holds a per-framework identifier grammar for the ten frameworks affected. A row is scanned for its framework's own id shape, wherever that sits: the id becomes `control_id`, the rest of that cell the name, and the requirement moves to `notes`. When the table has no name column the name comes from the framework registry's title for that id rather than repeating the id. Canonical forms follow the ruling on #35 — §5.3, Art. 9, Req 6.2.4, NHI-5, bare ISO clauses, SP 800-218A keeping NIST's -PS — with CIS identified by safeguard and the control carried as `parent` (A), and the SP 800-53 rows inside the 800-82 files kept and labelled `id_source` so they are not read as 800-82 sections (B). Two parser bugs surfaced on the way: - a section can hold more than one table, and the second table's header row was parsed as data. Splitting on the |---| separators drops those 10 junk rows and gives each table its own headers, which is what lets the SP 800-53 rows keep their titles. - two-column tables lost the requirement text entirely once the id stopped being mis-filed; it now becomes `notes`. Prose-shaped ids across the corpus: 611 -> 0. Mappings 3,781 -> 3,771, the difference being those 10 header rows. 969 rows changed id; no row was removed, and no severity, relationship or confidence changed. checkControlIdShapes() in validate.js fails the build if any of the 1,337 rows in those frameworks stops carrying a well-formed identifier. The registries were seeded from these broken rows and still hold prose ids; migrating them changes headline control counts and the webapp, so it follows separately. Co-Authored-By: Claude Opus 5 (1M context) --- data/backlinks.json | 22862 ++++++++++++++------------------ data/entries/ASI01.json | 132 +- data/entries/ASI02.json | 130 +- data/entries/ASI03.json | 154 +- data/entries/ASI04.json | 130 +- data/entries/ASI05.json | 132 +- data/entries/ASI06.json | 130 +- data/entries/ASI07.json | 132 +- data/entries/ASI08.json | 132 +- data/entries/ASI09.json | 124 +- data/entries/ASI10.json | 134 +- data/entries/DSGAI01.json | 99 +- data/entries/DSGAI02.json | 103 +- data/entries/DSGAI03.json | 92 +- data/entries/DSGAI04.json | 93 +- data/entries/DSGAI05.json | 80 +- data/entries/DSGAI06.json | 89 +- data/entries/DSGAI07.json | 96 +- data/entries/DSGAI08.json | 91 +- data/entries/DSGAI09.json | 91 +- data/entries/DSGAI10.json | 70 +- data/entries/DSGAI11.json | 83 +- data/entries/DSGAI12.json | 98 +- data/entries/DSGAI13.json | 91 +- data/entries/DSGAI14.json | 90 +- data/entries/DSGAI15.json | 89 +- data/entries/DSGAI16.json | 93 +- data/entries/DSGAI17.json | 87 +- data/entries/DSGAI18.json | 74 +- data/entries/DSGAI19.json | 83 +- data/entries/DSGAI20.json | 83 +- data/entries/DSGAI21.json | 91 +- data/entries/LLM01.json | 117 +- data/entries/LLM02.json | 124 +- data/entries/LLM03.json | 116 +- data/entries/LLM04.json | 118 +- data/entries/LLM05.json | 119 +- data/entries/LLM06.json | 114 +- data/entries/LLM07.json | 108 +- data/entries/LLM08.json | 108 +- data/entries/LLM09.json | 106 +- data/entries/LLM10.json | 108 +- data/stats.json | 4 +- docs/backlinks.js | 22864 ++++++++++++++------------------- docs/data.js | 4334 ++++--- scripts/control-ids.js | 163 + scripts/control-ids.test.mjs | 68 + scripts/generate.js | 73 +- scripts/validate.js | 40 + 49 files changed, 23979 insertions(+), 30763 deletions(-) create mode 100644 scripts/control-ids.js create mode 100644 scripts/control-ids.test.mjs diff --git a/data/backlinks.json b/data/backlinks.json index f8b62ac..897fde5 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -1422,8 +1422,56 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "12.4 Establish and maintain architecture diagram", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "10.1", + "control_name": "Deploy anti-malware", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "11.1", + "control_name": "Establish recovery capability", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "11.4", + "control_name": "Test data recovery", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "12.4", + "control_name": "Establish and maintain architecture diagram", "entries": [ { "id": "ASI07", @@ -1438,9 +1486,18 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.6", + "control_name": "Use of network-based URL filters", "entries": [ + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Rate limiting and traffic controls at the API gateway and network layer" + }, { "id": "ASI08", "name": "Cascading Agent Failures", @@ -1454,24 +1511,24 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use of network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.7", + "control_name": "Deploy host-based intrusion detection", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting and traffic controls at the API gateway and network layer" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "13.1 Centralise security event alerting", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.1", + "control_name": "Centralise security event alerting", "entries": [ { "id": "ASI10", @@ -1481,13 +1538,22 @@ "tier": "Hardening", "scope": "Both", "notes": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "13.3 Deploy a network-based intrusion detection system", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.3", + "control_name": "Deploy a network-based intrusion detection system", "entries": [ { "id": "ASI06", @@ -1502,25 +1568,34 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy a network intrusion detection solution", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.4", + "control_name": "Perform traffic filtering", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Network-layer monitoring for injection indicators in agent traffic" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy network intrusion detection", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.8", + "control_name": "Deploy a network intrusion detection solution", "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Network-layer monitoring for injection indicators in agent traffic" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -1529,13 +1604,22 @@ "tier": "Hardening", "scope": "Both", "notes": "Code execution environments network-monitored — outbound connection attempts from sandbox detected" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "entries": [ { "id": "LLM02", @@ -1568,50 +1652,75 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "15.1 Establish service provider management process", - "control_name": "CIS 15 — Service Provider Management", + "control_id": "14.3", + "control_name": "Train workforce to identify attacks", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "14.6", + "control_name": "Train workforce on AI security", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure application development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "15.1", + "control_name": "Establish service provider management process", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure development standards covering LLM integration — input validation, context separation" + "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure development standards covering agentic integrations — input validation, goal-state verification" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure application development standards", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secure development standards covering LLM integration — input validation, context separation" + }, { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -1630,6 +1739,15 @@ "scope": "Both", "notes": "Output encoding and sanitisation as secure development requirements" }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secure development standards covering agentic integrations — input validation, goal-state verification" + }, { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -1665,13 +1783,72 @@ "tier": "Hardening", "scope": "Both", "notes": "A2A authentication and schema validation as secure development requirements" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "16.11", + "control_name": "Use up-to-date software components", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "16.12", + "control_name": "Implement code-level security checks", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.2 Implement code review", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.2", + "control_name": "Implement code review", "entries": [ { "id": "LLM01", @@ -1681,13 +1858,22 @@ "tier": "Foundational", "scope": "Both", "notes": "Code review for all LLM integration code — prompt injection patterns reviewed" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.6 Use only up-to-date and trusted third-party components", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.6", + "control_name": "Use only up-to-date and trusted third-party components", "entries": [ { "id": "LLM04", @@ -1706,13 +1892,31 @@ "tier": "Foundational", "scope": "Both", "notes": "Approved component list — only sourced from approved vendors, signatures verified" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.7 Use standard hardening configuration templates", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.7", + "control_name": "Use standard hardening configuration templates", "entries": [ { "id": "LLM05", @@ -1722,13 +1926,22 @@ "tier": "Hardening", "scope": "Both", "notes": "Hardened training pipeline configurations — immutable infrastructure, locked data sources" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "entries": [ { "id": "LLM06", @@ -1765,13 +1978,22 @@ "tier": "Foundational", "scope": "Both", "notes": "Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "17.2 Establish incident response procedures", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.2", + "control_name": "Establish incident response procedures", "entries": [ { "id": "ASI10", @@ -1786,9 +2008,18 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Adversarial testing programme covering prompt injection scenarios" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -1798,6 +2029,15 @@ "scope": "Both", "notes": "Output injection scenarios in penetration testing — XSS, SQL injection via LLM output" }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -1815,38 +2055,58 @@ "tier": "Hardening", "scope": "Both", "notes": "Rogue agent scenarios in penetration testing — persistent hidden goal simulation, detection verification" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing programme", - "control_name": "CIS 18 — Penetration Testing", - "entries": [ + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Adversarial testing programme covering prompt injection scenarios" + "notes": null }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios" + "notes": null + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "18.3 Remediate penetration testing findings", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.3", + "control_name": "Remediate penetration testing findings", "entries": [ { "id": "LLM05", @@ -1856,13 +2116,22 @@ "tier": "Hardening", "scope": "Both", "notes": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software asset inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", + "control_id": "2.1", + "control_name": "Establish and maintain software asset inventory", "entries": [ { "id": "LLM04", @@ -1872,14 +2141,7 @@ "tier": "Foundational", "scope": "Both", "notes": "ML SBOM maintained as part of software asset inventory — model versions, libraries, adapters" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", - "entries": [ + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -1888,30 +2150,48 @@ "tier": "Foundational", "scope": "Both", "notes": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish and maintain data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "2.6", + "control_name": "Allowlist authorised software", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data classification and handling requirements applied to all LLM data assets" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish and maintain data management process", "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Data classification and handling requirements applied to all LLM data assets" + }, { "id": "LLM07", "name": "Misinformation", @@ -1929,13 +2209,40 @@ "tier": "Foundational", "scope": "Both", "notes": "System prompts classified as sensitive configuration — data handling policy applied" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "3.10 Encrypt sensitive data in transit", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.10", + "control_name": "Encrypt sensitive data in transit", "entries": [ { "id": "ASI07", @@ -1950,8 +2257,8 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "entries": [ { "id": "LLM02", @@ -1988,222 +2295,158 @@ "tier": "Hardening", "scope": "Both", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", - "entries": [ + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure configuration includes resource limits — token caps, rate limits, cost budgets" + "notes": null }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config" + "notes": null }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "3.13", + "control_name": "Deploy DLP solutions", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM tool access managed as privileged access — minimum scope, regular review" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool access managed as privileged access — minimum scope, regular review" + "notes": null }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance" + "notes": null }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat" + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "6.1 Establish access granting process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "3.2", + "control_name": "Establish data inventory", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Formal process for granting LLM tool access — documented justification required" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Formal process for granting agent tool access — documented justification per tool" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "6.2 Establish an access revoking process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "3.3", + "control_name": "Configure data access control lists", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management", - "control_name": "CIS 7 — Vulnerability Management", - "entries": [ - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector database CVEs in vulnerability management process — CVE-2024-3584 and equivalents" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management process", - "control_name": "CIS 7 — Continuous Vulnerability Management", - "entries": [ + "notes": null + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Vulnerability management process covers LLM component CVEs and dependency risks" + "scope": "Build", + "notes": null }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "7.5 Perform automated vulnerability scanning", - "control_name": "CIS 7 — Continuous Vulnerability Management", - "entries": [ + "scope": "Build", + "notes": null + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", - "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.12 Collect service provider logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "3.7", + "control_name": "Establish data classification scheme", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Hardening", - "scope": "Both", - "notes": "Full audit trail of training data provenance and model training runs" + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis" + "notes": "Secure configuration includes resource limits — token caps, rate limits, cost budgets" }, { "id": "LLM08", @@ -2212,60 +2455,83 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompt access logged — unauthorised access attempts detectable" + "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Log all LLM outputs — injection attempts in model responses detectable" + "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All agent inputs logged — injection attempts detectable through log analysis" + "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Memory write operations logged — who or what wrote, when, content hash" + "notes": null }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "4.2", + "control_name": "Maintain secure configuration of cloud assets", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated" - }, + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "5.3", + "control_name": "Disable dormant accounts", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", + "entries": [ { "id": "LLM03", "name": "Excessive Agency", @@ -2273,7 +2539,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All LLM tool invocations logged — every tool call auditable with parameters" + "notes": "LLM tool access managed as privileged access — minimum scope, regular review" }, { "id": "ASI02", @@ -2282,7 +2548,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp" + "notes": "Agent tool access managed as privileged access — minimum scope, regular review" }, { "id": "ASI03", @@ -2291,68 +2557,54 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All credential operations logged — issuance, use, anomalous patterns detectable" + "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" + "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.6 Collect DNS query audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "6.1", + "control_name": "Establish access granting process", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent traffic monitored — cascade indicators detected before physical impact" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 10", - "control_name": "10.1 — Deploy anti-malware", - "entries": [ + "notes": "Formal process for granting LLM tool access — documented justification required" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 11", - "control_name": "11.1 — Establish recovery capability", - "entries": [ + "notes": "Formal process for granting agent tool access — documented justification per tool" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -2363,83 +2615,67 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 12", - "control_name": "12.7 — Deploy host-based intrusion detection", + "control_id": "6.2", + "control_name": "Establish an access revoking process", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.4 — Perform traffic filtering", - "entries": [ + "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", "notes": null - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 14", - "control_name": "14.6 — Train workforce on AI security", + "control_id": "6.3", + "control_name": "Require password manager for service accounts", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 15", - "control_name": "15.1 — Establish service provider management policy", + "control_id": "6.4", + "control_name": "Require password manager", "entries": [ { "id": "DSGAI06", @@ -2454,12 +2690,12 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.12 — Implement code-level security checks", + "control_id": "6.5", + "control_name": "Require MFA for admin access", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", @@ -2467,68 +2703,57 @@ "notes": null }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "7.1", + "control_name": "Establish vulnerability management process", + "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Vulnerability management process covers LLM component CVEs and dependency risks" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Vector database CVEs in vulnerability management process — CVE-2024-3584 and equivalents" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": null }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", @@ -2542,168 +2767,123 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 17", - "control_name": "17.1 — Incident response management", + "control_id": "7.5", + "control_name": "Perform automated vulnerability scanning", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries" } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Establish penetration testing programme", + "control_id": "8.10", + "control_name": "Retain audit logs", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Build", "notes": null - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 2", - "control_name": "2.1 — Maintain authorised software inventory", + "control_id": "8.12", + "control_name": "Collect service provider logs", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Full audit trail of training data provenance and model training runs" } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Establish and maintain data management process", + "control_id": "8.2", + "control_name": "Collect audit logs", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "System prompt access logged — unauthorised access attempts detectable" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Log all LLM outputs — injection attempts in model responses detectable" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "All agent inputs logged — injection attempts detectable through log analysis" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Memory write operations logged — who or what wrote, when, content hash" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -2718,30 +2898,19 @@ "tier": "Foundational", "scope": "Build", "notes": null - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "8.3", + "control_name": "Ensure adequate audit log storage", + "entries": [ { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": null @@ -2750,207 +2919,87 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.1 — Establish secure configuration", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 5", - "control_name": "5.4 — Restrict administrator privileges", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.5 — Require MFA for admin access", - "entries": [ + "notes": "All LLM tool invocations logged — every tool call auditable with parameters" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All credential operations logged — issuance, use, anomalous patterns detectable" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": null + "tier": "Hardening", + "scope": "Both", + "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 7", - "control_name": "7.1 — Establish vulnerability management", - "entries": [ - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.6", + "control_name": "Collect DNS query audit logs", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null + "notes": "Agent traffic monitored — cascade indicators detected before physical impact" }, { "id": "DSGAI20", @@ -4297,92 +4346,69 @@ }, { "framework": "CWE/CVE", - "control_id": "Acceptance of Extraneous Untrusted Data with Trusted Data", - "control_name": "CWE-349", + "control_id": "CWE-1021", + "control_name": "Improper Restriction of Rendered UI Layers or Frames", "entries": [ { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge" + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Authentication Bypass by Capture-replay", - "control_name": "CWE-294", + "control_id": "CWE-116", + "control_name": "Improper Encoding or Escaping of Output", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Replay attacks on A2A channels without nonce-based replay protection" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Cleartext Storage of Sensitive Information", - "control_name": "CWE-312", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Cleartext Transmission of Sensitive Information", - "control_name": "CWE-319", - "entries": [ + "notes": null + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "A2A messages containing sensitive context transmitted without encryption" + "scope": "Build", + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-1021", - "control_name": "CWE-1021", + "control_id": "CWE-1341", + "control_name": "Multiple Releases of Same Resource or Handle", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Memory TTL not enforced — entries persist beyond intended lifetime" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-116", - "control_name": "CWE-116", + "control_id": "CWE-1357", + "control_name": "Reliance on Insufficiently Trustworthy Component", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", @@ -4390,36 +4416,36 @@ "notes": null }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Agent dependency on third-party MCP servers without security assessment" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-1357", - "control_name": "CWE-1357", + "control_id": "CWE-183", + "control_name": "Permissive List of Allowed Inputs", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "System accepts human-like agent output without disclosure requirements" } ] }, { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "entries": [ { "id": "LLM01", @@ -4439,6 +4465,33 @@ "scope": "Both", "notes": null }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool parameters generated by LLM not validated against safe ranges before execution" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Content entering agent memory not validated before write" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -4480,7 +4533,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "entries": [ { "id": "LLM02", @@ -4500,6 +4553,15 @@ "scope": "Build", "notes": null }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -4559,7 +4621,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "entries": [ { "id": "LLM02", @@ -4602,7 +4664,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-213", - "control_name": "CWE-213", + "control_name": "Exposure of Sensitive Information Due to Incompatible Policies", "entries": [ { "id": "DSGAI07", @@ -4618,7 +4680,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-215", - "control_name": "CWE-215", + "control_name": "Insertion of Sensitive Information Into Debugging Code", "entries": [ { "id": "LLM08", @@ -4631,10 +4693,26 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-250", + "control_name": "Execution with Unnecessary Privileges", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-269", - "control_name": "CWE-269", + "control_name": "Improper Privilege Management", "entries": [ { "id": "LLM03", @@ -4659,7 +4737,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-272", - "control_name": "CWE-272", + "control_name": "Least Privilege Violation", "entries": [ { "id": "LLM03", @@ -4681,10 +4759,26 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-276", + "control_name": "Incorrect Default Permissions", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "entries": [ { "id": "LLM03", @@ -4695,6 +4789,33 @@ "scope": "Build", "notes": null }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -4754,7 +4875,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-285", - "control_name": "CWE-285", + "control_name": "Improper Authorisation", "entries": [ { "id": "DSGAI15", @@ -4776,10 +4897,42 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-287", + "control_name": "Improper Authentication", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "A2A channels without mutual authentication — agents accept messages from any sender" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-294", + "control_name": "Authentication Bypass by Capture-replay", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Replay attacks on A2A channels without nonce-based replay protection" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "entries": [ { "id": "LLM08", @@ -4790,6 +4943,15 @@ "scope": "Build", "notes": null }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -4819,10 +4981,26 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-319", + "control_name": "Cleartext Transmission of Sensitive Information", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "A2A messages containing sensitive context transmitted without encryption" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "entries": [ { "id": "LLM09", @@ -4856,7 +5034,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-330", - "control_name": "CWE-330", + "control_name": "Use of Insufficiently Random Values", "entries": [ { "id": "LLM09", @@ -4881,7 +5059,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "entries": [ { "id": "LLM04", @@ -4910,6 +5088,15 @@ "scope": "Build", "notes": null }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Memory content not integrity-verified before storage or retrieval" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -4933,7 +5120,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-346", - "control_name": "CWE-346", + "control_name": "Origin Validation Error", "entries": [ { "id": "LLM05", @@ -4944,6 +5131,24 @@ "scope": "Both", "notes": null }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent does not verify that A2A messages originate from the claimed sender" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "User cannot determine whether advice originates from AI or human — no origin verification" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -4955,10 +5160,26 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-349", + "control_name": "Acceptance of Extraneous Untrusted Data with Trusted Data", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information to an Unauthorised Actor", "entries": [ { "id": "LLM02", @@ -5019,7 +5240,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-400", - "control_name": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "entries": [ { "id": "LLM06", @@ -5030,6 +5251,15 @@ "scope": "Both", "notes": null }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster" + }, { "id": "DSGAI17", "name": "Data Availability and Resilience Failures", @@ -5041,10 +5271,67 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-434", + "control_name": "Unrestricted Upload of File with Dangerous Type", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Analogy: agent accepts and executes tool payloads without content validation" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-441", + "control_name": "Unintended Proxy or Intermediary", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent acts as a proxy executing attacker instructions against backend systems" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Compromised tool acting as malicious intermediary in agent workflow" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-451", + "control_name": "User Interface Misrepresentation of Critical Information", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-488", - "control_name": "CWE-488", + "control_name": "Exposure of Data Element to Wrong Session", "entries": [ { "id": "DSGAI11", @@ -5060,7 +5347,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-494", - "control_name": "CWE-494", + "control_name": "Download of Code Without Integrity Check", "entries": [ { "id": "LLM04", @@ -5070,14 +5357,57 @@ "tier": "Foundational", "scope": "Both", "notes": null + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent tool components and MCP servers loaded without signature verification" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-506", + "control_name": "Embedded Malicious Code", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Model weights and tool components containing hidden backdoor functionality" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Rogue behaviour may result from backdoored model or component" } ] }, { "framework": "CWE/CVE", "control_id": "CWE-522", - "control_name": "CWE-522", + "control_name": "Insufficiently Protected Credentials", "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -5092,7 +5422,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-532", - "control_name": "CWE-532", + "control_name": "Insertion of Sensitive Information Into Log File", "entries": [ { "id": "DSGAI14", @@ -5108,7 +5438,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-602", - "control_name": "CWE-602", + "control_name": "Client-side Enforcement of Server-side Security", "entries": [ { "id": "DSGAI06", @@ -5121,10 +5451,42 @@ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-610", + "control_name": "Externally Controlled Reference to a Resource in Another Sphere", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent retrieves and acts on externally controlled content (RAG, email, tool returns) without adequate validation" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-613", + "control_name": "Insufficient Session Expiration", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Long-lived agent credentials without expiry or rotation — NHI-7" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-668", - "control_name": "CWE-668", + "control_name": "Exposure of Resource to Wrong Sphere", "entries": [ { "id": "DSGAI03", @@ -5148,111 +5510,120 @@ }, { "framework": "CWE/CVE", - "control_id": "CWE-74", - "control_name": "CWE-74", + "control_id": "CWE-674", + "control_name": "Uncontrolled Recursion", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null + "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-77", - "control_name": "CWE-77", + "control_id": "CWE-676", + "control_name": "Use of Potentially Dangerous Function", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent uses exec(), eval(), subprocess without validation" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-770", - "control_name": "CWE-770", + "control_id": "CWE-693", + "control_name": "Protection Mechanism Failure", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Safety and goal-verification controls bypassed through injection" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-778", - "control_name": "CWE-778", + "control_id": "CWE-703", + "control_name": "Improper Check or Handling of Exceptional Conditions", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent failures not caught and handled — exception propagates to downstream agents" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-78", - "control_name": "CWE-78", + "control_id": "CWE-730", + "control_name": "OWASP ReDoS", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Regex-based input processing causing runaway computation propagating through pipeline" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-79", - "control_name": "CWE-79", + "control_id": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Instruction elements in processed content not neutralised before agent reasoning" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", @@ -5262,172 +5633,165 @@ }, { "framework": "CWE/CVE", - "control_id": "CWE-798", - "control_name": "CWE-798", + "control_id": "CWE-755", + "control_name": "Improper Handling of Exceptional Conditions", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-799", - "control_name": "CWE-799", + "control_id": "CWE-77", + "control_name": "Command Injection", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM output used directly in command context" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-89", - "control_name": "CWE-89", + "control_id": "CWE-770", + "control_name": "Allocation of Resources Without Limits or Throttling", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Download of Code Without Integrity Check", - "control_name": "CWE-494", + "control_id": "CWE-778", + "control_name": "Insufficient Logging", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool components and MCP servers loaded without signature verification" + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Embedded Malicious Code", - "control_name": "CWE-506", + "control_id": "CWE-78", + "control_name": "OS Command Injection", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Model weights and tool components containing hidden backdoor functionality" + "scope": "Build", + "notes": null }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rogue behaviour may result from backdoored model or component" + "notes": "LLM-generated code containing shell commands executed without sanitisation" } ] }, { "framework": "CWE/CVE", - "control_id": "Execution with Unnecessary Privileges", - "control_name": "CWE-250", + "control_id": "CWE-79", + "control_name": "Cross-site Scripting (XSS)", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege" + "scope": "Build", + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Exposure of Sensitive Information to an Unauthorised Actor", - "control_name": "CWE-200", + "control_id": "CWE-798", + "control_name": "Use of Hard-coded Credentials", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Externally Controlled Reference to a Resource in Another Sphere", - "control_name": "CWE-610", - "entries": [ + "notes": "Agent credentials hardcoded in prompts or source code" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent retrieves and acts on externally controlled content (RAG, email, tool returns) without adequate validation" + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-799", + "control_name": "Improper Control of Interaction Frequency", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes" + "notes": null }, { "id": "ASI10", @@ -5436,46 +5800,30 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement" + "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Authentication", - "control_name": "CWE-287", + "control_id": "CWE-829", + "control_name": "Inclusion of Functionality from Untrusted Control Sphere", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "A2A channels without mutual authentication — agents accept messages from any sender" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Check or Handling of Exceptional Conditions", - "control_name": "CWE-703", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent failures not caught and handled — exception propagates to downstream agents" + "notes": "MCP servers and plugins from external registries loaded into agent execution context" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Dynamically-Managed Code Resources", - "control_name": "CWE-913", + "control_id": "CWE-862", + "control_name": "Missing Authorisation", "entries": [ { "id": "ASI02", @@ -5484,46 +5832,55 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled" + "notes": "No authorisation check before irreversible tool invocations; human confirmation not required" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Generation of Code", - "control_name": "CWE-94", + "control_id": "CWE-89", + "control_name": "SQL Injection", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Agent generates and executes code without adequate static analysis or sandbox" + "scope": "Build", + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Interaction Frequency", - "control_name": "CWE-799", + "control_id": "CWE-913", + "control_name": "Improper Control of Dynamically-Managed Code Resources", "entries": [ { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations" + "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Enforcement of Message Integrity During Transmission", - "control_name": "CWE-924", + "control_id": "CWE-924", + "control_name": "Improper Enforcement of Message Integrity During Transmission", "entries": [ { "id": "ASI07", @@ -5538,58 +5895,40 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Handling of Exceptional Conditions", - "control_name": "CWE-755", + "control_id": "CWE-94", + "control_name": "Improper Control of Generation of Code", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully" + "notes": "Agent generates and executes code without adequate static analysis or sandbox" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-940", + "control_name": "Improper Verification of Source of a Communication Channel", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool parameters generated by LLM not validated against safe ranges before execution" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Content entering agent memory not validated before write" + "notes": "User cannot verify the agent is operating under its stated configuration" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Directives in Dynamically Evaluated Code", - "control_name": "CWE-95", + "control_id": "CWE-95", + "control_name": "Improper Neutralisation of Directives in Dynamically Evaluated Code", "entries": [ { "id": "ASI05", @@ -5603,138 +5942,100 @@ ] }, { - "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Command", - "control_name": "CWE-77", + "framework": "DORA", + "control_id": "Art. 10", + "control_name": "Detection — injection monitoring", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM output used directly in command context" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in OS Command", - "control_name": "CWE-78", - "entries": [ + "notes": "Deploy detection mechanisms for prompt injection attempts; monitor inference requests for adversarial patterns and alert security operations" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated code containing shell commands executed without sanitisation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Output Used by a Downstream Component", - "control_name": "CWE-74", - "entries": [ + "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Instruction elements in processed content not neutralised before agent reasoning" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Verification of Source of a Communication Channel", - "control_name": "CWE-940", - "entries": [ + "scope": "Build", + "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "User cannot verify the agent is operating under its stated configuration" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Inclusion of Functionality from Untrusted Control Sphere", - "control_name": "CWE-829", - "entries": [ + "notes": "Monitor AI service consumption metrics in real time; alert on token spikes, latency degradation, and cost overruns affecting financial service availability" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "MCP servers and plugins from external registries loaded into agent execution context" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Incorrect Default Permissions", - "control_name": "CWE-276", - "entries": [ + "notes": "Deploy detection mechanisms for AI output quality degradation — hallucinations, factual errors, and misleading content in financial AI outputs" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "Monitor embedding stores for unauthorised modifications, anomalous writes, and bulk access patterns indicative of extraction or poisoning" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Insufficient Session Expiration", - "control_name": "CWE-613", - "entries": [ + "notes": "Monitor model output reaching privileged sinks; alert on generated code, markup, or query syntax that fails the boundary validation policy" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Long-lived agent credentials without expiry or rotation — NHI-7" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Insufficient Verification of Data Authenticity", - "control_name": "CWE-345", - "entries": [ + "notes": "Deploy detection mechanisms for agent goal manipulation; monitor for behavioural deviations, unexpected tool invocations, and goal drift indicators" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Memory content not integrity-verified before storage or retrieval" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Insufficiently Protected Credentials", - "control_name": "CWE-522", - "entries": [ + "scope": "Build", + "notes": "Monitor agent access patterns for unauthorised tool invocations, data access beyond scope, and permission violations; alert on detection" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -5742,31 +6043,17 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Missing Authorisation", - "control_name": "CWE-862", - "entries": [ + "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "No authorisation check before irreversible tool invocations; human confirmation not required" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Multiple Releases of Same Resource or Handle", - "control_name": "CWE-1341", - "entries": [ + "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -5774,359 +6061,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Memory TTL not enforced — entries persist beyond intended lifetime" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Origin Validation Error", - "control_name": "CWE-346", - "entries": [ + "notes": "Deploy detection mechanisms for agent memory manipulation; monitor for anomalous writes, content inconsistencies, and cross-session poisoning patterns" + }, { "id": "ASI07", "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Agent does not verify that A2A messages originate from the claimed sender" - }, - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "User cannot determine whether advice originates from AI or human — no origin verification" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "OWASP ReDoS", - "control_name": "CWE-730", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Regex-based input processing causing runaway computation propagating through pipeline" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Permissive List of Allowed Inputs", - "control_name": "CWE-183", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System accepts human-like agent output without disclosure requirements" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Protection Mechanism Failure", - "control_name": "CWE-693", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Safety and goal-verification controls bypassed through injection" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Reliance on Insufficiently Trustworthy Component", - "control_name": "CWE-1357", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent dependency on third-party MCP servers without security assessment" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Uncontrolled Recursion", - "control_name": "CWE-674", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Uncontrolled Resource Consumption", - "control_name": "CWE-400", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Unintended Proxy or Intermediary", - "control_name": "CWE-441", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent acts as a proxy executing attacker instructions against backend systems" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Compromised tool acting as malicious intermediary in agent workflow" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Unrestricted Upload of File with Dangerous Type", - "control_name": "CWE-434", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Analogy: agent accepts and executes tool payloads without content validation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Use of Hard-coded Credentials", - "control_name": "CWE-798", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials hardcoded in prompts or source code" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Use of Potentially Dangerous Function", - "control_name": "CWE-676", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent uses exec(), eval(), subprocess without validation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "User Interface Misrepresentation of Critical Information", - "control_name": "CWE-451", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI" - } - ] - }, - { - "framework": "DORA", - "control_id": "Art. 10", - "control_name": "Detection — injection monitoring", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for prompt injection attempts; monitor inference requests for adversarial patterns and alert security operations" - }, - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor AI service consumption metrics in real time; alert on token spikes, latency degradation, and cost overruns affecting financial service availability" - }, - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for AI output quality degradation — hallucinations, factual errors, and misleading content in financial AI outputs" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor embedding stores for unauthorised modifications, anomalous writes, and bulk access patterns indicative of extraction or poisoning" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor model output reaching privileged sinks; alert on generated code, markup, or query syntax that fails the boundary validation policy" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for agent goal manipulation; monitor for behavioural deviations, unexpected tool invocations, and goal drift indicators" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor agent access patterns for unauthorised tool invocations, data access beyond scope, and permission violations; alert on detection" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for agent memory manipulation; monitor for anomalous writes, content inconsistencies, and cross-session poisoning patterns" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries" + "scope": "Build", + "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries" }, { "id": "ASI08", @@ -8429,441 +8373,18 @@ }, { "framework": "EU AI Act", - "control_id": "A2A communication risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Accurate, robust outputs resilient to misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Output validation and sanitisation are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "AI-generated content must be marked as such — chatbots must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Mandatory AI disclosure prevents users from treating hallucinated content as authoritative human output" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "AI-generated content that could be mistaken as human must be disclosed", - "control_name": "Art. 50 — Transparency", - "entries": [ - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Disinformation risk amplified when users cannot distinguish AI-generated content — Art. 50 applies" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Autonomy-related risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Excessive agency scenarios required in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Availability risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Resource exhaustion and DoS scenarios included in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cascade risks identified and mitigated — blast radius defined", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Chatbots and AI-generated content must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All agent-user interactions require AI disclosure — universal obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Code execution risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Configuration management documented", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 10", + "control_name": "Data and data governance", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompt versions, access controls, and change procedures are quality management artefacts" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Credential exposure must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential lifecycle included in Art. 9 risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Credential exposure risk identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity against adversarial exploitation of context window content", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures covering all data channels including multimodal inputs", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing cross-session data exposure", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Session isolation and tenant separation are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing tool misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against adversarial misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against attacks including inference attacks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft and misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Short-lived credentials, NHI inventory, and access controls are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting AI system integrity", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting all system components", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including context window content", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including telemetry and monitoring data", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance applies to all data influencing AI behaviour — including agent memory", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance covering multi-tenant deployments — session isolation as a data handling requirement", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Session isolation controls are an Art. 10 data governance obligation for multi-user deployments" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance covers all input modalities — images, audio, video — not only text", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data poisoning must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs" + }, { "id": "LLM05", "name": "Data and Model Poisoning", @@ -8871,232 +8392,8 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Poisoning attack scenarios required in Art. 9 risk assessment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data quality controls applied to all data in scope — including RAG corpora", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Quality controls on embedding generation and vector store ingestion required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Deployers ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deployers responsible for ensuring endpoint AI agents operate within Art. 14 human oversight scope" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Deployers must ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deployers cannot waive Art. 14 human oversight requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Deployers must use AI systems as instructed and ensure appropriate oversight", - "control_name": "Art. 29 — Deployer obligations", - "entries": [ - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documentation of A2A security controls", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "A2A authentication and encryption documented in quality management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures covering output quality", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Post-market monitoring of output handling incidents required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for credential incident response", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for credential management and incident response", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent identity governance procedures documented in quality management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for data ingestion and pipeline integrity", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ingestion validation procedures and CVE patching documented in quality management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for LLM gateway security", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Security testing procedures and query log retention documented in quality management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented quality management system including data handling procedures", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data lifecycle procedures — classification, retention, deletion — documented in quality management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented quality management system including post-market monitoring", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents" + "notes": "Data quality controls preventing poisoning are a compliance requirement" }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Absence of a quality management system is an Art. 17 violation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Effective human oversight over high-risk AI", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Embedding and retrieval risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -9104,625 +8401,80 @@ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Vector store attack scenarios included in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Endpoint AI agent risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Browser and endpoint agent deployments assessed in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Goal hijack scenarios identified and mitigated in risk management system", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent goal hijack included in Art. 9 risk assessment for every agentic deployment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers document all third-party integrations", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool and plugin data exchange documented in GPAI technical documentation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Full data governance documentation for GPAI training data is a binding Art. 53 obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers must document training data governance including third-party sources", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Third-party training data provenance is a GPAI documentation obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers must maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers must publish summaries of training data and model capabilities", - "control_name": "Art. 53(1)(b) — GPAI transparency", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Published summaries must not inadvertently expose security-sensitive configuration" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI technical documentation includes model architecture and capability details", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI training data governance documented — privacy measures included", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Synthetic data generation methodology and re-identification risk assessment documented for GPAI" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Graduated fines based on violation type", - "control_name": "Art. 72 — Fines", - "entries": [ - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Understanding fine exposure is the starting point for compliance prioritisation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI accurate and resilient against adversarial data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Source trust scoring and ingestion validation are Art. 15 robustness requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow human oversight — users must be able to stop and override", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Users must be able to pause and override endpoint AI agents — Art. 14 human oversight requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI infrastructure protected against cybersecurity risks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient and implement cybersecurity measures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Technical robustness against poisoning is a binding Art. 15 requirement" + "notes": "Quality controls on embedding generation and vector store ingestion required" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must remain accurate and available under adverse conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must remain available under adversarial conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Technical resilience against denial-of-service attacks is an Art. 15 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI resilient against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI system information must include accuracy metrics and known limitations", - "control_name": "Art. 13 — Transparency", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Hallucination rates and accuracy limitations must be disclosed to deployers and users" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI systems designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI systems must be resilient to adversarial inputs and attempts to alter outputs or performance", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Robustness against prompt injection is a technical compliance requirement — not optional" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI training data subject to governance — relevant, representative, privacy-preserving", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data governance policy covering the full AI data lifecycle is an Art. 10 compliance requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Human oversight mechanisms effective against rogue behaviour", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI — ability to pause and stop", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI actions", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Ingestion integrity risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data ingestion attack surfaces included in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Labelling vendors are part of the AI value chain — obligations distributed accordingly", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "LLM gateway risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Mandatory risk management system for high-risk AI", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Absence of a documented risk management system is an Art. 9 violation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Meaningful human oversight over high-risk AI system outputs", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agents whose goals can be hijacked and execute autonomously are an Art. 14 failure — human confirmation required before goal-changing actions" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Operational continuity procedures documented", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Post-market monitoring and incident response for availability failures required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Organisations deploying AI are responsible for AI used within their operations", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Data governance policy covering the full AI data lifecycle is an Art. 10 compliance requirement" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Output handling risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Insecure output handling included in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering AI infrastructure components", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Anonymisation effectiveness is an Art. 10 data governance requirement, not a self-certification" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vector store security monitoring in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering availability and resilience", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Session isolation controls are an Art. 10 data governance obligation for multi-user deployments" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering code execution incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Code execution anomaly response in quality management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering context window exploitation incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement" + }, { "id": "DSGAI15", "name": "Over-Broad Context Windows", @@ -9730,207 +8482,130 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Context window security in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering rogue agent detection", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Behavioural monitoring in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering security incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Model extraction detection in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring detecting and responding to session bleed incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Cross-session leakage detection in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring for memory integrity", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory anomaly detection in post-market monitoring programme" + "notes": "RAG corpus integrity controls and source verification are Art. 10 requirements" } ] }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring required — but the monitoring infrastructure must itself be secured", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 13", + "control_name": "Transparency", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Providers document obligations flowing to deployers; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Disclosure of potential data disclosure risks is a transparency obligation" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool data exchange obligations explicitly distributed along the value chain" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Providers document obligations; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Hallucination rates and accuracy limitations must be disclosed to deployers and users" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool and MCP server supply chain obligations distributed along value chain" + "notes": "Agents must clearly communicate their AI nature and advisory limitations" } ] }, { "framework": "EU AI Act", - "control_id": "Providers of high-risk AI must implement a risk management system covering all reasonably foreseeable risks", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 14", + "control_name": "Human oversight", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Providers of systemic risk GPAI models must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI", - "entries": [ + "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Quality management includes supply chain controls", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Agents whose goals can be hijacked and execute autonomously are an Art. 14 failure — human confirmation required before goal-changing actions" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Documented supply chain security procedures — component verification, change management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Quality management must cover supply chain controls", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Documented supply chain security procedures required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Responsibilities distributed along the AI value chain between providers and deployers", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Providers must document what deployers inherit — deployers must verify" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Rogue agent scenarios identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness" + }, { "id": "ASI10", "name": "Rogue Agents", @@ -9938,136 +8613,78 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Shadow AI usage is a foreseeable risk requiring mitigation in the risk management system", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Supply chain risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope" + "notes": "Users must be able to pause and override endpoint AI agents — Art. 14 human oversight requirement" } ] }, { "framework": "EU AI Act", - "control_id": "Supply chain risks must be identified and mitigated in the risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Third-party component risks are in scope for Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must assess and mitigate risks including disinformation", - "control_name": "Art. 55(1)(a) — Systemic risk GPAI", - "entries": [ + "notes": "Robustness against prompt injection is a technical compliance requirement — not optional" + }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Misinformation risk assessment and mitigation is a binding obligation for systemic risk models" + "notes": "Technical robustness against poisoning is a binding Art. 15 requirement" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Disinformation risk assessment and RAG integrity controls are binding Art. 55 obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", - "entries": [ - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify model-level risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", - "entries": [ + "notes": "Technical resilience against denial-of-service attacks is an Art. 15 requirement" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Poisoning detection is in scope for Art. 55 adversarial testing" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical documentation covers all input modalities processed by the model", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ + "notes": "Embedding manipulation resistance is an Art. 15 technical requirement" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Multimodal data governance documented in GPAI technical documentation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + "notes": "Output validation and sanitisation are Art. 15 technical requirements" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -10076,14 +8693,34 @@ "tier": "Foundational", "scope": "Both", "notes": "Input filtering, goal-state verification, and injection detection are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial memory manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -10092,14 +8729,16 @@ "tier": "Hardening", "scope": "Both", "notes": "Memory integrity monitoring and access controls are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against cascading failures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems" + }, { "id": "ASI08", "name": "Cascading Agent Failures", @@ -10108,237 +8747,139 @@ "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers, fail-safe defaults, and cascade containment architecture are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against rogue agent behaviour", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial code execution", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Embedding manipulation resistance is an Art. 15 technical requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Third-party tool data exchange risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All tool integrations assessed in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Tool misuse risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Short-lived credentials, NHI inventory, and access controls are Art. 15 requirements" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training and retrieval data free from errors — source integrity required", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "RAG corpus integrity controls and source verification are Art. 10 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data for high-risk AI must be relevant, representative, free of errors, and complete — must address privacy", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data governance includes human annotation workflows", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Session isolation and tenant separation are Art. 15 technical requirements" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be relevant, representative, and subject to appropriate privacy measures", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate data governance — privacy measures must be effective", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Anonymisation effectiveness is an Art. 10 data governance requirement, not a self-certification" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Data quality controls preventing poisoning are a compliance requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be subject to governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data privacy measures required — protecting sensitive data used in training", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Users informed of capabilities, limitations, and AI nature", - "control_name": "Art. 13 — Transparency", - "entries": [ + "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agents must clearly communicate their AI nature and advisory limitations" + "notes": "Source trust scoring and ingestion validation are Art. 15 robustness requirements" } ] }, { "framework": "EU AI Act", - "control_id": "Users must receive information about capabilities, limitations, and conditions of use", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 17", + "control_name": "Quality management", "entries": [ { "id": "LLM02", @@ -10347,47 +8888,26 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Disclosure of potential data disclosure risks is a transparency obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Users must receive sufficient information about the AI system — but this does not require disclosing system prompts", - "control_name": "Art. 13 — Transparency", - "entries": [ + "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Vector store security risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Documented supply chain security procedures required" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All vector store deployments assessed in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-I-C1-M1.1", - "control_name": "Drawing up and maintaining model documentation", - "entries": [ + "notes": "Post-market monitoring and incident response for availability failures required" + }, { "id": "LLM08", "name": "Hidden Context Exposure", @@ -10395,23 +8915,25 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-I-C1-M1.2", - "control_name": "Providing information to downstream providers and AI Office", - "entries": [ + "notes": "System prompt versions, access controls, and change procedures are quality management artefacts" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Post-market monitoring of output handling incidents required" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment" }, { "id": "ASI04", @@ -10420,50 +8942,52 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Documented supply chain security procedures — component verification, change management" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Code execution anomaly response in quality management system" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-I-C1-M1.3", - "control_name": "Quality, integrity, and security of information", - "entries": [ + "notes": "Memory anomaly detection in post-market monitoring programme" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "A2A authentication and encryption documented in quality management system" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Behavioural monitoring in post-market monitoring programme" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent identity governance procedures documented in quality management system" }, { "id": "DSGAI05", @@ -10472,15 +8996,8 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-II-C1-M1.1", - "control_name": "Copyright policy", - "entries": [ + "notes": "Ingestion validation procedures and CVE patching documented in quality management" + }, { "id": "DSGAI07", "name": "Data Governance and Lifecycle", @@ -10488,80 +9005,86 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data lifecycle procedures — classification, retention, deletion — documented in quality management" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-II-C1-M1.2", - "control_name": "Lawful access to copyright-protected content", - "entries": [ + "notes": "Absence of a quality management system is an Art. 17 violation" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Cross-session leakage detection in post-market monitoring programme" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Security testing procedures and query log retention documented in quality management" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-II-C1-M1.4", - "control_name": "Copyright-infringing output mitigation", - "entries": [ + "notes": "Vector store security monitoring in post-market monitoring programme" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.1", - "control_name": "Creating the safety and security framework", - "entries": [ + "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Context window security in post-market monitoring programme" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Model extraction detection in post-market monitoring programme" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.2", - "control_name": "Implementing the framework", + "framework": "EU AI Act", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "entries": [ { "id": "LLM04", @@ -10570,7 +9093,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Providers must document what deployers inherit — deployers must verify" }, { "id": "ASI04", @@ -10579,16 +9102,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent tool and MCP server supply chain obligations distributed along value chain" }, { "id": "DSGAI03", @@ -10597,98 +9111,66 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Tool data exchange obligations explicitly distributed along the value chain" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.3", - "control_name": "Updating the framework", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.4", - "control_name": "Framework notifications to AI Office", + "framework": "EU AI Act", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C10-M10.1", - "control_name": "Implementation documentation", - "entries": [ + "notes": "Deployers cannot waive Art. 14 human oversight requirements" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Deployers responsible for ensuring endpoint AI agents operate within Art. 14 human oversight scope" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C10-M10.2", - "control_name": "Public transparency", + "framework": "EU AI Act", + "control_id": "Art. 50", + "control_name": "Transparency for certain AI systems", "entries": [ { "id": "LLM07", @@ -10697,7 +9179,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Mandatory AI disclosure prevents users from treating hallucinated content as authoritative human output" }, { "id": "ASI09", @@ -10706,206 +9188,193 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All agent-user interactions require AI disclosure — universal obligation" }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Disinformation risk amplified when users cannot distinguish AI-generated content — Art. 50 applies" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C2-M2.1", - "control_name": "Systemic risk identification process", + "framework": "EU AI Act", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Third-party training data provenance is a GPAI documentation obligation" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Tool and plugin data exchange documented in GPAI technical documentation" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Full data governance documentation for GPAI training data is a binding Art. 53 obligation" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Multimodal data governance documented in GPAI technical documentation" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Synthetic data generation methodology and re-identification risk assessment documented for GPAI" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C2-M2.2", - "control_name": "Systemic risk scenarios", + "framework": "EU AI Act", + "control_id": "Art. 53(1)(b)", + "control_name": "GPAI transparency", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, + "notes": "Published summaries must not inadvertently expose security-sensitive configuration" + } + ] + }, + { + "framework": "EU AI Act", + "control_id": "Art. 55(1)(a)", + "control_name": "Systemic risk GPAI", + "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Misinformation risk assessment and mitigation is a binding obligation for systemic risk models" }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Disinformation risk assessment and RAG integrity controls are binding Art. 55 obligations" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.1", - "control_name": "Model-independent information gathering", + "framework": "EU AI Act", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Poisoning detection is in scope for Art. 55 adversarial testing" }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" - }, + "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models" + } + ] + }, + { + "framework": "EU AI Act", + "control_id": "Art. 72", + "control_name": "Fines", + "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Understanding fine exposure is the starting point for compliance prioritisation" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.2", - "control_name": "Model evaluations", + "framework": "EU AI Act", + "control_id": "Art. 9", + "control_name": "Risk management", "entries": [ { "id": "LLM01", @@ -10914,69 +9383,62 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Excessive agency scenarios required in risk management system" }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Third-party component risks are in scope for Art. 9 risk management" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Poisoning attack scenarios required in Art. 9 risk assessment" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Resource exhaustion and DoS scenarios included in risk management system" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Vector store attack scenarios included in risk management system" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.3", - "control_name": "Systemic risk modelling", - "entries": [ + "notes": "Insecure output handling included in risk management system" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -10984,109 +9446,52 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent goal hijack included in Art. 9 risk assessment for every agentic deployment" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.4", - "control_name": "Systemic risk estimation", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.5", - "control_name": "Post-market monitoring and external evaluation", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C4-M4.1", - "control_name": "Risk acceptance criteria and tiers", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status" }, { "id": "ASI08", @@ -11095,102 +9500,61 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C4-M4.2", - "control_name": "Market placement decisions", - "entries": [ + "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds" + }, { "id": "ASI10", "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C5-M5.1", - "control_name": "Safety mitigation implementation", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent credential lifecycle included in Art. 9 risk management system" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data ingestion attack surfaces included in Art. 9 risk management" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All tool integrations assessed in Art. 9 risk management" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Absence of a documented risk management system is an Art. 9 violation" }, { "id": "DSGAI12", @@ -11199,63 +9563,70 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All vector store deployments assessed in Art. 9 risk management" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Browser and endpoint agent deployments assessed in Art. 9 risk management" } ] }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C6-M6.1", - "control_name": "Security goal and threat actor definition", + "control_id": "CoP-I-C1-M1.1", + "control_name": "Drawing up and maintaining model documentation", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-I-C1-M1.2", + "control_name": "Providing information to downstream providers and AI Office", + "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11263,8 +9634,8 @@ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11275,8 +9646,8 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C6-M6.2", - "control_name": "Security mitigation implementation", + "control_id": "CoP-I-C1-M1.3", + "control_name": "Quality, integrity, and security of information", "entries": [ { "id": "LLM02", @@ -11297,80 +9668,90 @@ "notes": "DRAFT — SME review required" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-II-C1-M1.1", + "control_name": "Copyright policy", + "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-II-C1-M1.2", + "control_name": "Lawful access to copyright-protected content", + "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-II-C1-M1.4", + "control_name": "Copyright-infringing output mitigation", + "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C1-M1.1", + "control_name": "Creating the safety and security framework", + "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11381,12 +9762,12 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.1", - "control_name": "Model description and behaviour documentation", + "control_id": "CoP-III-C1-M1.2", + "control_name": "Implementing the framework", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", @@ -11394,26 +9775,35 @@ "notes": "DRAFT — SME review required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11421,8 +9811,8 @@ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11430,8 +9820,8 @@ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11442,14 +9832,14 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.2", - "control_name": "Risk justification for market placement", + "control_id": "CoP-III-C1-M1.3", + "control_name": "Updating the framework", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" @@ -11458,23 +9848,30 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.3", - "control_name": "Systemic risk documentation", + "control_id": "CoP-III-C1-M1.4", + "control_name": "Framework notifications to AI Office", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C10-M10.1", + "control_name": "Implementation documentation", + "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" @@ -11492,21 +9889,21 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.5", - "control_name": "Material changes to risk landscape", + "control_id": "CoP-III-C10-M10.2", + "control_name": "Public transparency", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", @@ -11514,10 +9911,10 @@ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" @@ -11526,81 +9923,67 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C8-M8.1", - "control_name": "Clear responsibility definition", + "control_id": "CoP-III-C2-M2.1", + "control_name": "Systemic risk identification process", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C8-M8.2", - "control_name": "Resource allocation", - "entries": [ + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C8-M8.3", - "control_name": "Organizational risk culture", - "entries": [ + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", @@ -11610,48 +9993,30 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C9-M9.1", - "control_name": "Incident tracking and documentation", + "control_id": "CoP-III-C2-M2.2", + "control_name": "Systemic risk scenarios", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11659,8 +10024,8 @@ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11668,8 +10033,8 @@ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11680,94 +10045,87 @@ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C9-M9.2", - "control_name": "Incident reporting to authorities", + "control_id": "CoP-III-C3-M3.1", + "control_name": "Model-independent information gathering", "entries": [ { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C9-M9.3", - "control_name": "Corrective actions", - "entries": [ + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AC-3", - "control_name": "Access Enforcement — model endpoint access", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.2", + "control_name": "Model evaluations", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce role-based access control on model inference endpoints; restrict access to training data, fine-tuning data, and model configuration based on clearance and need-to-know" - }, - { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce access control on all AI tool invocations; require authorisation for each tool call based on agent identity, context, and action type" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Restrict access to system prompt configurations to authorised personnel; enforce role-based access control and change management on all prompt modifications" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Enforce role-based access control on vector database operations; restrict who can read, write, and delete embeddings" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "LLM10", @@ -11776,7 +10134,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce least-privilege service accounts on every consumer of model output so unvalidated content cannot reach a high-privilege operation" + "notes": "DRAFT — SME review required" }, { "id": "ASI02", @@ -11784,114 +10142,144 @@ "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce role-based access control on all agent resources — tools, data stores, APIs, and inter-agent communication channels; deny by default" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Enforce access control at every tool invocation boundary; validate agent identity and authorisation for each requested action regardless of calling context" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce access control at each tool invocation independently; re-evaluate authorisation at every step in a tool chain regardless of prior approvals" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce authenticated, authorised access to all AI data stores; deny unauthenticated access; log all access decisions" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access control preventing data transfer to unauthorised AI tools; monitor and block shadow AI usage" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.3", + "control_name": "Systemic risk modelling", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce role-based access control on all AI data stores; restrict access based on clearance, need-to-know, and data sensitivity" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce strict access control on AI intellectual property; restrict to minimum necessary personnel with audit trail" - }, + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.4", + "control_name": "Systemic risk estimation", + "entries": [ { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access controls aligned with data ownership; restrict usage based on ownership rights and licence terms" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce purpose-limitation on AI data access; restrict usage to approved purposes documented in data processing agreements" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.5", + "control_name": "Post-market monitoring and external evaluation", + "entries": [ + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access controls aligned with consent status; block AI processing on data where consent has been withdrawn" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access controls that account for inference and aggregation risk; restrict access based on combined sensitivity" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Implement access controls mandated by applicable data laws; enforce data subject rights, purpose limitation, and processing restrictions" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AC-6", - "control_name": "Least Privilege — AI agent permissions", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C4-M4.1", + "control_name": "Risk acceptance criteria and tiers", "entries": [ { "id": "LLM03", @@ -11899,103 +10287,58 @@ "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce least privilege for all AI agent tool access, API permissions, and autonomous action scope; restrict to minimum capabilities needed per deployment" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Enforce least privilege for all agent permissions; restrict tool access, data store access, and API scope to minimum necessary per agent role" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Enforce least privilege with explicit privilege ceilings per agent; prevent accumulation of permissions through tool chaining or inter-agent delegation" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Enforce least privilege across tool chains; prevent agents from combining tool invocations that individually are safe but together achieve harmful outcomes" - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Restrict data aggregation scope to minimum necessary; enforce controls preventing combination of datasets that create higher-sensitivity aggregates" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Restrict AI data collection to minimum necessary for stated purpose; enforce at pipeline ingestion points" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AU-12", - "control_name": "Audit Generation — inference audit trail", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C4-M4.2", + "control_name": "Market placement decisions", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Generate audit records for all model inference requests with sufficient detail for compliance and incident investigation" - }, - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Generate audit records for all access to AI intellectual property; enable detection of unauthorised access and exfiltration" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AU-2", - "control_name": "Event Logging — AI inference logging", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C5-M5.1", + "control_name": "Safety mitigation implementation", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log all model inference requests and responses with sufficient detail to detect sensitive data disclosure; include user identity, query content, and response metadata" + "notes": "DRAFT — SME review required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Log inference interactions with sufficient detail to detect system prompt extraction attempts; alert on query patterns indicative of extraction techniques" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "LLM10", @@ -12004,7 +10347,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Log model output crossing into privileged systems, including the payload, the consuming component, and the validation verdict, for incident reconstruction" + "notes": "DRAFT — SME review required" }, { "id": "ASI01", @@ -12013,70 +10356,43 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log all agent actions, goal interpretations, tool invocations, and decision points with sufficient detail to detect goal hijacking in post-incident analysis" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Log all agent access decisions — permitted and denied — with sufficient detail for access control review and incident investigation" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Log all agent memory operations — reads, writes, deletions — with sufficient detail to detect poisoning and support forensic investigation" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Log complete tool chain sequences with full context; enable detection and forensic analysis of harmful tool combination patterns" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log all access to AI training data, model weights, inference inputs and outputs, and configuration; include user/service identity, timestamp, and access type" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log data movement through AI pipelines — ingestion, transformation, training, inference; enable end-to-end data flow traceability" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Log all data transformation events in AI pipelines; enable end-to-end lineage reconstruction from source to model" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Log AI data access and model outputs with sufficient detail to detect data leakage; include output content metadata" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI12", @@ -12085,25 +10401,16 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log data usage for ownership compliance; track how data is used across AI systems for licence and rights management" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Log all data operations with purpose context; enable detection of purpose drift and unauthorised usage" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Log consent status and changes; enable audit of consent compliance for all AI data processing activities" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI21", @@ -12112,143 +10419,129 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Maintain comprehensive logs for regulatory compliance evidence; ensure audit trails meet requirements of applicable data laws" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AU-6", - "control_name": "Audit Review — AI behaviour review", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C6-M6.1", + "control_name": "Security goal and threat actor definition", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Regularly review AI inference logs and output samples for hallucination patterns, factual errors, and misleading content; escalate findings through security channels" + "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Conduct regular audit review of agent decision logs; identify patterns indicative of unexpected capabilities or emergent behaviours requiring security assessment" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "CA-7", - "control_name": "Continuous Monitoring — model drift detection", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include model output quality and drift monitoring in FedRAMP continuous monitoring programme; track accuracy metrics, hallucination rates, and output consistency over time" + "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include monitoring for novel agentic behaviour patterns in FedRAMP continuous monitoring; track for unexpected capabilities, emergent behaviours, and architectural drift" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include synthetic data quality metrics in continuous monitoring; track for privacy degradation and bias drift" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include bias and fairness metrics in continuous monitoring; track output equity over time" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "CA-8", - "control_name": "Penetration Testing — AI adversarial testing", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C6-M6.2", + "control_name": "Security mitigation implementation", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include prompt injection scenarios in penetration testing engagements; cover direct, indirect, and multimodal injection paths" + "notes": "DRAFT — SME review required" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include agent goal hijacking in penetration testing scope; cover injection through all input channels — user prompts, tool outputs, memory stores, and inter-agent communication" + "notes": "DRAFT — SME review required" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include agent code execution sandbox escape in penetration testing scope; test boundary integrity under adversarial conditions" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "CM-3", - "control_name": "Configuration Change Control — model update governance", - "entries": [ + "notes": "DRAFT — SME review required" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Require formal change control for all model updates, fine-tuning runs, and training data changes; maintain audit trail of all modifications" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Document and control changes to AI data pipeline configurations; maintain current data flow diagrams and processing documentation" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Require formal change control for all data source additions, modifications, and removals; maintain audit trail" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI06", @@ -12256,8 +10549,8 @@ "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Maintain comprehensive data lineage documentation for all AI pipelines; update on every transformation, combination, or processing change" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "DSGAI11", @@ -12266,16 +10559,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Define and enforce data retention policies for all AI data; implement automated deletion schedules; log policy changes" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Maintain AI governance policies under change control; require approval for policy modifications; audit all changes" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI20", @@ -12284,77 +10577,59 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Maintain documentation of AI data storage locations; require change control for data location modifications" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "CM-7", - "control_name": "Least Functionality — AI capability restrictions", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.1", + "control_name": "Model description and behaviour documentation", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Restrict AI systems to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in configuration" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrict AI services to defined resource budgets; disable unnecessary model capabilities; enforce compute and cost limits in configuration" + "notes": "DRAFT — SME review required" }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Remove interpreter, shell, and dynamic-evaluation paths from components that consume model output; disable any capability the consumer does not require" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Restrict agents to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in agent configuration" + "notes": "DRAFT — SME review required" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrict agent code execution to minimum necessary scope; enforce sandbox boundaries, disable unnecessary language features, and limit filesystem and network access" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Restrict permitted tool combinations; define allowed tool chains in configuration and deny undefined sequences" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrict AI tool usage to approved, vetted tools within the FedRAMP boundary; disable or block access to unauthorised AI services" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI15", @@ -12362,137 +10637,49 @@ "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Restrict AI data processing to minimum necessary scope; disable collection of non-essential data fields" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "IA-2", - "control_name": "Identification and Authentication — agent NHI", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Assign unique non-human identities to each AI agent; authenticate agent identity at each tool invocation and inter-agent communication boundary" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "IR-4", - "control_name": "Incident Handling — consumption incident response", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.2", + "control_name": "Risk justification for market placement", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Define incident handling procedures for AI consumption anomalies including automatic throttling, service suspension, and cost cap enforcement" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Define incident handling procedures for agent privilege escalation events; include automated containment, privilege revocation, and forensic investigation" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Define incident handling procedures for cascading agent failures; include automated circuit breakers, agent isolation, and multi-agent system shutdown procedures" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Define incident handling procedures for agent dependency failures; include automated fallback activation, graceful degradation, and service restoration" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "PM-9", - "control_name": "Risk Management Strategy — AI autonomy risk", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.3", + "control_name": "Systemic risk documentation", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Include AI autonomy and excessive agency in the organisational risk management strategy; define acceptable autonomy thresholds and escalation procedures" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Include cascading automation risk in the organisational risk management strategy; define acceptable multi-agent coupling thresholds and circuit breaker requirements" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data visibility and transparency requirements in AI risk management strategy; define what data flows must be documented and monitored" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Include data lineage completeness in AI risk management strategy; define minimum lineage requirements per data sensitivity level" - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data aggregation risk in AI risk management strategy; assess combined sensitivity of aggregated datasets" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include data retention risk in AI risk management; define retention periods per data type and regulatory requirement" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Define data ownership policies for AI data; clarify rights and responsibilities for training data, outputs, and derived insights" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI14", @@ -12501,129 +10688,186 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include consent management in AI risk management strategy; define consent requirements per data type and processing activity" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.5", + "control_name": "Material changes to risk landscape", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include data minimisation in AI risk management; define minimum necessary data per AI use case" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include AI privacy erosion in risk management; assess inference, aggregation, and memorisation risks for AI systems" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C8-M8.1", + "control_name": "Clear responsibility definition", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Establish comprehensive AI data governance framework within risk management strategy; define roles, policies, and oversight mechanisms" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include data localisation in AI risk management; define data residency requirements per jurisdiction and data type" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Include regulatory compliance in AI risk management; map applicable data laws to AI processing activities and define compliance requirements" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "RA-3", - "control_name": "Risk Assessment — governance completeness", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C8-M8.2", + "control_name": "Resource allocation", "entries": [ { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Assess AI governance completeness; identify gaps in roles, policies, oversight, and accountability" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C8-M8.3", + "control_name": "Organizational risk culture", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Conduct regulatory compliance gap analysis for AI systems; identify areas of non-compliance and define remediation plans" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "RA-5", - "control_name": "Vulnerability Scanning — AI red-teaming", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C9-M9.1", + "control_name": "Incident tracking and documentation", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include prompt injection vectors in vulnerability scanning programme; conduct regular automated and manual injection testing" + "notes": "DRAFT — SME review required" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include vector databases, embedding pipelines, and retrieval infrastructure in vulnerability scanning; test for injection, access control bypass, and data extraction" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include agent memory stores, context databases, and shared state infrastructure in vulnerability scanning and security assessment" + "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include emerging agentic attack surfaces in vulnerability scanning; assess novel architectures for security implications before production deployment" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include synthetic data re-identification and pattern leakage in vulnerability assessment" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "DSGAI17", @@ -12632,91 +10876,64 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include bias detection and fairness assessment in vulnerability scanning; test for disparate impact" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "SA-3", - "control_name": "System Development Life Cycle — AI SDLC", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C9-M9.2", + "control_name": "Incident reporting to authorities", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Integrate AI-specific security activities into the SDLC — model security review, adversarial testing, supply chain verification at each lifecycle phase" + "notes": "DRAFT — SME review required" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrate agent-specific security activities into the SDLC — tool integration review, privilege analysis, and adversarial testing at each lifecycle phase" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "SA-9", - "control_name": "External Information System Services — third-party AI", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C9-M9.3", + "control_name": "Corrective actions", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Require third-party AI service providers to meet FedRAMP requirements; establish SLAs covering model security, data handling, and incident notification" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Require third-party agent tool and plugin providers to meet FedRAMP requirements; establish SLAs for security, availability, and incident notification" - }, - { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Require SLAs from agent dependency providers covering availability, performance, security, and incident notification; establish fallback procedures" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Require FedRAMP authorisation or equivalent for all third-party AI services; block data transfer to unauthorised AI tools" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Require FedRAMP authorisation for third-party data service providers; establish SLAs covering data security, privacy, and incident notification" + "notes": "DRAFT — SME review required" } ] }, { "framework": "FedRAMP", - "control_id": "SC-28", - "control_name": "Protection of Information at Rest — training data and model weights", + "control_id": "AC-3", + "control_name": "Access Enforcement — model endpoint access", "entries": [ { "id": "LLM02", @@ -12725,7 +10942,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt training data, fine-tuning datasets, and model weights at rest; prevent data memorisation exposure through access controls on data stores" + "notes": "Enforce role-based access control on model inference endpoints; restrict access to training data, fine-tuning data, and model configuration based on clearance and need-to-know" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Enforce access control on all AI tool invocations; require authorisation for each tool call based on agent identity, context, and action type" }, { "id": "LLM08", @@ -12734,7 +10960,7 @@ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Classify system prompts as sensitive configuration; encrypt at rest, enforce access controls, and apply version control and audit logging to all prompt stores" + "notes": "Restrict access to system prompt configurations to authorised personnel; enforce role-based access control and change management on all prompt modifications" }, { "id": "LLM09", @@ -12743,267 +10969,217 @@ "severity": "Medium", "tier": "Foundational", "scope": "Build", - "notes": "Encrypt vector databases and embedding stores at rest; enforce access controls and audit logging on all embedding read and write operations" + "notes": "Enforce role-based access control on vector database operations; restrict who can read, write, and delete embeddings" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt agent memory stores and context databases at rest; enforce access controls and integrity verification on all memory read and write operations" + "notes": "Enforce least-privilege service accounts on every consumer of model output so unvalidated content cannot reach a high-privilege operation" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Encrypt all training data, model weights, and pipeline artefacts at rest; enforce key management per FedRAMP requirements" + "scope": "Build", + "notes": "Enforce role-based access control on all agent resources — tools, data stores, APIs, and inter-agent communication channels; deny by default" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt all AI data at rest — training data, model weights, inference logs, embedding stores — using FIPS 140-validated modules" + "notes": "Enforce access control at every tool invocation boundary; validate agent identity and authorisation for each requested action regardless of calling context" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Encrypt all intellectual property — model weights, proprietary training data, algorithms — at rest with FIPS 140-validated modules" + "scope": "Build", + "notes": "Enforce access control at each tool invocation independently; re-evaluate authorisation at every step in a tool chain regardless of prior approvals" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt all retained AI data; implement crypto-shredding capability for secure deletion" + "notes": "Enforce authenticated, authorised access to all AI data stores; deny unauthenticated access; log all access decisions" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt AI data at rest; implement privacy-preserving storage techniques to prevent inference and re-identification" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "SC-7", - "control_name": "Boundary Protection — rate limiting and cost controls", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce rate limiting, token quotas, and cost circuit breakers at the AI service boundary; define per-user and per-session consumption limits" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce strict boundary protection on agent code execution environments; isolate from production systems, restrict network access, and enforce resource limits" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce boundary protection between agents in multi-agent systems; prevent uncontrolled propagation of failures or attacks across agent boundaries" + "notes": "Enforce access control preventing data transfer to unauthorised AI tools; monitor and block shadow AI usage" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce boundary protection on data flows between systems; prevent uncontrolled data aggregation across security boundaries" + "notes": "Enforce role-based access control on all AI data stores; restrict access based on clearance, need-to-know, and data sensitivity" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce data flow controls preventing AI data from crossing jurisdictional boundaries; restrict to approved data centres and regions" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "SI-10", - "control_name": "Information Input Validation — prompt validation", - "entries": [ + "notes": "Enforce strict access control on AI intellectual property; restrict to minimum necessary personnel with audit trail" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Validate all inputs to LLM inference endpoints; enforce structural separation between instruction and data contexts; reject known injection patterns" + "notes": "Enforce access controls aligned with data ownership; restrict usage based on ownership rights and licence terms" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate retrieval sources and grounding data provided to the model; ensure factual grounding sources are authoritative and current" + "notes": "Enforce purpose-limitation on AI data access; restrict usage to approved purposes documented in data processing agreements" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate model output at every consuming boundary; the consumer treats generated content as untrusted input and applies syntactic and schema validation before acting on it" + "notes": "Enforce access controls aligned with consent status; block AI processing on data where consent has been withdrawn" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate all inputs to agent systems including user prompts, tool outputs, memory retrievals, and inter-agent messages; enforce structural separation of instructions and data" + "notes": "Enforce access controls that account for inference and aggregation risk; restrict access based on combined sensitivity" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate quality, completeness, and accuracy of data entering AI pipelines; reject data failing quality thresholds" + "notes": "Implement access controls mandated by applicable data laws; enforce data subject rights, purpose limitation, and processing restrictions" } ] }, { "framework": "FedRAMP", - "control_id": "SI-15", - "control_name": "Information Output Filtering — model response filtering", + "control_id": "AC-6", + "control_name": "Least Privilege — AI agent permissions", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Filter and encode model responses before release to a renderer, interpreter, or downstream service; reject content that fails the boundary content-type policy" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "SI-3", - "control_name": "Malicious Code Protection — adversarial AI inputs", - "entries": [ + "scope": "Build", + "notes": "Enforce least privilege for all AI agent tool access, API permissions, and autonomous action scope; restrict to minimum capabilities needed per deployment" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Extend malicious code protection to detect and block adversarial inputs including direct and indirect prompt injection payloads" + "scope": "Build", + "notes": "Enforce least privilege for all agent permissions; restrict tool access, data store access, and API scope to minimum necessary per agent role" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious code protection to training data pipelines; detect and block poisoned data, anomalous labels, and backdoor triggers" + "notes": "Enforce least privilege with explicit privilege ceilings per agent; prevent accumulation of permissions through tool chaining or inter-agent delegation" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Deploy output monitoring to detect and block responses containing system prompt content; treat extraction as a security event" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Extend malicious code protection to detect adversarial manipulation of embeddings — poisoned vectors, out-of-distribution injections, and embedding inversion attacks" + "notes": "Enforce least privilege across tool chains; prevent agents from combining tool invocations that individually are safe but together achieve harmful outcomes" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious code protection to detect and block adversarial inputs targeting agent goal manipulation including injection through tool outputs and context stores" + "notes": "Restrict data aggregation scope to minimum necessary; enforce controls preventing combination of datasets that create higher-sensitivity aggregates" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Scan agent-generated code for malicious patterns before execution; detect and block code that attempts filesystem access, network communication, or privilege escalation" - }, + "scope": "Build", + "notes": "Restrict AI data collection to minimum necessary for stated purpose; enforce at pipeline ingestion points" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "AU-12", + "control_name": "Audit Generation — inference audit trail", + "entries": [ { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious content detection to agent memory stores; detect poisoned memories, manipulated context, and adversarial state modifications" + "notes": "Generate audit records for all model inference requests with sufficient detail for compliance and incident investigation" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious code protection to training data and model artefacts; detect poisoned data, anomalous patterns, and backdoor indicators" + "notes": "Generate audit records for all access to AI intellectual property; enable detection of unauthorised access and exfiltration" } ] }, { "framework": "FedRAMP", - "control_id": "SI-4", - "control_name": "System Monitoring — output content monitoring", + "control_id": "AU-2", + "control_name": "Event Logging — AI inference logging", "entries": [ { "id": "LLM02", @@ -13012,52 +11188,88 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor model outputs for sensitive data patterns — PII, credentials, classification markings — and alert on detection" + "notes": "Log all model inference requests and responses with sufficient detail to detect sensitive data disclosure; include user identity, query content, and response metadata" }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Monitor AI service consumption metrics — tokens, latency, cost — in real time; alert and auto-mitigate on consumption anomalies" + "scope": "Build", + "notes": "Log inference interactions with sufficient detail to detect system prompt extraction attempts; alert on query patterns indicative of extraction techniques" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor model outputs for factual accuracy, consistency, and hallucination indicators; alert when confidence scores or factual grounding drops below thresholds" + "notes": "Log model output crossing into privileged systems, including the payload, the consuming component, and the validation verdict, for incident reconstruction" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Monitor multi-agent systems for cascade indicators — error propagation, resource exhaustion spreading, and anomalous inter-agent communication patterns" + "notes": "Log all agent actions, goal interpretations, tool invocations, and decision points with sufficient detail to detect goal hijacking in post-incident analysis" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Log all agent access decisions — permitted and denied — with sufficient detail for access control review and incident investigation" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor agent systems for unexpected behaviour — novel tool use patterns, unanticipated goal decomposition, and emergent inter-agent coordination" + "notes": "Log all agent memory operations — reads, writes, deletions — with sufficient detail to detect poisoning and support forensic investigation" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Log complete tool chain sequences with full context; enable detection and forensic analysis of harmful tool combination patterns" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures" + "notes": "Log all access to AI training data, model weights, inference inputs and outputs, and configuration; include user/service identity, timestamp, and access type" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Log data movement through AI pipelines — ingestion, transformation, training, inference; enable end-to-end data flow traceability" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Log all data transformation events in AI pipelines; enable end-to-end lineage reconstruction from source to model" }, { "id": "DSGAI08", @@ -13066,16 +11278,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor model outputs and data access patterns for leakage indicators — PII, credentials, classification markings in outputs; alert on detection" + "notes": "Log AI data access and model outputs with sufficient detail to detect data leakage; include output content metadata" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Monitor synthetic data outputs for quality, privacy preservation, and absence of sensitive pattern leakage" + "scope": "Both", + "notes": "Log data usage for ownership compliance; track how data is used across AI systems for licence and rights management" }, { "id": "DSGAI13", @@ -13084,129 +11296,152 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor AI data usage patterns for misuse indicators; alert on data access inconsistent with approved purposes" + "notes": "Log all data operations with purpose context; enable detection of purpose drift and unauthorised usage" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor for privacy erosion indicators; detect inference capabilities, re-identification risk, and memorisation patterns" + "notes": "Log consent status and changes; enable audit of consent compliance for all AI data processing activities" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor AI outputs for bias indicators; track fairness metrics across demographic groups and use cases" + "notes": "Maintain comprehensive logs for regulatory compliance evidence; ensure audit trails meet requirements of applicable data laws" } ] }, { "framework": "FedRAMP", - "control_id": "SR-2", - "control_name": "Supply Chain Risk Management Plan — AI components", + "control_id": "AU-6", + "control_name": "Audit Review — AI behaviour review", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include all AI components — models, datasets, adapters, libraries, plugins — in the supply chain risk management plan with provenance and risk assessment" + "notes": "Regularly review AI inference logs and output samples for hallucination patterns, factual errors, and misleading content; escalate findings through security channels" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include AI training data sources, fine-tuning datasets, and pre-trained model weights in the supply chain risk management plan; document provenance and risk assessment for each" - }, + "notes": "Conduct regular audit review of agent decision logs; identify patterns indicative of unexpected capabilities or emergent behaviours requiring security assessment" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "CA-7", + "control_name": "Continuous Monitoring — model drift detection", + "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include all agent components — tools, plugins, MCP servers, model weights, and agent frameworks — in the supply chain risk management plan" + "notes": "Include model output quality and drift monitoring in FedRAMP continuous monitoring programme; track accuracy metrics, hallucination rates, and output consistency over time" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include all agent external dependencies — model APIs, tool endpoints, data sources — in supply chain risk management with availability and integrity requirements" + "notes": "Include monitoring for novel agentic behaviour patterns in FedRAMP continuous monitoring; track for unexpected capabilities, emergent behaviours, and architectural drift" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Include AI training data, model weights, and pipeline artefacts in supply chain risk management with provenance documentation" + "scope": "Build", + "notes": "Include synthetic data quality metrics in continuous monitoring; track for privacy degradation and bias drift" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include third-party data providers in supply chain risk management; assess data handling practices and security posture" + "notes": "Include bias and fairness metrics in continuous monitoring; track output equity over time" } ] }, { "framework": "FedRAMP", - "control_id": "SR-3", - "control_name": "Supply Chain Controls — model provenance verification", + "control_id": "CA-8", + "control_name": "Penetration Testing — AI adversarial testing", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Implement integrity verification for all AI supply chain components using cryptographic signatures, checksums, and attestation before deployment" + "notes": "Include prompt injection scenarios in penetration testing engagements; cover direct, indirect, and multimodal injection paths" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Implement supply chain controls for AI model components — verify integrity, provenance, and authenticity of all training data and model weights before use" + "notes": "Include agent goal hijacking in penetration testing scope; cover injection through all input channels — user prompts, tool outputs, memory stores, and inter-agent communication" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify integrity and provenance of all agent supply chain components using cryptographic signatures, checksums, and attestation before deployment" + "notes": "Include agent code execution sandbox escape in penetration testing scope; test boundary integrity under adversarial conditions" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "CM-3", + "control_name": "Configuration Change Control — model update governance", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Require formal change control for all model updates, fine-tuning runs, and training data changes; maintain audit trail of all modifications" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify integrity and provenance of all AI artefacts using cryptographic signatures and checksums before use in any pipeline" + "notes": "Document and control changes to AI data pipeline configurations; maintain current data flow diagrams and processing documentation" }, { "id": "DSGAI05", @@ -13215,100 +11450,104 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Implement provenance tracking for all AI training data; document source, collection method, processing history, and licensing for each dataset" + "notes": "Require formal change control for all data source additions, modifications, and removals; maintain audit trail" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Maintain comprehensive data lineage documentation for all AI pipelines; update on every transformation, combination, or processing change" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify provenance and integrity of data from third-party sources; implement validation before ingestion into AI pipelines" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "Security management", - "control_name": "62443-2-1", - "entries": [ + "notes": "Define and enforce data retention policies for all AI data; implement automated deletion schedules; log policy changes" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT synthetic data governance policy — when synthetic data removes OT classification obligation" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "Security management system", - "control_name": "62443-2-1", - "entries": [ + "notes": "Maintain AI governance policies under change control; require approval for policy modifications; audit all changes" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT security management system updated to cover GenAI deployments — policy, roles, assessment" + "notes": "Maintain documentation of AI data storage locations; require change control for data location modifications" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.2", - "control_name": "Identification and authentication", + "framework": "FedRAMP", + "control_id": "CM-7", + "control_name": "Least Functionality — AI capability restrictions", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Restrict AI systems to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in configuration" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM access to OT data systems requires authenticated, authorised identity" + "notes": "Restrict AI services to defined resource budgets; disable unnecessary model capabilities; enforce compute and cost limits in configuration" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM actions in OT context authenticated as a distinct identity — traceable in OT audit log" + "notes": "Remove interpreter, shell, and dynamic-evaluation paths from components that consume model output; disable any capability the consumer does not require" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "All agent access to OT systems using distinct, traceable identity — not shared service accounts" + "scope": "Build", + "notes": "Restrict agents to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in agent configuration" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Access to GenAI systems in OT scope authenticated — each user with unique, traceable identity" + "notes": "Restrict agent code execution to minimum necessary scope; enforce sandbox boundaries, disable unnecessary language features, and limit filesystem and network access" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "All agent credentials unique and traceable — no shared service accounts for OT-accessing agents" + "scope": "Build", + "notes": "Restrict permitted tool combinations; define allowed tool chains in configuration and deny undefined sequences" }, { "id": "DSGAI03", @@ -13317,102 +11556,100 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Approved AI tools only on OT workstations — unapproved services blocked at network layer" + "notes": "Restrict AI tool usage to approved, vetted tools within the FedRAMP boundary; disable or block access to unauthorised AI services" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Access controls on all GenAI-derived OT data assets — same authentication requirements as source data" - }, + "scope": "Build", + "notes": "Restrict AI data processing to minimum necessary scope; disable collection of non-essential data fields" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "IA-2", + "control_name": "Identification and Authentication — agent NHI", + "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Per-operator session isolation — each operator's context inaccessible to all other sessions" - }, + "notes": "Assign unique non-human identities to each AI agent; authenticate agent identity at each tool invocation and inter-agent communication boundary" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "IR-4", + "control_name": "Incident Handling — consumption incident response", + "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "RBAC on all Zone 3 vector stores — no unauthenticated access in any OT environment" + "notes": "Define incident handling procedures for AI consumption anomalies including automatic throttling, service suspension, and cost cap enforcement" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Access controls on OT GenAI telemetry stores — need-to-know enforced" + "notes": "Define incident handling procedures for agent privilege escalation events; include automated containment, privilege revocation, and forensic investigation" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Approved extensions only on Zone 3 workstations — unapproved AI extensions blocked at device management" + "notes": "Define incident handling procedures for cascading agent failures; include automated circuit breakers, agent isolation, and multi-agent system shutdown procedures" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Authentication on all OT GenAI model inference APIs — unauthenticated systematic querying blocked" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.3", - "control_name": "Use of authenticators", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "All inter-agent messages authenticated — no ambient trust between agents in OT context" + "notes": "Define incident handling procedures for agent dependency failures; include automated fallback activation, graceful degradation, and service restoration" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.6", - "control_name": "Authenticator feedback", + "framework": "FedRAMP", + "control_id": "PM-9", + "control_name": "Risk Management Strategy — AI autonomy risk", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "LLM interactions logged with user identity — injection attempts attributable to specific sessions" + "scope": "Build", + "notes": "Include AI autonomy and excessive agency in the organisational risk management strategy; define acceptable autonomy thresholds and escalation procedures" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures" + "notes": "Include cascading automation risk in the organisational risk management strategy; define acceptable multi-agent coupling thresholds and circuit breaker requirements" }, { "id": "DSGAI02", @@ -13421,109 +11658,129 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credential lifecycle managed — issuance, rotation, revocation documented per agent" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.9", - "control_name": "Remote session termination", - "entries": [ + "notes": "Include data visibility and transparency requirements in AI risk management strategy; define what data flows must be documented and monitored" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Include data lineage completeness in AI risk management strategy; define minimum lineage requirements per data sensitivity level" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include data aggregation risk in AI risk management strategy; assess combined sensitivity of aggregated datasets" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include data retention risk in AI risk management; define retention periods per data type and regulatory requirement" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ability to terminate LLM sessions immediately on detection of suspicious behaviour" + "notes": "Define data ownership policies for AI data; clarify rights and responsibilities for training data, outputs, and derived insights" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include consent management in AI risk management strategy; define consent requirements per data type and processing activity" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Include data minimisation in AI risk management; define minimum necessary data per AI use case" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include AI privacy erosion in risk management; assess inference, aggregation, and memorisation risks for AI systems" }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM sessions with OT access can be locked and terminated immediately by operators" + "notes": "Establish comprehensive AI data governance framework within risk management strategy; define roles, policies, and oversight mechanisms" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Operator-accessible agent kill switch — halt all agent activity immediately without affecting process control" + "notes": "Include data localisation in AI risk management; define data residency requirements per jurisdiction and data type" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent sessions terminated and credentials revoked immediately on compromise detection" + "notes": "Include regulatory compliance in AI risk management; map applicable data laws to AI processing activities and define compliance requirements" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.1", - "control_name": "Use control enforcement", + "framework": "FedRAMP", + "control_id": "RA-3", + "control_name": "Risk Assessment — governance completeness", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforcement of permitted use of LLM within OT context — out-of-scope requests rejected at the gateway layer" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "All LLM actions in OT context subject to explicit use controls — no autonomous action without human confirmation" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent actions in OT context subject to explicit use controls — goal-changing actions require human confirmation" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Allowlisted tool operations for each agent role — agent cannot invoke tools outside its defined function" + "notes": "Assess AI governance completeness; identify gaps in roles, policies, oversight, and accountability" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "NL gateway query allowlisting — only pre-approved query patterns permitted to OT data systems" + "notes": "Conduct regulatory compliance gap analysis for AI systems; identify areas of non-compliance and define remediation plans" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.2", - "control_name": "Least privilege", + "framework": "FedRAMP", + "control_id": "RA-5", + "control_name": "Vulnerability Scanning — AI red-teaming", "entries": [ { "id": "LLM01", @@ -13532,120 +11789,84 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLMs granted minimum necessary access to OT data — cannot read or write to control systems without explicit scoping" + "notes": "Include prompt injection vectors in vulnerability scanning programme; conduct regular automated and manual injection testing" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLMs granted minimum necessary permissions to OT systems — read-only by default, no autonomous write" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Agents granted minimum tool access — each tool scoped to specific OT function, read-only by default" + "scope": "Build", + "notes": "Include vector databases, embedding pipelines, and retrieval infrastructure in vulnerability scanning; test for injection, access control bypass, and data extraction" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Per-tool minimum permission — setpoint adjustment tool restricted to specific tags and safe ranges" + "notes": "Include agent memory stores, context databases, and shared state infrastructure in vulnerability scanning and security assessment" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials scoped to minimum OT data access required for defined task" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent cannot exceed defined permission scope even if internal goals are compromised" + "notes": "Include emerging agentic attack surfaces in vulnerability scanning; assess novel architectures for security implications before production deployment" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "NL gateway executes under requesting operator's permissions — never shared high-privilege OT service account" + "scope": "Build", + "notes": "Include synthetic data re-identification and pattern leakage in vulnerability assessment" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT context assembly restricted to minimum data required for the specific query — not broad process datasets" + "notes": "Include bias detection and fairness assessment in vulnerability scanning; test for disparate impact" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.3", - "control_name": "Use control", + "framework": "FedRAMP", + "control_id": "SA-3", + "control_name": "System Development Life Cycle — AI SDLC", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM advisory outputs clearly distinguished from authoritative procedural documentation" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM output restricted to authorised actions — no raw output directly to control interfaces" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent code execution restricted to specific, defined operations — no shell access, no network programming" + "notes": "Integrate AI-specific security activities into the SDLC — model security review, adversarial testing, supply chain verification at each lifecycle phase" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM advisory outputs clearly distinguished from authoritative documentation — source always visible" + "notes": "Integrate agent-specific security activities into the SDLC — tool integration review, privilege analysis, and adversarial testing at each lifecycle phase" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.6", - "control_name": "Use control", + "framework": "FedRAMP", + "control_id": "SA-9", + "control_name": "External Information System Services — third-party AI", "entries": [ { "id": "LLM04", @@ -13654,7 +11875,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrictions on software installation — only approved, verified LLM components permitted in OT zones" + "notes": "Require third-party AI service providers to meet FedRAMP requirements; establish SLAs covering model security, data handling, and incident notification" }, { "id": "ASI04", @@ -13663,41 +11884,50 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools" + "notes": "Require third-party agent tool and plugin providers to meet FedRAMP requirements; establish SLAs for security, availability, and incident notification" }, { "id": "ASI10", "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent cannot load additional tools or expand its own capability scope" + "notes": "Require SLAs from agent dependency providers covering availability, performance, security, and incident notification; establish fallback procedures" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked" + "notes": "Require FedRAMP authorisation or equivalent for all third-party AI services; block data transfer to unauthorised AI tools" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Require FedRAMP authorisation for third-party data service providers; establish SLAs covering data security, privacy, and incident notification" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.1", - "control_name": "Software and information integrity", + "framework": "FedRAMP", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest — training data and model weights", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs for safety-relevant guidance cross-validated against authoritative sources" + "notes": "Encrypt training data, fine-tuning datasets, and model weights at rest; prevent data memorisation exposure through access controls on data stores" }, { "id": "LLM08", @@ -13705,103 +11935,130 @@ "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "System prompt integrity protected — unauthorised modification detected" + "scope": "Build", + "notes": "Classify system prompts as sensitive configuration; encrypt at rest, enforce access controls, and apply version control and audit logging to all prompt stores" }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Communication integrity enforcement on all LLM-to-OT data paths" + "scope": "Build", + "notes": "Encrypt vector databases and embedding stores at rest; enforce access controls and audit logging on all embedding read and write operations" }, { "id": "ASI06", "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory baseline established and maintained — deviations from baseline detectable" + "notes": "Encrypt agent memory stores and context databases at rest; enforce access controls and integrity verification on all memory read and write operations" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Encrypt all training data, model weights, and pipeline artefacts at rest; enforce key management per FedRAMP requirements" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "A2A message schema validation — reject malformed or unexpected message structures" + "notes": "Encrypt all AI data at rest — training data, model weights, inference logs, embedding stores — using FIPS 140-validated modules" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent recommendations for safety-relevant decisions cross-validated against independent reference" + "notes": "Encrypt all intellectual property — model weights, proprietary training data, algorithms — at rest with FIPS 140-validated modules" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Encrypt all retained AI data; implement crypto-shredding capability for secure deletion" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Encrypt AI data at rest; implement privacy-preserving storage techniques to prevent inference and re-identification" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.2", - "control_name": "Software and information integrity", + "framework": "FedRAMP", + "control_id": "SC-7", + "control_name": "Boundary Protection — rate limiting and cost controls", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrity verification of all LLM components before deployment in OT environment" + "notes": "Enforce rate limiting, token quotas, and cost circuit breakers at the AI service boundary; define per-user and per-session consumption limits" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Integrity verification of all agent tools and MCP components before OT deployment" + "notes": "Enforce strict boundary protection on agent code execution environments; isolate from production systems, restrict network access, and enforce resource limits" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All OT tool integrations assessed — security requirements in vendor contracts per 62443-2-4" + "notes": "Enforce boundary protection between agents in multi-agent systems; prevent uncontrolled propagation of failures or attacks across agent boundaries" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Browser AI extensions assessed as third-party software — 62443-2-4 requirements before Zone 3 deployment" + "notes": "Enforce boundary protection on data flows between systems; prevent uncontrolled data aggregation across security boundaries" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Labelling vendors with OT data access assessed under 62443-2-4 — same requirements as OT software vendors" + "notes": "Enforce data flow controls preventing AI data from crossing jurisdictional boundaries; restrict to approved data centres and regions" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.3", - "control_name": "Software and information integrity", + "framework": "FedRAMP", + "control_id": "SI-10", + "control_name": "Information Input Validation — prompt validation", "entries": [ { "id": "LLM01", @@ -13810,26 +12067,51 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All inputs to LLMs connected to OT systems validated for integrity — crafted inputs rejected" + "notes": "Validate all inputs to LLM inference endpoints; enforce structural separation between instruction and data contexts; reject known injection patterns" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "LLM model integrity verified before each OT deployment — poisoning detection as integrity control" + "notes": "Validate retrieval sources and grounding data provided to the model; ensure factual grounding sources are authoritative and current" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store ingestion validated — only authorised OT documentation enters the corpus" + "notes": "Validate model output at every consuming boundary; the consumer treats generated content as untrusted input and applies syntactic and schema validation before acting on it" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate all inputs to agent systems including user prompts, tool outputs, memory retrievals, and inter-agent messages; enforce structural separation of instructions and data" }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate quality, completeness, and accuracy of data entering AI pipelines; reject data failing quality thresholds" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SI-15", + "control_name": "Information Output Filtering — model response filtering", + "entries": [ { "id": "LLM10", "name": "Improper Output Handling", @@ -13837,43 +12119,77 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM output validated before rendering or passing to OT systems" + "notes": "Filter and encode model responses before release to a renderer, interpreter, or downstream service; reject content that fails the boundary content-type policy" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SI-3", + "control_name": "Malicious Code Protection — adversarial AI inputs", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Extend malicious code protection to detect and block adversarial inputs including direct and indirect prompt injection payloads" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All inputs to OT agents validated for integrity — no unvalidated external content directly into agent context" + "notes": "Extend malicious code protection to training data pipelines; detect and block poisoned data, anomalous labels, and backdoor triggers" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Deploy output monitoring to detect and block responses containing system prompt content; treat extraction as a security event" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "Extend malicious code protection to detect adversarial manipulation of embeddings — poisoned vectors, out-of-distribution injections, and embedding inversion attacks" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool descriptor integrity verified — poisoned MCP tool descriptors rejected at loading" + "notes": "Extend malicious code protection to detect and block adversarial inputs targeting agent goal manipulation including injection through tool outputs and context stores" }, { "id": "ASI05", "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "All agent-generated code validated before execution — allowlisted operations only" + "notes": "Scan agent-generated code for malicious patterns before execution; detect and block code that attempts filesystem access, network communication, or privilege escalation" }, { "id": "ASI06", "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory content validated for integrity — unauthorised modifications detected" + "notes": "Extend malicious content detection to agent memory stores; detect poisoned memories, manipulated context, and adversarial state modifications" }, { "id": "DSGAI04", @@ -13882,25 +12198,77 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Training data integrity controls — source allowlisting, anomaly detection, provenance tracking" + "notes": "Extend malicious code protection to training data and model artefacts; detect poisoned data, anomalous patterns, and backdoor indicators" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SI-4", + "control_name": "System Monitoring — output content monitoring", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor model outputs for sensitive data patterns — PII, credentials, classification markings — and alert on detection" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Multi-stage validation at all GenAI ingestion boundaries — path traversal prevention mandatory in Zone 3" + "notes": "Monitor AI service consumption metrics — tokens, latency, cost — in real time; alert and auto-mitigate on consumption anomalies" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor model outputs for factual accuracy, consistency, and hallucination indicators; alert when confidence scores or factual grounding drops below thresholds" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor multi-agent systems for cascade indicators — error propagation, resource exhaustion spreading, and anomalous inter-agent communication patterns" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor agent systems for unexpected behaviour — novel tool use patterns, unanticipated goal decomposition, and emergent inter-agent coordination" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Multimodal extraction pipelines validated — no uncontrolled OT data entering unclassified processing" + "notes": "Monitor model outputs and data access patterns for leakage indicators — PII, credentials, classification markings in outputs; alert on detection" }, { "id": "DSGAI10", @@ -13908,87 +12276,130 @@ "source_list": "DSGAI-2026", "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Synthetic data generation pipeline validated — source OT data integrity maintained" + "scope": "Build", + "notes": "Monitor synthetic data outputs for quality, privacy preservation, and absence of sensitive pattern leakage" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "NL gateway input validation — injection addressed as a known vulnerability class in Zone 3" + "notes": "Monitor AI data usage patterns for misuse indicators; alert on data access inconsistent with approved purposes" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Confidence score suppression as OT integrity control — limits information available for model inversion" + "notes": "Monitor for privacy erosion indicators; detect inference capabilities, re-identification risk, and memorisation patterns" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT RAG corpus integrity controls — source allowlisting, hash verification, ingestion gates" + "notes": "Monitor AI outputs for bias indicators; track fairness metrics across demographic groups and use cases" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.7", - "control_name": "Software and information integrity (monitoring)", + "framework": "FedRAMP", + "control_id": "SR-2", + "control_name": "Supply Chain Risk Management Plan — AI components", "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include all AI components — models, datasets, adapters, libraries, plugins — in the supply chain risk management plan with provenance and risk assessment" + }, { "id": "LLM05", "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Continuous monitoring of LLM outputs for anomalous recommendations — statistical deviation detection" + "notes": "Include AI training data sources, fine-tuning datasets, and pre-trained model weights in the supply chain risk management plan; document provenance and risk assessment for each" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store content integrity monitored — alert on anomalous retrieval patterns" + "notes": "Include all agent components — tools, plugins, MCP servers, model weights, and agent frameworks — in the supply chain risk management plan" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked" + "notes": "Include all agent external dependencies — model APIs, tool endpoints, data sources — in supply chain risk management with availability and integrity requirements" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Include AI training data, model weights, and pipeline artefacts in supply chain risk management with provenance documentation" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Include third-party data providers in supply chain risk management; assess data handling practices and security posture" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SR-3", + "control_name": "Supply Chain Controls — model provenance verification", + "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications" + "notes": "Implement integrity verification for all AI supply chain components using cryptographic signatures, checksums, and attestation before deployment" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Continuous behavioural monitoring of all OT agents — deviation from established baseline detected" + "notes": "Implement supply chain controls for AI model components — verify integrity, provenance, and authenticity of all training data and model weights before use" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify integrity and provenance of all agent supply chain components using cryptographic signatures, checksums, and attestation before deployment" }, { "id": "DSGAI04", @@ -13997,7 +12408,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Continuous monitoring of OT GenAI model outputs — systematic anomalies indicating poisoning detected" + "notes": "Verify integrity and provenance of all AI artefacts using cryptographic signatures and checksums before use in any pipeline" }, { "id": "DSGAI05", @@ -14006,32 +12417,55 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Runtime monitoring of ingestion pipelines — anomalous payloads detected and rejected" + "notes": "Implement provenance tracking for all AI training data; document source, collection method, processing history, and licensing for each dataset" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Vector store integrity monitoring — anomalous access patterns indicating bulk extraction detected" - }, + "notes": "Verify provenance and integrity of data from third-party sources; implement validation before ingestion into AI pipelines" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "Security management", + "control_name": "62443-2-1", + "entries": [ { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "OT synthetic data governance policy — when synthetic data removes OT classification obligation" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "Security management system", + "control_name": "62443-2-1", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Continuous OT RAG corpus monitoring — unauthorised modifications detected before reaching operators" + "notes": "OT security management system updated to cover GenAI deployments — policy, roles, assessment" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 4.1", - "control_name": "Data confidentiality in transit", + "control_id": "SR 1.2", + "control_name": "Identification and authentication", "entries": [ { "id": "LLM02", @@ -14040,16 +12474,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All OT data accessed by LLMs encrypted in transit — no cleartext historian queries over OT network" + "notes": "All LLM access to OT data systems requires authenticated, authorised identity" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt content treated as sensitive OT configuration data — encrypted in transit" + "notes": "LLM actions in OT context authenticated as a distinct identity — traceable in OT audit log" }, { "id": "ASI03", @@ -14058,16 +12492,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials never transmitted or stored in cleartext within OT network" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A communication encrypted — no cleartext agent messages on OT network segments" + "notes": "All agent access to OT systems using distinct, traceable identity — not shared service accounts" }, { "id": "DSGAI01", @@ -14076,7 +12501,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All OT data flowing through GenAI systems encrypted — historian exports, embedding stores, prompt caches" + "notes": "Access to GenAI systems in OT scope authenticated — each user with unique, traceable identity" }, { "id": "DSGAI02", @@ -14085,34 +12510,25 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials never transmitted or stored in cleartext within OT network" + "notes": "All agent credentials unique and traceable — no shared service accounts for OT-accessing agents" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT-derived GenAI assets (embeddings, caches) classified and protected — not treated as general IT data" + "notes": "Approved AI tools only on OT workstations — unapproved services blocked at network layer" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Extracted OT content from multimodal inputs classified and protected — OCR output of P&ID is as sensitive as the P&ID" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Synthetic OT datasets not automatically excluded from protection — assessed before classification change" + "notes": "Access controls on all GenAI-derived OT data assets — same authentication requirements as source data" }, { "id": "DSGAI11", @@ -14121,7 +12537,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Per-operator session data encrypted — KV cache isolation prevents cross-session OT data exposure" + "notes": "Per-operator session isolation — each operator's context inaccessible to all other sessions" }, { "id": "DSGAI13", @@ -14130,7 +12546,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Zone 3 vector store content encrypted — equipment documentation and procedure embeddings as sensitive OT data" + "notes": "RBAC on all Zone 3 vector stores — no unauthenticated access in any OT environment" }, { "id": "DSGAI14", @@ -14139,34 +12555,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI telemetry stores classified and protected — process data in logs requires same protection as live data" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT context window classification tracking — highest classification drives response handling" + "notes": "Access controls on OT GenAI telemetry stores — need-to-know enforced" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Inference attack resistance as OT data protection measure — differential privacy for OT training data" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "OT data minimisation in labelling tasks — annotators see minimum content needed, not full process records" + "notes": "Approved extensions only on Zone 3 workstations — unapproved AI extensions blocked at device management" }, { "id": "DSGAI20", @@ -14175,175 +12573,125 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI model APIs rate-limited — systematic extraction requires high query volumes, rate limiting raises cost" + "notes": "Authentication on all OT GenAI model inference APIs — unauthenticated systematic querying blocked" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 4.2", - "control_name": "Data confidentiality at rest", + "control_id": "SR 1.3", + "control_name": "Use of authenticators", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT data used in LLM context or stored by LLM components encrypted at rest" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 4.3", - "control_name": "Data confidentiality", - "entries": [ - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Embeddings of sensitive OT documentation encrypted — inversion attack protection" + "notes": "All inter-agent messages authenticated — no ambient trust between agents in OT context" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 4.4", - "control_name": "Communication integrity", + "control_id": "SR 1.6", + "control_name": "Authenticator feedback", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels" + "notes": "LLM interactions logged with user identity — injection attempts attributable to specific sessions" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ" + "notes": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging" + "notes": "Agent credential lifecycle managed — issuance, rotation, revocation documented per agent" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 5.1", - "control_name": "Information flow restriction", + "control_id": "SR 1.9", + "control_name": "Remote session termination", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs containing OT data restricted to authorised users — no unrestricted external output" + "notes": "Ability to terminate LLM sessions immediately on detection of suspicious behaviour" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt content cannot flow to unauthorised external destinations" + "notes": "LLM sessions with OT access can be locked and terminated immediately by operators" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent-to-agent information flows restricted — cascade paths limited by design" - }, - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Network controls block OT data flows to unapproved AI endpoints — DLP at OT DMZ boundary" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Cross-session data flows restricted — Zone 3 GenAI enforces strict operator session boundaries" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context assembly limits in Zone 3 — cross-trust-domain aggregation restricted" + "notes": "Operator-accessible agent kill switch — halt all agent activity immediately without affecting process control" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI availability events do not propagate to process control — architectural separation" + "notes": "Agent sessions terminated and credentials revoked immediately on compromise detection" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 5.3", - "control_name": "Information flow restriction", + "control_id": "SR 2.1", + "control_name": "Use control enforcement", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 6.1", - "control_name": "Timely response to events", - "entries": [ + "notes": "Enforcement of permitted use of LLM within OT context — out-of-scope requests rejected at the gateway layer" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Detection and response to poisoning indicators — LLM output anomalies treated as security events" + "notes": "All LLM actions in OT context subject to explicit use controls — no autonomous action without human confirmation" }, { "id": "ASI01", @@ -14352,52 +12700,16 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Goal hijack indicators treated as security events — agent suspended, human notified, actions reversed where feasible" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Memory poisoning indicators treated as security events — agent suspended, memory audited, human notified" + "notes": "Agent actions in OT context subject to explicit use controls — goal-changing actions require human confirmation" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent indicators treated as security events — immediate suspension, investigation, OT impact assessment" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Sensitive OT data disclosure treated as security event — agent suspended, disclosure scope assessed" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential exposure treated as security event — immediate rotation, lateral movement assessment" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Poisoning events treated as Critical security incidents — model suspended, process control fallback activated" + "notes": "Allowlisted tool operations for each agent role — agent cannot invoke tools outside its defined function" }, { "id": "DSGAI12", @@ -14406,249 +12718,240 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "NL gateway misuse treated as Critical security event — query log forensics, data exposure scope" - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT RAG poisoning treated as Critical security event — source quarantine, index rebuild, process control assessment" + "notes": "NL gateway query allowlisting — only pre-approved query patterns permitted to OT data systems" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 6.2", - "control_name": "Timely response to events", + "control_id": "SR 2.2", + "control_name": "Least privilege", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Procedures for detecting and responding to LLM misinformation incidents" + "notes": "LLMs granted minimum necessary access to OT data — cannot read or write to control systems without explicit scoping" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Procedures for detecting operator over-trust patterns — aggregate analysis of agent-influenced decisions" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 6.6", - "control_name": "Timely response to events", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Network monitoring detects and responds to LLM-related resource exhaustion before OT impact" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate" + "notes": "LLMs granted minimum necessary permissions to OT systems — read-only by default, no autonomous write" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade indicators detected and responded to before physical process impact" + "notes": "Agents granted minimum tool access — each tool scoped to specific OT function, read-only by default" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Shadow AI discovery triggers incident response — data impact assessment, vendor notification" + "notes": "Per-tool minimum permission — setpoint adjustment tool restricted to specific tags and safe ranges" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ingestion integrity failure treated as security event — pipeline suspended, forensic capture" + "notes": "Agent credentials scoped to minimum OT data access required for defined task" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Tool data exchange anomalies detected — unusual data volumes in tool calls alerted" + "notes": "Rogue agent cannot exceed defined permission scope even if internal goals are compromised" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Non-compliance incidents trigger defined response — regulatory notification procedures documented" + "notes": "NL gateway executes under requesting operator's permissions — never shared high-privilege OT service account" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Multimodal OT data leakage treated as security event" - }, + "notes": "OT context assembly restricted to minimum data required for the specific query — not broad process datasets" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "SR 2.3", + "control_name": "Use control", + "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Browser AI anomalies on Zone 3 workstations treated as security events" + "notes": "LLM advisory outputs clearly distinguished from authoritative procedural documentation" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI pipeline failures treated as security events — process control fallback activated" + "notes": "LLM output restricted to authorised actions — no raw output directly to control interfaces" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Inference attack campaigns detected — systematic query patterns indicative of AML.T0024.000 alerted" + "notes": "Agent code execution restricted to specific, defined operations — no shell access, no network programming" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model extraction patterns detected — unusual query diversity alerted as potential AML.T0016" + "notes": "LLM advisory outputs clearly distinguished from authoritative documentation — source always visible" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 7.6", - "control_name": "Denial of service protection", + "control_id": "SR 2.6", + "control_name": "Use control", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM components protected against resource exhaustion attacks affecting OT availability" + "notes": "Restrictions on software installation — only approved, verified LLM components permitted in OT zones" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius" + "notes": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Poisoned model availability impact contained — fallback procedure prevents physical process disruption" - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Circuit breakers preventing OT GenAI service degradation from affecting process control" + "notes": "Rogue agent cannot load additional tools or expand its own capability scope" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Poisoned advisory output blast radius contained — process control fallback if advisory system compromised" + "notes": "Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 7.7", - "control_name": "Control system backup", + "control_id": "SR 3.1", + "control_name": "Software and information integrity", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM resource exhaustion cannot affect backup and recovery of OT control systems" + "notes": "LLM outputs for safety-relevant guidance cross-validated against authoritative sources" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent system failures cannot affect backup and recovery of OT process control" + "notes": "System prompt integrity protected — unauthorised modification detected" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI failures cannot affect backup and recovery of process control — independence verified" + "notes": "Communication integrity enforcement on all LLM-to-OT data paths" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Agent memory baseline established and maintained — deviations from baseline detectable" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A message schema validation — reject malformed or unexpected message structures" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent recommendations for safety-relevant decisions cross-validated against independent reference" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "Supplier security requirements", - "control_name": "62443-2-4", + "control_id": "SR 3.2", + "control_name": "Software and information integrity", "entries": [ { "id": "LLM04", @@ -14657,7 +12960,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all LLM vendors with access to OT environments" + "notes": "Integrity verification of all LLM components before deployment in OT environment" }, { "id": "ASI04", @@ -14666,25 +12969,25 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all agent tool and MCP server vendors with OT access" + "notes": "Integrity verification of all agent tools and MCP components before OT deployment" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "GenAI vendors handling OT-derived assets subject to 62443-2-4 programme" + "notes": "All OT tool integrations assessed — security requirements in vendor contracts per 62443-2-4" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "GenAI vendors assessed under OT supplier security programme — same requirements as OT software vendors" + "notes": "Browser AI extensions assessed as third-party software — 62443-2-4 requirements before Zone 3 deployment" }, { "id": "DSGAI19", @@ -14693,255 +12996,263 @@ "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "All labelling vendors with OT data access assessed before engagement" + "notes": "Labelling vendors with OT data access assessed under 62443-2-4 — same requirements as OT software vendors" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.1", - "control_name": "Policies for information security", + "framework": "ISA/IEC 62443", + "control_id": "SR 3.3", + "control_name": "Software and information integrity", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "AI acceptable use policy as a formal ISMS policy document" + "notes": "All inputs to LLMs connected to OT systems validated for integrity — crafted inputs rejected" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Governance policies covering regulatory obligations for GenAI" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.10", - "control_name": "Acceptable use of assets", - "entries": [ + "notes": "LLM model integrity verified before each OT deployment — poisoning detection as integrity control" + }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Policy defining acceptable LLM autonomous actions — approved tool use cases documented" + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store ingestion validated — only authorised OT documentation enters the corpus" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Policy explicitly covering acceptable use of AI tools — approved list and prohibited use cases" + "notes": "All LLM output validated before rendering or passing to OT systems" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Policy governing permitted browser AI extensions and endpoint agent permissions" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.12", - "control_name": "Classification of information", - "entries": [ + "notes": "All inputs to OT agents validated for integrity — no unvalidated external content directly into agent context" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All data in LLM scope classified — training data, RAG sources, outputs, embeddings" + "notes": "Tool descriptor integrity verified — poisoned MCP tool descriptors rejected at loading" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "System prompts classified as sensitive configuration — subject to data governance policy" + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "All agent-generated code validated before execution — allowlisted operations only" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agent advisory output classified — users cannot mistake model recommendations for authoritative system content" + "notes": "Agent memory content validated for integrity — unauthorised modifications detected" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All data in GenAI scope classified — training data, RAG corpora, outputs, embeddings" + "notes": "Training data integrity controls — source allowlisting, anomaly detection, provenance tracking" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Classification extended to GenAI-derived assets — embeddings inherit source classification" + "notes": "Multi-stage validation at all GenAI ingestion boundaries — path traversal prevention mandatory in Zone 3" }, { "id": "DSGAI09", "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Classification of multimodal inputs must propagate to all derived extracted content" + "notes": "Multimodal extraction pipelines validated — no uncontrolled OT data entering unclassified processing" }, { "id": "DSGAI10", "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Synthetic datasets classified based on re-identification risk, not assumed to be non-personal" + "tier": "Foundational", + "scope": "Both", + "notes": "Synthetic data generation pipeline validated — source OT data integrity maintained" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Telemetry data classified — full prompt captures classified at same level as content they contain" + "scope": "Both", + "notes": "NL gateway input validation — injection addressed as a known vulnerability class in Zone 3" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "All content injected into context window classified — highest classification drives handling requirement" + "scope": "Both", + "notes": "Confidence score suppression as OT integrity control — limits information available for model inversion" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Model weights, architectures, and fine-tuning configurations classified as intellectual property" + "notes": "OT RAG corpus integrity controls — source allowlisting, hash verification, ingestion gates" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.13", - "control_name": "Labelling of information", + "framework": "ISA/IEC 62443", + "control_id": "SR 3.7", + "control_name": "Software and information integrity (monitoring)", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Classification labels propagated to derived assets — embeddings, caches, summaries" + "notes": "Continuous monitoring of LLM outputs for anomalous recommendations — statistical deviation detection" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Classification labels propagate through the full GenAI data lifecycle" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.14", - "control_name": "Transfer of information", - "entries": [ + "notes": "Vector store content integrity monitored — alert on anomalous retrieval patterns" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Information transfer policies and agreements for A2A communication — authentication requirements, acceptable content" + "notes": "Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Continuous behavioural monitoring of all OT agents — deviation from established baseline detected" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Continuous monitoring of OT GenAI model outputs — systematic anomalies indicating poisoning detected" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Controls on context transfer between sessions — prohibition on cross-session data leakage" + "scope": "Both", + "notes": "Runtime monitoring of ingestion pipelines — anomalous payloads detected and rejected" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Controls on content transfer into context windows — documented data flow for each RAG pipeline" + "scope": "Both", + "notes": "Vector store integrity monitoring — anomalous access patterns indicating bulk extraction detected" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Continuous OT RAG corpus monitoring — unauthorised modifications detected before reaching operators" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.15", - "control_name": "Identity management", + "framework": "ISA/IEC 62443", + "control_id": "SR 4.1", + "control_name": "Data confidentiality in transit", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "LLM tool access governed through identity management — tool permissions scoped per deployment" + "scope": "Both", + "notes": "All OT data accessed by LLMs encrypted in transit — no cleartext historian queries over OT network" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool access governed through identity management — tool permissions scoped per agent identity" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.16", - "control_name": "Identity management", - "entries": [ + "notes": "System prompt content treated as sensitive OT configuration data — encrypted in transit" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -14949,24 +13260,26 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process" + "notes": "Agent credentials never transmitted or stored in cleartext within OT network" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "All agent identities inventoried and lifecycle-managed as non-human identities" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.17", - "control_name": "Authentication information", - "entries": [ + "notes": "All A2A communication encrypted — no cleartext agent messages on OT network segments" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "All OT data flowing through GenAI systems encrypted — historian exports, embedding stores, prompt caches" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -14974,93 +13287,79 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Secure management of agent credentials — no hardcoding, rotation enforced" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.19", - "control_name": "Supplier relationships", - "entries": [ + "notes": "Agent credentials never transmitted or stored in cleartext within OT network" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all LLM model and data vendors — provenance, integrity, disclosure obligations" + "notes": "OT-derived GenAI assets (embeddings, caches) classified and protected — not treated as general IT data" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all agent tool and MCP server providers — provenance, integrity, disclosure obligations" + "notes": "Extracted OT content from multimodal inputs classified and protected — OCR output of P&ID is as sensitive as the P&ID" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all third-party training data and model sources" + "notes": "Synthetic OT datasets not automatically excluded from protection — assessed before classification change" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security due diligence on all tool and plugin providers receiving agent context" + "notes": "Per-operator session data encrypted — KV cache isolation prevents cross-session OT data exposure" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Security requirements for any third-party access to proprietary model capabilities" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.20", - "control_name": "Supplier agreements", - "entries": [ + "notes": "Zone 3 vector store content encrypted — equipment documentation and procedure embeddings as sensitive OT data" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Contractual security requirements for LLM component suppliers — integrity guarantees, vulnerability notification" + "notes": "OT GenAI telemetry stores classified and protected — process data in logs requires same protection as live data" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA" + "notes": "OT context window classification tracking — highest classification drives response handling" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Contractual requirements covering data minimisation, retention, and training use for tool providers" + "notes": "Inference attack resistance as OT data protection measure — differential privacy for OT training data" }, { "id": "DSGAI19", @@ -15069,125 +13368,143 @@ "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Contractual data handling requirements for labelling vendors and HITL service providers" + "notes": "OT data minimisation in labelling tasks — annotators see minimum content needed, not full process records" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "OT GenAI model APIs rate-limited — systematic extraction requires high query volumes, rate limiting raises cost" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.21", - "control_name": "Supply chain security", + "framework": "ISA/IEC 62443", + "control_id": "SR 4.2", + "control_name": "Data confidentiality at rest", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope" - }, + "notes": "OT data used in LLM context or stored by LLM components encrypted at rest" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "SR 4.3", + "control_name": "Data confidentiality", + "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope" + "notes": "Embeddings of sensitive OT documentation encrypted — inversion attack protection" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.23", - "control_name": "Security for cloud services", + "framework": "ISA/IEC 62443", + "control_id": "SR 4.4", + "control_name": "Communication integrity", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Due diligence and security requirements for any cloud-based AI service including shadow AI SaaS" + "notes": "GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Cloud-based tool and plugin providers assessed against A.5.23 security requirements" + "notes": "OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.24", - "control_name": "Incident management", + "framework": "ISA/IEC 62443", + "control_id": "SR 5.1", + "control_name": "Information flow restriction", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Incident response procedures for LLM availability failures and cost overruns" + "notes": "LLM outputs containing OT data restricted to authorised users — no unrestricted external output" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Cascade events treated as security incidents — defined response, kill switch activation, operations notification" + "notes": "System prompt content cannot flow to unauthorised external destinations" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent containment as ISMS incident — kill switch, recommendation audit, process state validation, forensic capture" + "notes": "Agent-to-agent information flows restricted — cascade paths limited by design" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Incident management procedures covering AI pipeline availability failures" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.30", - "control_name": "ICT readiness for business continuity", - "entries": [ + "notes": "Network controls block OT data flows to unapproved AI endpoints — DLP at OT DMZ boundary" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM availability requirements in BCP — RTO/RPO defined, rate limiting as resilience control" + "notes": "Cross-session data flows restricted — Zone 3 GenAI enforces strict operator session boundaries" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent cluster failures covered in BCP — RTO/RPO defined, failover tested, circuit breakers as resilience controls" + "notes": "Context assembly limits in Zone 3 — cross-trust-domain aggregation restricted" }, { "id": "DSGAI17", @@ -15196,73 +13513,118 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI pipeline availability requirements included in BCP — RTO/RPO defined for vector stores and RAG components" + "notes": "OT GenAI availability events do not propagate to process control — architectural separation" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.31", - "control_name": "Compliance with legal requirements", + "framework": "ISA/IEC 62443", + "control_id": "SR 5.3", + "control_name": "Information flow restriction", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Identifying and complying with all legal, regulatory, and contractual requirements applicable to GenAI" + "notes": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.34", - "control_name": "Privacy and PII protection", + "framework": "ISA/IEC 62443", + "control_id": "SR 6.1", + "control_name": "Timely response to events", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Detection and response to poisoning indicators — LLM output anomalies treated as security events" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Goal hijack indicators treated as security events — agent suspended, human notified, actions reversed where feasible" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory poisoning indicators treated as security events — agent suspended, memory audited, human notified" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Rogue agent indicators treated as security events — immediate suspension, investigation, OT impact assessment" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Privacy requirements for GenAI-processed personal data — lawful basis, minimisation, rights support" + "notes": "Sensitive OT data disclosure treated as security event — agent suspended, disclosure scope assessed" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Anonymisation must meet the standard required by applicable privacy law — not just technical anonymisation" + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credential exposure treated as security event — immediate rotation, lateral movement assessment" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Privacy requirements extended to cover inference attack resistance — not just direct disclosure" + "notes": "Poisoning events treated as Critical security incidents — model suspended, process control fallback activated" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Data minimisation and privacy controls for all HITL labelling workflows" + "notes": "NL gateway misuse treated as Critical security event — query log forensics, data exposure scope" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "OT RAG poisoning treated as Critical security event — source quarantine, index rebuild, process control assessment" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.36", - "control_name": "Compliance with policies", + "framework": "ISA/IEC 62443", + "control_id": "SR 6.2", + "control_name": "Timely response to events", "entries": [ { "id": "LLM07", @@ -15271,7 +13633,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Policy on AI-generated content accuracy — disclosure requirements, human verification thresholds" + "notes": "Procedures for detecting and responding to LLM misinformation incidents" }, { "id": "ASI09", @@ -15280,254 +13642,326 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Policy on agentic AI advisory use — domains requiring verification, approval flow independence from agent interface" - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Internal policies for GenAI compliance — reviewed and enforced" + "notes": "Procedures for detecting operator over-trust patterns — aggregate analysis of agent-influenced decisions" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.7", - "control_name": "Threat intelligence", + "framework": "ISA/IEC 62443", + "control_id": "SR 6.6", + "control_name": "Timely response to events", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Network monitoring detects and responds to LLM-related resource exhaustion before OT impact" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Active intelligence on prompt injection techniques — new attack patterns inform detection controls" + "notes": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Intelligence on active data poisoning campaigns targeting your sector and model type" + "notes": "Cascade indicators detected and responded to before physical process impact" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Intelligence on disinformation campaigns and active manipulation of RAG sources" + "notes": "Shadow AI discovery triggers incident response — data impact assessment, vendor notification" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Active intelligence on prompt injection and goal hijack techniques — new attack methods inform detection controls" + "notes": "Ingestion integrity failure treated as security event — pipeline suspended, forensic capture" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Active intelligence on disinformation campaigns and RAG poisoning techniques targeting your sector" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.9", - "control_name": "Inventory of assets", - "entries": [ + "notes": "Tool data exchange anomalies detected — unusual data volumes in tool calls alerted" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All GenAI data assets inventoried — training data, embeddings, caches, agent memory, logs" + "notes": "Non-compliance incidents trigger defined response — regulatory notification procedures documented" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Multimodal OT data leakage treated as security event" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser AI anomalies on Zone 3 workstations treated as security events" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "OT GenAI pipeline failures treated as security events — process control fallback activated" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Inference attack campaigns detected — systematic query patterns indicative of AML.T0024.000 alerted" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Model extraction patterns detected — unusual query diversity alerted as potential AML.T0016" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.6.3", - "control_name": "Information security awareness training", + "framework": "ISA/IEC 62443", + "control_id": "SR 7.6", + "control_name": "Denial of service protection", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "User training on LLM output limitations — verification requirements and critical evaluation" + "notes": "LLM components protected against resource exhaustion attacks affecting OT availability" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All users of agentic decision-support tools trained on AI limitations — verification requirements, how to identify manipulation" + "notes": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Security training for all labellers — internal and third-party — covering data handling requirements" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.1", - "control_name": "Endpoint device management", - "entries": [ + "notes": "Poisoned model availability impact contained — fallback procedure prevents physical process disruption" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Circuit breakers preventing OT GenAI service degradation from affecting process control" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Endpoint AI agents managed under device management policy — approved versions, permissions scoped" + "notes": "Poisoned advisory output blast radius contained — process control fallback if advisory system compromised" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.10", - "control_name": "Information deletion", + "framework": "ISA/IEC 62443", + "control_id": "SR 7.7", + "control_name": "Control system backup", "entries": [ { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM resource exhaustion cannot affect backup and recovery of OT control systems" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent system failures cannot affect backup and recovery of OT process control" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Deletion and erasure obligations enforced across all derived assets — embeddings, caches, backups" + "notes": "OT GenAI failures cannot affect backup and recovery of process control — independence verified" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.11", - "control_name": "Data masking", + "framework": "ISA/IEC 62443", + "control_id": "Supplier security requirements", + "control_name": "62443-2-4", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Output redaction for PII and sensitive patterns before responses reach users" + "notes": "Security requirements applied to all LLM vendors with access to OT environments" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Differential privacy in embedding generation for sensitive corpora" + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Security requirements applied to all agent tool and MCP server vendors with OT access" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Masking or redaction of sensitive data in LLM outputs, RAG results, and prompts" + "notes": "GenAI vendors handling OT-derived assets subject to 62443-2-4 programme" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Masking and redaction applied to extracted text from OCR and audio transcription — same as source" + "notes": "GenAI vendors assessed under OT supplier security programme — same requirements as OT software vendors" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Technical anonymisation and pseudonymisation controls applied to synthetic data generation" - }, + "tier": "Foundational", + "scope": "Both", + "notes": "All labelling vendors with OT data access assessed before engagement" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.1", + "control_name": "Policies for information security", + "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Redaction of any cross-session content that reaches an output channel" + "scope": "Both", + "notes": "AI acceptable use policy as a formal ISMS policy document" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Masking of sensitive content in logs and traces before storage" - }, + "scope": "Both", + "notes": "Governance policies covering regulatory obligations for GenAI" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.10", + "control_name": "Acceptable use of assets", + "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Build", - "notes": "Sensitive content redacted or masked before injection into shared context windows" + "notes": "Policy defining acceptable LLM autonomous actions — approved tool use cases documented" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Differential privacy and output masking reducing information available for reconstruction attacks" + "notes": "Policy explicitly covering acceptable use of AI tools — approved list and prohibited use cases" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Anonymisation and redaction applied to labelling tasks before exposure to annotators" + "notes": "Policy governing permitted browser AI extensions and endpoint agent permissions" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.12", - "control_name": "Data leakage prevention", + "control_id": "A.5.12", + "control_name": "Classification of information", "entries": [ { "id": "LLM02", @@ -15536,16 +13970,25 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DLP on all LLM output channels — API, chat interface, logs" + "notes": "All data in LLM scope classified — training data, RAG sources, outputs, embeddings" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "System prompts classified as sensitive configuration — subject to data governance policy" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "DLP on memory write paths — credential patterns, sensitive content detected before memory write" + "notes": "Agent advisory output classified — users cannot mistake model recommendations for authoritative system content" }, { "id": "DSGAI01", @@ -15554,16 +13997,16 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DLP controls on all GenAI output channels — model API, chat interfaces, logs" + "notes": "All data in GenAI scope classified — training data, RAG corpora, outputs, embeddings" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DLP controls detecting and blocking sensitive data transfer to unapproved AI endpoints" + "notes": "Classification extended to GenAI-derived assets — embeddings inherit source classification" }, { "id": "DSGAI09", @@ -15572,16 +14015,16 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "DLP applied to all modality-extracted content — text, OCR output, transcripts" + "notes": "Classification of multimodal inputs must propagate to all derived extracted content" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DLP controls on vector store query results — sensitive content in retrieved passages detected" + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Synthetic datasets classified based on re-identification risk, not assumed to be non-personal" }, { "id": "DSGAI14", @@ -15590,25 +14033,16 @@ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "DLP applied to telemetry streams — sensitive content redacted before storage" + "notes": "Telemetry data classified — full prompt captures classified at same level as content they contain" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "DLP controls on endpoint AI agent data access and exfiltration paths" - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Output monitoring for responses that reconstruct training data or sensitive source content" + "scope": "Build", + "notes": "All content injected into context window classified — highest classification drives handling requirement" }, { "id": "DSGAI20", @@ -15617,64 +14051,73 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitoring for systematic querying patterns indicative of model extraction attacks" + "notes": "Model weights, architectures, and fine-tuning configurations classified as intellectual property" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.13", - "control_name": "Backup", + "control_id": "A.5.13", + "control_name": "Labelling of information", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Backup and recovery for LLM service infrastructure — failover capability tested" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent state and configuration backed up — recovery to known-good state after cascade incident" + "notes": "Classification labels propagated to derived assets — embeddings, caches, summaries" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora" + "notes": "Classification labels propagate through the full GenAI data lifecycle" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.14", - "control_name": "Redundancy", + "control_id": "A.5.14", + "control_name": "Transfer of information", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Information transfer policies and agreements for A2A communication — authentication requirements, acceptable content" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Redundancy and failover for production RAG and vector store infrastructure" + "scope": "Build", + "notes": "Controls on context transfer between sessions — prohibition on cross-session data leakage" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Controls on content transfer into context windows — documented data flow for each RAG pipeline" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.15", - "control_name": "Logging", + "control_id": "A.5.15", + "control_name": "Identity management", "entries": [ { "id": "LLM03", @@ -15683,16 +14126,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Build", - "notes": "All LLM tool invocations logged with full context — every tool call auditable" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Access to system prompts logged — unauthorised access attempts detectable" + "notes": "LLM tool access governed through identity management — tool permissions scoped per deployment" }, { "id": "ASI02", @@ -15701,8 +14135,15 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All tool invocations logged with full context — tool identity, parameters, agent identity, timestamp" - }, + "notes": "Agent tool access governed through identity management — tool permissions scoped per agent identity" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.16", + "control_name": "Identity management", + "entries": [ { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -15710,26 +14151,24 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All credential operations logged — issuance, use, expiry, anomalous patterns detectable" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" + "notes": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" - }, + "notes": "All agent identities inventoried and lifecycle-managed as non-human identities" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.17", + "control_name": "Authentication information", + "entries": [ { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -15737,174 +14176,177 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All agent credential use logged with full context — issuance, invocation, expiry" + "notes": "Secure management of agent credentials — no hardcoding, rotation enforced" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.19", + "control_name": "Supplier relationships", + "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Security requirements applied to all LLM model and data vendors — provenance, integrity, disclosure obligations" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Logging of cross-session access anomalies for detection and forensics" + "scope": "Both", + "notes": "Security requirements applied to all agent tool and MCP server providers — provenance, integrity, disclosure obligations" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Security requirements applied to all third-party training data and model sources" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit logging on all vector store read, write, and admin operations" + "notes": "Security due diligence on all tool and plugin providers receiving agent context" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Logging controls applied to AI telemetry — least-logging defaults, no full payload capture by default" + "tier": "Hardening", + "scope": "Both", + "notes": "Security requirements for any third-party access to proprietary model capabilities" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.16", - "control_name": "Monitoring activities", + "control_id": "A.5.20", + "control_name": "Supplier agreements", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Runtime monitoring for prompt injection indicators in LLM inputs and outputs" + "notes": "Contractual security requirements for LLM component suppliers — integrity guarantees, vulnerability notification" }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Real-time monitoring of LLM resource consumption — cost anomaly detection and alerting" + "notes": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Production monitoring for output accuracy — hallucination rate tracking, anomaly detection on model drift" + "notes": "Contractual requirements covering data minimisation, retention, and training use for tool providers" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Anomaly detection on vector store query patterns — bulk extraction and poisoning indicators" - }, + "tier": "Foundational", + "scope": "Both", + "notes": "Contractual data handling requirements for labelling vendors and HITL service providers" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.21", + "control_name": "Supply chain security", + "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Runtime monitoring for output handling incidents — injection attempts in LLM output channels" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Runtime monitoring for injection indicators across all agent input channels — new 2022 control" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", "scope": "Both", - "notes": "Code execution environments monitored — anomalous system calls, network attempts detected" + "notes": "Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Memory store access and content monitored — anomalous write patterns, statistical integrity checks" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade indicators monitored — correlated failure patterns across agent cluster detected before physical impact" - }, + "notes": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.23", + "control_name": "Security for cloud services", + "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Aggregate over-trust patterns monitored — systematic operator acceptance without verification detected" + "notes": "Due diligence and security requirements for any cloud-based AI service including shadow AI SaaS" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Behavioural baseline monitoring — deviation detection is the primary rogue agent control, new 2022 control directly applicable" + "notes": "Cloud-based tool and plugin providers assessed against A.5.23 security requirements" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.2", - "control_name": "Privileged access rights", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "LLM tool access managed as privileged access — minimum scope, reviewed regularly" - }, + "control_id": "A.5.24", + "control_name": "Incident management", + "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool access managed as privileged access — per-tool permission manifests, minimum scope, regular review" + "notes": "Incident response procedures for LLM availability failures and cost overruns" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials managed as privileged access — JIT issuance, minimum scope, regular review, automatic expiry" + "notes": "Cascade events treated as security incidents — defined response, kill switch activation, operations notification" }, { "id": "ASI10", @@ -15913,102 +14355,91 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Scope constraints enforced — rogue agent cannot exceed permission envelope regardless of internal goal state" + "notes": "Rogue agent containment as ISMS incident — kill switch, recommendation audit, process state validation, forensic capture" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials managed as privileged access — short-lived, scoped, reviewed" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.20", - "control_name": "Networks security", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "A2A communication channels network-isolated — dedicated VLAN, traffic volume caps, protocol filtering" + "notes": "Incident management procedures covering AI pipeline availability failures" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.24", - "control_name": "Use of cryptography", + "control_id": "A.5.30", + "control_name": "ICT readiness for business continuity", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Encryption of all vector store data at rest and in transit" + "scope": "Both", + "notes": "LLM availability requirements in BCP — RTO/RPO defined, rate limiting as resilience control" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials encrypted at rest and in transit — secret manager, no cleartext storage" + "notes": "Agent cluster failures covered in BCP — RTO/RPO defined, failover tested, circuit breakers as resilience controls" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge base" - }, + "notes": "AI pipeline availability requirements included in BCP — RTO/RPO defined for vector stores and RAG components" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.31", + "control_name": "Compliance with legal requirements", + "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "A2A messages encrypted and integrity-verified — mutual TLS, nonce-based replay protection" - }, + "notes": "Identifying and complying with all legal, regulatory, and contractual requirements applicable to GenAI" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.34", + "control_name": "Privacy and PII protection", + "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Encryption of multimodal uploads and all derived content at rest and in transit" + "notes": "Privacy requirements for GenAI-processed personal data — lawful basis, minimisation, rights support" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Encryption of all vector store data at rest and in transit" + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Anonymisation must meet the standard required by applicable privacy law — not just technical anonymisation" }, { "id": "DSGAI18", @@ -16017,58 +14448,67 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Cryptographic protection of embedding vectors preventing inversion attacks" + "notes": "Privacy requirements extended to cover inference attack resistance — not just direct disclosure" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Data minimisation and privacy controls for all HITL labelling workflows" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.26", - "control_name": "Application security requirements", + "control_id": "A.5.36", + "control_name": "Compliance with policies", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Security requirements for all interfaces consuming LLM output — specified before development" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", "scope": "Both", - "notes": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations" + "notes": "Policy on AI-generated content accuracy — disclosure requirements, human verification thresholds" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Input validation requirements specified for all GenAI data ingestion interfaces" + "scope": "Both", + "notes": "Policy on agentic AI advisory use — domains requiring verification, approval flow independence from agent interface" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory" + "scope": "Both", + "notes": "Internal policies for GenAI compliance — reviewed and enforced" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.27", - "control_name": "Secure system architecture", + "control_id": "A.5.7", + "control_name": "Threat intelligence", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Active intelligence on prompt injection techniques — new attack patterns inform detection controls" + }, { "id": "LLM05", "name": "Data and Model Poisoning", @@ -16076,16 +14516,25 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking" + "notes": "Intelligence on active data poisoning campaigns targeting your sector and model type" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Intelligence on disinformation campaigns and active manipulation of RAG sources" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Training pipeline designed with integrity controls and supply chain verification" + "notes": "Active intelligence on prompt injection and goal hijack techniques — new attack methods inform detection controls" }, { "id": "DSGAI21", @@ -16094,172 +14543,193 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "RAG pipeline designed with source trust verification and integrity controls" + "notes": "Active intelligence on disinformation campaigns and RAG poisoning techniques targeting your sector" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.28", - "control_name": "Secure coding", + "control_id": "A.5.9", + "control_name": "Inventory of assets", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure coding requirements for all LLM integration code — input validation, sanitisation, context separation" - }, + "notes": "All GenAI data assets inventoried — training data, embeddings, caches, agent memory, logs" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.6.3", + "control_name": "Information security awareness training", + "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Output encoding, sanitisation, and schema validation as secure coding requirements" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Secure coding requirements for all agentic integration code — input validation, goal-state verification, context separation" + "notes": "User training on LLM output limitations — verification requirements and critical evaluation" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool parameter validation as secure coding requirement — LLM-generated parameters treated as untrusted" + "notes": "All users of agentic decision-support tools trained on AI limitations — verification requirements, how to identify manipulation" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", - "notes": "Sandbox, static analysis, and allowlist as secure coding requirements — no code execution without these controls" - }, + "notes": "Security training for all labellers — internal and third-party — covering data handling requirements" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.1", + "control_name": "Endpoint device management", + "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Secure coding practices applied to data ingestion, parsing, and snapshot import code" - }, + "scope": "Both", + "notes": "Endpoint AI agents managed under device management policy — approved versions, permissions scoped" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.10", + "control_name": "Information deletion", + "entries": [ { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Parameterised queries, allowlisted operations, and row-level policy enforcement in LLM gateway code" + "scope": "Both", + "notes": "Deletion and erasure obligations enforced across all derived assets — embeddings, caches, backups" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.29", - "control_name": "Security testing", + "control_id": "A.8.11", + "control_name": "Data masking", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Adversarial testing programme covering prompt injection scenarios before each release" + "notes": "Output redaction for PII and sensitive patterns before responses reach users" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", - "scope": "Both", - "notes": "Adversarial testing covering poisoning detection before each production model promotion" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", "scope": "Build", - "notes": "Output injection scenarios in security testing — XSS, SQL injection, command injection via LLM output" + "notes": "Differential privacy in embedding generation for sensitive corpora" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Adversarial testing programme covering goal hijack — direct, indirect, multi-turn injection before each release" + "notes": "Masking or redaction of sensitive data in LLM outputs, RAG results, and prompts" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment" + "notes": "Masking and redaction applied to extracted text from OCR and audio transcription — same as source" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", - "scope": "Both", - "notes": "Adversarial testing of model outputs for poisoning indicators before deployment" + "scope": "Build", + "notes": "Technical anonymisation and pseudonymisation controls applied to synthetic data generation" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Security testing of all data ingestion interfaces including schema and semantic validation" + "notes": "Redaction of any cross-session content that reaches an output channel" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "SQL injection and privilege escalation testing on all LLM-to-database interfaces" + "notes": "Masking of sensitive content in logs and traces before storage" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Sensitive content redacted or masked before injection into shared context windows" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Integrity testing of RAG corpora — anomaly detection, source validation, content verification" + "notes": "Differential privacy and output masking reducing information available for reconstruction attacks" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Anonymisation and redaction applied to labelling tasks before exposure to annotators" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.3", - "control_name": "Information access restriction", + "control_id": "A.8.12", + "control_name": "Data leakage prevention", "entries": [ { "id": "LLM02", @@ -16268,25 +14738,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Access controls on system prompt storage — version controlled, access logged" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "RBAC on all vector store collections — no unauthenticated access to any collection" + "notes": "DLP on all LLM output channels — API, chat interface, logs" }, { "id": "ASI06", @@ -16295,7 +14747,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Access controls on all agent memory stores — only agent and designated administrators can write" + "notes": "DLP on memory write paths — credential patterns, sensitive content detected before memory write" }, { "id": "DSGAI01", @@ -16304,204 +14756,145 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Access controls on RAG data sources limiting retrieval to authorised user scope" + "notes": "DLP controls on all GenAI output channels — model API, chat interfaces, logs" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent access restricted to minimum scope required per task" + "notes": "DLP controls detecting and blocking sensitive data transfer to unapproved AI endpoints" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Tools receive only the minimum context required for their function — not full conversation history" + "notes": "DLP applied to all modality-extracted content — text, OCR output, transcripts" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Strict session and tenant isolation — one user's context cannot be accessed by another" + "scope": "Both", + "notes": "DLP controls on vector store query results — sensitive content in retrieved passages detected" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "LLM-generated queries execute under least-privilege credentials matching the requesting user's access" + "notes": "DLP applied to telemetry streams — sensitive content redacted before storage" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "RBAC enforced on all vector store collections — collection-level and namespace-level access control" + "notes": "DLP controls on endpoint AI agent data access and exfiltration paths" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Context window content restricted to minimum required — no cross-trust-domain aggregation without access control" + "tier": "Hardening", + "scope": "Both", + "notes": "Output monitoring for responses that reconstruct training data or sensitive source content" }, { "id": "DSGAI20", "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "API rate limiting, query restrictions, and anomaly detection limiting systematic model extraction" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.33", - "control_name": "Test information", - "entries": [ - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Appropriate protection of test and synthetic data used in AI development" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.7", - "control_name": "Protection against malware", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Endpoint AI agents subject to malware protection — extension integrity verification" + "notes": "Monitoring for systematic querying patterns indicative of model extraction attacks" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.8", - "control_name": "Management of technical vulnerabilities", + "control_id": "A.8.13", + "control_name": "Backup", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scanning and patching LLM component vulnerabilities — model weights and inference runtime libraries" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Training pipeline dependency scanning — vulnerabilities in training infrastructure components" + "notes": "Backup and recovery for LLM service infrastructure — failover capability tested" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent component CVEs in vulnerability management — ML libraries, inference runtime, MCP server dependencies" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Scanning and patching model components and training pipeline dependencies" + "notes": "Agent state and configuration backed up — recovery to known-good state after cascade incident" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Vulnerability management extended to cover data integrity vulnerabilities in RAG pipelines" + "notes": "Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.9", - "control_name": "Configuration management", + "control_id": "A.8.14", + "control_name": "Redundancy", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Model versions, adapters, and datasets managed with integrity and change controls" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Snapshot import and restore functionality hardened and version controlled" + "scope": "Both", + "notes": "Redundancy and failover for production RAG and vector store infrastructure" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.10.1", - "control_name": "Third-party AI system acquisition", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.15", + "control_name": "Logging", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Security requirements applied to all LLM component vendors — model providers, dataset suppliers, inference runtime vendors" + "scope": "Build", + "notes": "All LLM tool invocations logged with full context — every tool call auditable" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector database providers assessed as third-party AI system components" + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Access to system prompts logged — unauthorised access attempts detectable" }, { "id": "ASI02", @@ -16510,7 +14903,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts" + "notes": "All tool invocations logged with full context — tool identity, parameters, agent identity, timestamp" }, { "id": "ASI03", @@ -16519,75 +14912,86 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Third-party services accessed via agent credentials assessed — security obligations in access arrangements" + "notes": "All credential operations logged — issuance, use, expiry, anomalous patterns detectable" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts" + "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "A2A communication infrastructure providers assessed — security obligations in arrangements" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.10.2", - "control_name": "Customer relationships", - "entries": [ + "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM deployment obligations to downstream customers — what security properties are guaranteed" + "notes": "All agent credential use logged with full context — issuance, invocation, expiry" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Logging of cross-session access anomalies for detection and forensics" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed" + "notes": "Audit logging on all vector store read, write, and admin operations" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Logging controls applied to AI telemetry — least-logging defaults, no full payload capture by default" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.5.2", - "control_name": "Impact assessment", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.16", + "control_name": "Monitoring activities", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Impact assessment covers data disclosure risk — what data is in LLM scope, what is the disclosure impact per stakeholder" + "notes": "Runtime monitoring for prompt injection indicators in LLM inputs and outputs" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Impact assessment covers excessive agency risk — what actions can the LLM take autonomously, what is the worst-case impact" + "notes": "Real-time monitoring of LLM resource consumption — cost anomaly detection and alerting" }, { "id": "LLM07", @@ -16596,7 +15000,25 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI impact assessment covers misinformation risk — which domains are affected, what is the consequence of incorrect output per stakeholder" + "notes": "Production monitoring for output accuracy — hallucination rate tracking, anomaly detection on model drift" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Anomaly detection on vector store query patterns — bulk extraction and poisoning indicators" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Runtime monitoring for output handling incidents — injection attempts in LLM output channels" }, { "id": "ASI01", @@ -16605,25 +15027,34 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Impact assessment covers goal hijack risk — what autonomous actions are possible if goal is redirected, who is affected" + "notes": "Runtime monitoring for injection indicators across all agent input channels — new 2022 control" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Tool misuse impact assessed — what harm is possible if each tool is misused autonomously" + "notes": "Code execution environments monitored — anomalous system calls, network attempts detected" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Impact of code execution capability formally assessed — RCE impact on persons and systems documented" + "notes": "Memory store access and content monitored — anomalous write patterns, statistical integrity checks" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Cascade indicators monitored — correlated failure patterns across agent cluster detected before physical impact" }, { "id": "ASI09", @@ -16632,14 +15063,23 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Trust exploitation impact assessed — which persons are affected by AI decisions influenced by manipulated trust" + "notes": "Aggregate over-trust patterns monitored — systematic operator acceptance without verification detected" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Behavioural baseline monitoring — deviation detection is the primary rogue agent control, new 2022 control directly applicable" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.1.2", - "control_name": "Responsible AI system management", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.2", + "control_name": "Privileged access rights", "entries": [ { "id": "LLM03", @@ -16647,26 +15087,26 @@ "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "LLM tool access managed responsibly — minimum permissions, human oversight requirements documented as AIMS responsibilities" + "scope": "Build", + "notes": "LLM tool access managed as privileged access — minimum scope, reviewed regularly" }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission" + "notes": "Agent tool access managed as privileged access — per-tool permission manifests, minimum scope, regular review" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements" + "notes": "Agent credentials managed as privileged access — JIT issuance, minimum scope, regular review, automatic expiry" }, { "id": "ASI10", @@ -16675,165 +15115,265 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation" + "notes": "Scope constraints enforced — rogue agent cannot exceed permission envelope regardless of internal goal state" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials managed as privileged access — short-lived, scoped, reviewed" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.2.3", - "control_name": "AI system security", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.20", + "control_name": "Networks security", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "AI systems designed with security controls — input validation, context separation, injection detection as AIMS design requirements" - }, + "notes": "A2A communication channels network-isolated — dedicated VLAN, traffic volume caps, protocol filtering" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.24", + "control_name": "Use of cryptography", + "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Output scanning and redaction as AIMS security controls — DLP enforced at the system boundary" + "scope": "Build", + "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Encryption of all vector store data at rest and in transit" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool permission enforcement as AIMS security control — scope enforced at orchestration layer" + "notes": "Agent credentials encrypted at rest and in transit — secret manager, no cleartext storage" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline integrity controls — input validation, source allowlisting as AIMS security design requirements" + "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge base" }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Rate limiting and resource controls as AIMS security design requirements — enforced at deployment" + "notes": "A2A messages encrypted and integrity-verified — mutual TLS, nonce-based replay protection" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Encryption of multimodal uploads and all derived content at rest and in transit" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompt encryption and access controls as AIMS security design requirements" + "notes": "Encryption of all vector store data at rest and in transit" }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Cryptographic protection of embedding vectors preventing inversion attacks" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.26", + "control_name": "Application security requirements", + "entries": [ { "id": "LLM10", "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Output encoding and schema validation as AIMS security design requirements — LLM output treated as untrusted input to downstream systems" + "scope": "Build", + "notes": "Security requirements for all interfaces consuming LLM output — specified before development" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Goal-state verification and input validation as AIMS security design requirements — structural controls enforced at orchestration layer" + "notes": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Per-tool permission manifests and parameter validation as AIMS security controls" + "scope": "Build", + "notes": "Input validation requirements specified for all GenAI data ingestion interfaces" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege" - }, + "scope": "Build", + "notes": "Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.27", + "control_name": "Secure system architecture", + "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Component integrity verification as AIMS security design requirement — cryptographic signatures before loading" + "notes": "Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox, static analysis, and allowlist as AIMS security design requirements for code execution capability" + "notes": "Training pipeline designed with integrity controls and supply chain verification" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory store access controls and integrity monitoring as AIMS security design requirements" + "notes": "RAG pipeline designed with source trust verification and integrity controls" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.28", + "control_name": "Secure coding", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secure coding requirements for all LLM integration code — input validation, sanitisation, context separation" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", + "scope": "Build", + "notes": "Output encoding, sanitisation, and schema validation as secure coding requirements" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "A2A authentication, encryption, and schema validation as AIMS security design requirements" + "notes": "Secure coding requirements for all agentic integration code — input validation, goal-state verification, context separation" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Circuit breakers and blast radius limits as AIMS security design requirements" + "notes": "Tool parameter validation as secure coding requirement — LLM-generated parameters treated as untrusted" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Scope constraints enforced at infrastructure layer — rogue agent cannot exceed permission envelope" + "notes": "Sandbox, static analysis, and allowlist as secure coding requirements — no code execution without these controls" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Secure coding practices applied to data ingestion, parsing, and snapshot import code" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Parameterised queries, allowlisted operations, and row-level policy enforcement in LLM gateway code" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.2.6", - "control_name": "Testing of AI systems", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.29", + "control_name": "Security testing", "entries": [ { "id": "LLM01", @@ -16842,7 +15382,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "AI systems tested before deployment — adversarial testing for prompt injection as AIMS testing requirement" + "notes": "Adversarial testing programme covering prompt injection scenarios before each release" }, { "id": "LLM05", @@ -16851,16 +15391,7 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Poisoning detection in AIMS testing — backdoor trigger testing, biased output detection before each production promotion" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector store attacks in AIMS testing — RBAC bypass, embedding inversion, bulk extraction tested" + "notes": "Adversarial testing covering poisoning detection before each production model promotion" }, { "id": "LLM10", @@ -16868,8 +15399,8 @@ "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Output injection scenarios in AIMS testing — XSS, SQL injection, command injection via LLM output tested before deployment" + "scope": "Build", + "notes": "Output injection scenarios in security testing — XSS, SQL injection, command injection via LLM output" }, { "id": "ASI01", @@ -16878,7 +15409,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Goal hijack scenarios in AIMS testing — direct, indirect, multi-turn injection tested before each production release" + "notes": "Adversarial testing programme covering goal hijack — direct, indirect, multi-turn injection before each release" }, { "id": "ASI05", @@ -16887,50 +15418,77 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment" + "notes": "Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversarial testing of model outputs for poisoning indicators before deployment" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Security testing of all data ingestion interfaces including schema and semantic validation" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "SQL injection and privilege escalation testing on all LLM-to-database interfaces" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment" + "notes": "Integrity testing of RAG corpora — anomaly detection, source validation, content verification" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.2.8", - "control_name": "Monitoring of AI systems", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.3", + "control_name": "Information access restriction", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI systems monitored in operation — runtime injection detection as AIMS monitoring control" + "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access" }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Resource consumption monitored in operation — cost anomaly detection as AIMS monitoring control" + "scope": "Build", + "notes": "Access controls on system prompt storage — version controlled, access logged" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Production monitoring for accuracy degradation — hallucination rates tracked as AIMS operational monitoring" + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "RBAC on all vector store collections — no unauthenticated access to any collection" }, { "id": "ASI06", @@ -16939,102 +15497,127 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring" + "notes": "Access controls on all agent memory stores — only agent and designated administrators can write" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring" + "notes": "Access controls on RAG data sources limiting retrieval to authorised user scope" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.7.2", - "control_name": "Data quality", - "entries": [ + "notes": "Agent access restricted to minimum scope required per task" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use" + "notes": "Tools receive only the minimum context required for their function — not full conversation history" }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Third-party training datasets assessed for quality — provenance, completeness, representativeness, security" + "scope": "Build", + "notes": "Strict session and tenant isolation — one user's context cannot be accessed by another" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Training data quality requirements include integrity — anomaly detection, source allowlisting, provenance tracking as data quality controls" + "tier": "Foundational", + "scope": "Build", + "notes": "LLM-generated queries execute under least-privilege credentials matching the requesting user's access" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store content quality requirements — RBAC, encryption, source validation as data quality controls" + "notes": "RBAC enforced on all vector store collections — collection-level and namespace-level access control" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Training data from third-party sources assessed — same data quality criteria as internal data" + "scope": "Build", + "notes": "Context window content restricted to minimum required — no cross-trust-domain aggregation without access control" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls" + "notes": "API rate limiting, query restrictions, and anomaly detection limiting systematic model extraction" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.7.3", - "control_name": "Data provenance and characteristics", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.33", + "control_name": "Test information", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Appropriate protection of test and synthetic data used in AI development" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.7", + "control_name": "Protection against malware", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Endpoint AI agents subject to malware protection — extension integrity verification" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.8", + "control_name": "Management of technical vulnerabilities", + "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms" + "notes": "Scanning and patching LLM component vulnerabilities — model weights and inference runtime libraries" }, { "id": "LLM05", @@ -17043,117 +15626,122 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Training data provenance documented — full chain from source to training dataset, modification history tracked" + "notes": "Training pipeline dependency scanning — vulnerabilities in training infrastructure components" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts classified as sensitive operational data — provenance, access controls, handling requirements documented" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Embedding provenance documented — source document, classification, access controls tracked" + "notes": "Agent component CVEs in vulnerability management — ML libraries, inference runtime, MCP server dependencies" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented" + "notes": "Scanning and patching model components and training pipeline dependencies" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory provenance tracked — source, write access controls, TTL, modification history in AIMS" + "notes": "Vulnerability management extended to cover data integrity vulnerabilities in RAG pipelines" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.8.1", - "control_name": "Information for interested parties", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.9", + "control_name": "Configuration management", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Transparency about AI system limitations — users informed of advisory status, accuracy limitations, verification requirements" + "notes": "Model versions, adapters, and datasets managed with integrity and change controls" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential" - }, + "scope": "Build", + "notes": "Snapshot import and restore functionality hardened and version controlled" + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "10", + "control_name": "Improvement", + "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment" + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "A.9.1", - "control_name": "Use of AI systems", + "control_id": "4", + "control_name": "Context", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Guidance on appropriate AI system use — domains requiring human verification documented as AIMS use guidance" + "notes": "Foundational" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Guidance on AI system use — downstream consumers informed that LLM output must be validated before use" - }, + "notes": "Foundational" + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "4.2", + "control_name": "Context — interested parties", + "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content" + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.5", + "control_id": "5", "control_name": "Policy", "entries": [ { @@ -17173,12 +15761,21 @@ "tier": "Foundational", "scope": "Both", "notes": "Leadership commitment to AI transparency — AI disclosure and advisory labelling requirements in AI policy" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "entries": [ { @@ -17225,12 +15822,57 @@ "tier": "Foundational", "scope": "Both", "notes": "Cascade blast radius in AI risk register — maximum affected systems formally documented and accepted" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Hardening" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.7", + "control_id": "7", "control_name": "Support", "entries": [ { @@ -17250,12 +15892,21 @@ "tier": "Foundational", "scope": "Both", "notes": "Resources for AI systems include NHIs — agent identities inventoried and managed as AIMS resources" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.8", + "control_id": "8", "control_name": "Operation", "entries": [ { @@ -17275,12 +15926,57 @@ "tier": "Hardening", "scope": "Both", "notes": "A2A communication documented as AIMS operational control — authentication requirements, encryption standards" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "entries": [ { @@ -17309,14 +16005,77 @@ "tier": "Hardening", "scope": "Both", "notes": "Rogue agent detection rates and containment times in AIMS management review" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context", - "control_name": "Cl.4", + "control_id": "A.10.1", + "control_name": "Third-party AI system acquisition", "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Security requirements applied to all LLM component vendors — model providers, dataset suppliers, inference runtime vendors" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector database providers assessed as third-party AI system components" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Third-party services accessed via agent credentials assessed — security obligations in access arrangements" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A communication infrastructure providers assessed — security obligations in arrangements" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -17324,73 +16083,59 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" + "notes": "Hardening" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Context — interested parties", - "control_name": "Cl.4.2", - "entries": [ + "notes": "Hardening" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — access control", - "control_name": "A.7.2", - "entries": [ + "notes": "Hardening" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.10.2", + "control_name": "Customer relationships", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "LLM deployment obligations to downstream customers — what security properties are guaranteed" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed" }, { "id": "DSGAI06", @@ -17400,10 +16145,17 @@ "tier": "Foundational", "scope": "Both", "notes": "Hardening" - }, + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "A.2.2", + "control_name": "Policies — acceptable use", + "entries": [ { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -17411,71 +16163,55 @@ "notes": "Foundational" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Hardening" + "notes": "Foundational" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": "Foundational" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — governance", - "control_name": "A.7.2", - "entries": [ + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — minimisation", - "control_name": "A.7.2", + "control_id": "A.3.3", + "control_name": "Internal organisation — roles", "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": "Foundational" }, { @@ -17491,157 +16227,72 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — model artefacts", - "control_name": "A.7.3", + "control_id": "A.5.2", + "control_name": "Impact assessment", "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", - "entries": [ + "notes": "Impact assessment covers data disclosure risk — what data is in LLM scope, what is the disclosure impact per stakeholder" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "Impact assessment covers excessive agency risk — what actions can the LLM take autonomously, what is the worst-case impact" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Hardening" + "scope": "Both", + "notes": "AI impact assessment covers misinformation risk — which domains are affected, what is the consequence of incorrect output per stakeholder" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Hardening" + "notes": "Impact assessment covers goal hijack risk — what autonomous actions are possible if goal is redirected, who is affected" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — privacy-preserving", - "control_name": "A.7.2", - "entries": [ - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — provenance", - "control_name": "A.7.2", - "entries": [ + "notes": "Tool misuse impact assessed — what harm is possible if each tool is misused autonomously" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — quality", - "control_name": "A.7.3", - "entries": [ + "notes": "Impact of code execution capability formally assessed — RCE impact on persons and systems documented" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — acquisition", - "control_name": "A.7.2", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — preparation", - "control_name": "A.7.3", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", - "entries": [ + "notes": "Trust exploitation impact assessed — which persons are affected by AI decisions influenced by manipulated trust" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -17700,98 +16351,45 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Improvement", - "control_name": "Cl.10", + "control_id": "A.6.1.2", + "control_name": "Responsible AI system management", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Information for interested parties", - "control_name": "A.8.1", - "entries": [ + "notes": "LLM tool access managed responsibly — minimum permissions, human oversight requirements documented as AIMS responsibilities" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Internal organisation — roles", - "control_name": "A.3.3", - "entries": [ + "notes": "LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" + "notes": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Leadership", - "control_name": "Cl.5", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — decommissioning", - "control_name": "A.6.2.8", - "entries": [ - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", - "entries": [ + "notes": "Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -17844,15 +16442,159 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", - "entries": [ + "notes": "Foundational" + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "A.6.2.3", + "control_name": "AI system security", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "AI systems designed with security controls — input validation, context separation, injection detection as AIMS design requirements" + }, + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output scanning and redaction as AIMS security controls — DLP enforced at the system boundary" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool permission enforcement as AIMS security control — scope enforced at orchestration layer" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training pipeline integrity controls — input validation, source allowlisting as AIMS security design requirements" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Rate limiting and resource controls as AIMS security design requirements — enforced at deployment" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt encryption and access controls as AIMS security design requirements" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output encoding and schema validation as AIMS security design requirements — LLM output treated as untrusted input to downstream systems" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Goal-state verification and input validation as AIMS security design requirements — structural controls enforced at orchestration layer" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Per-tool permission manifests and parameter validation as AIMS security controls" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Component integrity verification as AIMS security design requirement — cryptographic signatures before loading" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Sandbox, static analysis, and allowlist as AIMS security design requirements for code execution capability" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory store access controls and integrity monitoring as AIMS security design requirements" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A authentication, encryption, and schema validation as AIMS security design requirements" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Circuit breakers and blast radius limits as AIMS security design requirements" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Scope constraints enforced at infrastructure layer — rogue agent cannot exceed permission envelope" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -17920,9 +16662,72 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Testing of AI systems", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "AI systems tested before deployment — adversarial testing for prompt injection as AIMS testing requirement" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Poisoning detection in AIMS testing — backdoor trigger testing, biased output detection before each production promotion" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store attacks in AIMS testing — RBAC bypass, embedding inversion, bulk extraction tested" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output injection scenarios in AIMS testing — XSS, SQL injection, command injection via LLM output tested before deployment" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Goal hijack scenarios in AIMS testing — direct, indirect, multi-turn injection tested before each production release" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -17990,44 +16795,62 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "A.6.2.8", + "control_name": "Monitoring of AI systems", "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "AI systems monitored in operation — runtime injection detection as AIMS monitoring control" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "Resource consumption monitored in operation — cost anomaly detection as AIMS monitoring control" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Production monitoring for accuracy degradation — hallucination rates tracked as AIMS operational monitoring" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control" }, { "id": "DSGAI17", @@ -18042,25 +16865,99 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Performance evaluation", - "control_name": "Cl.9", + "control_id": "A.7.2", + "control_name": "Data quality", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use" + }, + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Third-party training datasets assessed for quality — provenance, completeness, representativeness, security" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data quality requirements include integrity — anomaly detection, source allowlisting, provenance tracking as data quality controls" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store content quality requirements — RBAC, encryption, source validation as data quality controls" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Training data from third-party sources assessed — same data quality criteria as internal data" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", - "entries": [ + }, { "id": "DSGAI07", "name": "Data Governance and Lifecycle", @@ -18068,14 +16965,14 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "Foundational" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": "Hardening" }, @@ -18089,42 +16986,26 @@ "notes": "Hardening" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": "Foundational" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -18141,37 +17022,23 @@ "notes": "Foundational" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Policies — acceptable use", - "control_name": "A.2.2", - "entries": [ + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Support", - "control_name": "Cl.7", - "entries": [ + "notes": "Hardening" + }, { "id": "DSGAI19", "name": "Human-in-Loop and Labeler Overexposure", @@ -18180,17 +17047,107 @@ "tier": "Foundational", "scope": "Both", "notes": "Foundational" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party", - "control_name": "A.10.1", + "control_id": "A.7.3", + "control_name": "Data provenance and characteristics", "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data provenance documented — full chain from source to training dataset, modification history tracked" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompts classified as sensitive operational data — provenance, access controls, handling requirements documented" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Embedding provenance documented — source document, classification, access controls tracked" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory provenance tracked — source, write access controls, TTL, modification history in AIMS" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Hardening" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -18198,43 +17155,38 @@ "notes": "Hardening" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Hardening" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — AI supply chain", - "control_name": "A.10.1", - "entries": [ + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — customer data", - "control_name": "A.10.2", - "entries": [ + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": "Hardening" } @@ -18242,25 +17194,45 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party relationships", - "control_name": "A.10.1", + "control_id": "A.8.1", + "control_name": "Information for interested parties", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Transparency about AI system limitations — users informed of advisory status, accuracy limitations, verification requirements" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Transparency", - "control_name": "A.8.1", - "entries": [ + }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", @@ -18274,9 +17246,36 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "entries": [ + { + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Guidance on appropriate AI system use — domains requiring human verification documented as AIMS use guidance" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Guidance on AI system use — downstream consumers informed that LLM output must be validated before use" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -24240,265 +23239,54 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial red-team testing against goal hijacking vectors including injection through every data source, tool output, and context channel", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validates goal integrity controls under realistic attack conditions" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing of cascade failure paths — test error propagation, hallucination amplification, and runaway automation scenarios", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validates cascade prevention controls under attack conditions" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting code execution — sandbox escapes, resource limit bypasses, self-modification, and host system access through generated code", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validates execution boundary controls under attack conditions" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting emerging agentic patterns — self-evolution, prompt self-modification, autonomous tool acquisition, and dynamic agent creation", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PS.1.1-PS", + "control_name": "Protect all forms of code and data from unauthorised access — training and retrieval corpora", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validates controls against novel attack surfaces" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit privilege boundaries for each agent identity — maximum permitted privilege level, credential scope, and escalation constraints", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Establishes privilege boundaries as mandatory requirements" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit requirements for maximum automation depth, step limits, cost budgets, and mandatory human checkpoints for each agent workflow", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ + "notes": "Classify and access-control training datasets, fine-tuning corpora, and retrieval indexes; restrict who and what can read each store, and log every access" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Establishes automation boundaries as mandatory requirements" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements constraining permitted tool invocation sequences and cross-tool data flows for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ + "notes": "Protect training data repositories, fine-tuning datasets, and ML pipeline code from unauthorised read, write, and modification" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Establishes chaining constraints as mandatory requirements" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements specifying the maximum permitted tool access, API scope, data source access, and resource boundaries for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ + "notes": "Classify system prompts as sensitive configuration artefacts; apply access controls, version control, and audit logging to all prompt stores" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Build", - "notes": "Establishes access control as a mandatory deployment requirement" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for cascade failure incidents including automatic circuit breaker activation, workflow suspension, cost cap enforcement, and rollback", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid response to cascading automation failures" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for dependency failures — graceful degradation, fallback providers, workflow suspension, and stakeholder notification", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures operational continuity during dependency outages" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Design circuit breakers, step limits, cost budgets, and human approval gates as explicit security requirements for all agentic automation workflows", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures cascade prevention is a design-phase requirement" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring and triage procedures for privilege escalation incidents — detect agents operating beyond their assigned privilege level", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ + "notes": "Classify embedding stores and vector databases as sensitive AI artefacts; apply access controls, encryption at rest/in transit, and audit logging" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid detection of privilege escalation in production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for anomalous tool invocation sequences; define triage procedures for suspected lateral chaining incidents", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", "scope": "Build", - "notes": "Enables detection of chaining attacks in production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for emergent agent behaviours — detect agents acquiring new capabilities, modifying their own definitions, or spawning sub-agents outside approved patterns", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables detection of emerging risks in production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish procedures to identify goal hijacking incidents in production including goal deviation monitoring, triage, and confirmation workflows", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid detection and response to goal manipulation in live systems" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Implement secure coding for agent code execution — sandbox isolation, input validation for code generation, output filtering, and prevention of self-modification", - "control_name": "PW.5.1-PS – Secure coding practices", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prevents code execution vulnerabilities in agent implementation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Implement secure credential handling — agents must not inherit user credentials, store tokens in context, or pass credentials between agents without explicit authorisation", - "control_name": "PW.5.1-PS – Secure coding practices", - "entries": [ + "notes": "Prevents tampering with access control configuration" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -24506,95 +23294,8 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prevents credential leakage through agent code paths" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Maintain a secure, versioned registry of all agent components with provenance records; enable auditability and rollback", - "control_name": "PS.3.1-PS – Archive and protect software releases", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures traceability and recovery capability for supply chain incidents" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Maintain versioned, integrity-verified snapshots of agent memory and context stores; enable rollback to pre-poisoning states", - "control_name": "PS.3.1-PS – Archive and protect software releases", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures recovery capability for memory poisoning incidents" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Monitor all agent dependencies for availability, behavioural consistency, and security posture changes; establish triage procedures for dependency degradation events", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid detection of dependency failures" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Monitor for newly disclosed vulnerabilities in third-party agent components; establish a triage process for AI-specific supply chain disclosures", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid response to supply chain compromises" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect agent configuration files, tool manifests, permission policies, and orchestration definitions from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Prevents tampering with access control configuration" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect agent execution environments, sandbox configurations, and runtime constraints from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ + "notes": "Prevents tampering with privilege boundaries" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -24603,14 +23304,7 @@ "tier": "Foundational", "scope": "Both", "notes": "Prevents weakening of execution boundaries through configuration tampering" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect agent memory stores, context databases, and shared state repositories from unauthorised read, write, and modification; enforce access controls per agent identity", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -24619,65 +23313,6 @@ "tier": "Foundational", "scope": "Both", "notes": "Prevents direct tampering with agent memory and context" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect credential stores, identity configurations, and privilege mapping files from unauthorised access and modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prevents tampering with privilege boundaries" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "PS.1.1-PS", - "control_name": "Protect all forms of code and data from unauthorised access — training and retrieval corpora", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Classify and access-control training datasets, fine-tuning corpora, and retrieval indexes; restrict who and what can read each store, and log every access" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Protect training data repositories, fine-tuning datasets, and ML pipeline code from unauthorised read, write, and modification" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Classify system prompts as sensitive configuration artefacts; apply access controls, version control, and audit logging to all prompt stores" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Classify embedding stores and vector databases as sensitive AI artefacts; apply access controls, encryption at rest/in transit, and audit logging" }, { "id": "DSGAI01", @@ -24785,6 +23420,24 @@ "scope": "Build", "notes": "Verify that the model artifact serving output has not been tampered with; maintain signed model checksums and verify before deployment" }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Detects tampering in agent supply chain artefacts" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Detects dependency degradation and tampering" + }, { "id": "DSGAI05", "name": "Data Integrity and Validation Failures", @@ -24828,6 +23481,24 @@ "scope": "Both", "notes": "Maintain versioned, integrity-verified training data snapshots and model checkpoints in a secure model registry; enable rollback" }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures traceability and recovery capability for supply chain incidents" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures recovery capability for memory poisoning incidents" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -24898,6 +23569,42 @@ "scope": "Build", "notes": "Define explicit security requirements limiting the capabilities, tool access, and autonomous action scope permitted for each AI deployment" }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Establishes access control as a mandatory deployment requirement" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Establishes privilege boundaries as mandatory requirements" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Establishes chaining constraints as mandatory requirements" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Establishes automation boundaries as mandatory requirements" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -25040,6 +23747,51 @@ "scope": "Both", "notes": "Design AI systems to surface confidence indicators, source citations, and uncertainty signals in output; include as explicit security and quality requirements" }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures goal integrity is a design-phase requirement for all agentic systems" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Ensures access boundaries are designed before implementation" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures code execution boundaries are designed before implementation" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Ensures chaining risks are addressed at design time" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures cascade prevention is a design-phase requirement" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -25146,6 +23898,24 @@ "scope": "Build", "notes": "Vet vector database platforms and embedding model providers for security posture before adoption; review access control capabilities" }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents introduction of compromised components into agent pipelines" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents adoption of unreliable dependencies" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -25216,6 +23986,24 @@ "scope": "Build", "notes": "Implement secure coding practices for all code paths that consume LLM output; treat model responses as untrusted input to downstream systems" }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents credential leakage through agent code paths" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents code execution vulnerabilities in agent implementation" + }, { "id": "DSGAI08", "name": "Non-Compliance and Regulatory Violations", @@ -25287,136 +24075,14 @@ "notes": "Include output injection and unsafe rendering scenarios in pre-release security reviews; verify that output sanitisation controls are present and effective" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data leakage and memorisation scenarios in pre-release security reviews; verify that outputs cannot reveal training data or sensitive context" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Review synthetic data for bias inheritance, privacy leakage, and statistical fidelity before use in training pipelines; verify privacy guarantees are meaningful" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data misuse and manipulation scenarios in pre-release reviews; verify that purpose limitation controls are enforced and cannot be bypassed" - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include bias, fairness, and discrimination testing in pre-release model behaviour reviews; assess model outputs across protected attributes and demographic groups" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "PW.8.2-PS", - "control_name": "Test for security vulnerabilities — adversarial / red-team", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Conduct adversarial testing (red-teaming) against prompt injection vectors before each production release; cover direct, indirect, and multimodal injection paths" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial testing targeting excessive agency through indirect injection and permission escalation scenarios" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", "scope": "Both", - "notes": "Conduct adversarial resource consumption testing (sponge examples, token amplification, recursive context injection) before each production release" - }, - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Conduct adversarial and behavioural testing covering hallucination rates, factual accuracy, and misinformation generation potential before each release" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial prompt extraction testing against all known extraction techniques before deployment and after each system prompt change" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial testing of retrieval pipelines including embedding inversion, retrieval poisoning, and semantic search manipulation scenarios" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Include output-based injection testing (XSS, SQLi, CMDi via LLM output) in adversarial test suites" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial testing of synthetic data for membership inference, attribute inference, and reconstruction attacks to validate privacy claims" + "notes": "Catches goal manipulation vulnerabilities before production deployment" }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Conduct adversarial testing for discriminatory outputs; test model behaviour across demographic groups, intersectional categories, and edge cases" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent access control enforcement — verify that tool permission manifests, RBAC policies, and tenant isolation boundaries are correctly implemented and cannot be bypassed", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -25425,62 +24091,7 @@ "tier": "Foundational", "scope": "Build", "notes": "Validates access controls before production deployment" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for chain-based scope violations — verify that multi-step tool sequences cannot achieve outcomes exceeding individual tool permissions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Catches chaining vulnerabilities before production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for emergent capabilities — verify that self-modification, dynamic tool discovery, and autonomous agent spawning do not create unintended security exposures", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Catches emergent pattern risks before production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for goal deviation — verify that the agent maintains intended objectives under adversarial input conditions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Catches goal manipulation vulnerabilities before production deployment" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for memory-influenced anomalies — verify that persistent memory and shared context do not introduce unintended behaviour changes across sessions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -25489,220 +24100,131 @@ "tier": "Foundational", "scope": "Both", "notes": "Catches memory poisoning effects before they propagate" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "RV.1.1-PS", - "control_name": "Identify and confirm vulnerabilities — AI-specific", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to identify prompt injection incidents in production including monitoring, triage, and confirmation workflows" - }, - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to identify, triage, and confirm disclosure incidents in production, including notification paths for regulated data" - }, - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor for newly disclosed vulnerabilities in third-party AI components; establish a triage process for AI-specific CVEs" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to detect and triage misinformation incidents in production including user feedback channels, automated fact-checking, and output monitoring" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to detect data access anomalies using audit logs; define triage workflows for suspicious access patterns across AI data stores" + "scope": "Build", + "notes": "Catches chaining vulnerabilities before production" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Establish procedures to identify data exposure from shadow AI tool usage; define triage and remediation workflows for unsanctioned data processing" + "notes": "Catches emergent pattern risks before production" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Establish procedures to detect data misuse and manipulation in production including monitoring for purpose-scope violations and data manipulation patterns" + "notes": "Include data leakage and memorisation scenarios in pre-release security reviews; verify that outputs cannot reveal training data or sensitive context" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Monitor for security advisories and quality issues from third-party data providers; establish triage procedures for third-party data incidents" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "RV.2.1-PS", - "control_name": "Assess, prioritise, and remediate — availability remediation", - "entries": [ + "scope": "Build", + "notes": "Review synthetic data for bias inheritance, privacy leakage, and statistical fidelity before use in training pipelines; verify privacy guarantees are meaningful" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Define and test remediation procedures for availability incidents — rate limit tightening, model rollback, cost circuit breaker activation" + "notes": "Include data misuse and manipulation scenarios in pre-release reviews; verify that purpose limitation controls are enforced and cannot be bypassed" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Define procedures to assess and remediate data deletion requests including impact analysis on trained models and retraining requirements" + "notes": "Include bias, fairness, and discrimination testing in pre-release model behaviour reviews; assess model outputs across protected attributes and demographic groups" } ] }, { "framework": "NIST SP 800-218A", - "control_id": "RV.3.1-PS", - "control_name": "Analyse root causes — training data forensics", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities — adversarial / red-team", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "When poisoning is detected, conduct training data analysis to identify the poisoned records, their source, and the blast radius" + "notes": "Conduct adversarial testing (red-teaming) against prompt injection vectors before each production release; cover direct, indirect, and multimodal injection paths" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "When an embedding or retrieval security incident occurs, conduct forensic analysis of the vector store, ingestion pipeline, and query patterns" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "When poisoning is detected, conduct forensic analysis to identify corrupted records, trace to source, and determine blast radius across dependent models" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", "scope": "Build", - "notes": "When model failures trace to synthetic training data, conduct root cause analysis of the generation process, source data, and privacy mechanism" + "notes": "Conduct adversarial testing targeting excessive agency through indirect injection and permission escalation scenarios" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "When discriminatory behaviour is identified, conduct root cause analysis tracing bias to specific training data sources, labelling processes, or preprocessing steps" + "notes": "Conduct adversarial resource consumption testing (sponge examples, token amplification, recursive context injection) before each production release" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "When data governance failures contribute to AI incidents, conduct root cause analysis to identify governance gaps and strengthen frameworks" + "notes": "Conduct adversarial and behavioural testing covering hallucination rates, factual accuracy, and misinformation generation potential before each release" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "When regulatory non-compliance is identified, conduct root cause analysis to determine the gap, affected data subjects, and required remediation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model all agent access paths to tools, data stores, and APIs; design least-privilege tool manifests and enforce tenant isolation by design", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ + "scope": "Build", + "notes": "Conduct adversarial prompt extraction testing against all known extraction techniques before deployment and after each system prompt change" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Build", - "notes": "Ensures access boundaries are designed before implementation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model all code execution paths in agent workflows; design sandboxing, resource limits, and execution constraints as explicit security requirements", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ + "notes": "Conduct adversarial testing of retrieval pipelines including embedding inversion, retrieval poisoning, and semantic search manipulation scenarios" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Ensures code execution boundaries are designed before implementation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model the agent pipeline for adversarial goal manipulation vectors including direct injection, indirect injection via tool outputs, and context poisoning", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ + "scope": "Build", + "notes": "Include output-based injection testing (XSS, SQLi, CMDi via LLM output) in adversarial test suites" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -25710,95 +24232,26 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ensures goal integrity is a design-phase requirement for all agentic systems" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model tool interaction graphs — identify composite action sequences that could achieve unauthorised outcomes; design controls for chain-level authorisation", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Ensures chaining risks are addressed at design time" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Verify integrity of all agent artefacts and third-party components using cryptographic signatures and checksums before deployment", - "control_name": "PS.2.1-PS – Verify software integrity", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Detects tampering in agent supply chain artefacts" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Verify that external dependency responses are consistent with expected behaviour — detect API version changes, model swaps, or degraded output quality that could affect agent correctness", - "control_name": "PS.2.1-PS – Verify software integrity", - "entries": [ + "notes": "Validates goal integrity controls under realistic attack conditions" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Detects dependency degradation and tampering" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Vet all external agent dependencies — LLM APIs, tool endpoints, MCP servers, orchestration platforms — for reliability, security posture, and failure mode characteristics before adoption", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", - "entries": [ + "notes": "Validates execution boundary controls under attack conditions" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prevents adoption of unreliable dependencies" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Vet all third-party agent components — tools, plugins, MCP servers, model weights, orchestration libraries — for provenance, integrity, and security posture before use", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Prevents introduction of compromised components into agent pipelines" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "When incidents involve novel agentic patterns, conduct root cause analysis focused on understanding the emergent capability and its security implications", - "control_name": "RV.3.1-PS – Analyse root causes", - "entries": [ + "notes": "Validates cascade prevention controls under attack conditions" + }, { "id": "ASI09", "name": "Human-Agent Trust Exploitation", @@ -25806,30 +24259,32 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Builds organisational knowledge of emerging agentic risks" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "When memory poisoning is detected, conduct forensic analysis to identify the poisoned records, their ingestion source, propagation path, and blast radius across agents", - "control_name": "RV.3.1-PS – Analyse root causes", - "entries": [ + "notes": "Validates controls against novel attack surfaces" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "Conduct adversarial testing of synthetic data for membership inference, attribute inference, and reconstruction attacks to validate privacy claims" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enables thorough incident response for memory poisoning events" + "notes": "Conduct adversarial testing for discriminatory outputs; test model behaviour across demographic groups, intersectional categories, and edge cases" } ] }, { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "framework": "NIST SP 800-218A", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities — AI-specific", "entries": [ { "id": "LLM01", @@ -25838,7 +24293,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope" + "notes": "Establish procedures to identify prompt injection incidents in production including monitoring, triage, and confirmation workflows" }, { "id": "LLM02", @@ -25847,16 +24302,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier" + "notes": "Establish procedures to identify, triage, and confirm disclosure incidents in production, including notification paths for regulated data" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction" + "notes": "Monitor for newly disclosed vulnerabilities in third-party AI components; establish a triage process for AI-specific CVEs" }, { "id": "LLM07", @@ -25865,305 +24320,210 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM advisory outputs restricted to defined advisory roles — never authoritative source for safety-critical procedures" + "notes": "Establish procedures to detect and triage misinformation incidents in production including user feedback channels, automated fact-checking, and output monitoring" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt access restricted to authorised personnel — version controlled, access logged" + "notes": "Enables rapid detection and response to goal manipulation in live systems" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Access controls on OT vector stores — RBAC enforced at collection level" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess availability risks for OT systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Enables rapid detection of privilege escalation in production" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM resource consumption impact assessed on shared OT network and compute infrastructure" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess confidentiality of OT data", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Enables rapid response to supply chain compromises" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "OT data classification applied to all data accessible by LLMs" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess impact of unauthorised access and control", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "scope": "Build", + "notes": "Enables detection of chaining attacks in production" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess integrity risks for all OT-connected systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Enables detection of emerging risks in production" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Model poisoning scenarios included in OT risk assessment for each LLM" + "notes": "Enables rapid detection of dependency failures" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store integrity included in OT LLM risk assessment" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess reliability of OT advisory systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Establish procedures to detect data access anomalies using audit logs; define triage workflows for suspicious access patterns across AI data stores" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM accuracy limitations assessed in OT risk assessment per use case" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks degrading the reliability of OT decision-support", - "control_name": "Section 5.3 — Integrity threats", - "entries": [ + "notes": "Establish procedures to identify data exposure from shadow AI tool usage; define triage and remediation workflows for unsanctioned data processing" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM misinformation as an integrity attack on operator decision-making" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting OT data and system integrity", - "control_name": "Section 5.3 — Integrity threats", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Model poisoning as an integrity attack on the LLM advisory system" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting the integrity of OT decision-support data", - "control_name": "Section 5.3 — Integrity threats", - "entries": [ + "notes": "Establish procedures to detect data misuse and manipulation in production including monitoring for purpose-scope violations and data manipulation patterns" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store poisoning as an integrity attack on LLM knowledge sources" + "notes": "Monitor for security advisories and quality issues from third-party data providers; establish triage procedures for third-party data incidents" } ] }, { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "framework": "NIST SP 800-218A", + "control_id": "RV.2.1-PS", + "control_name": "Assess, prioritise, and remediate — availability remediation", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action" + "notes": "Define and test remediation procedures for availability incidents — rate limit tightening, model rollback, cost circuit breaker activation" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM resource consumption logged — patterns indicating exhaustion attacks detectable" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Availability risks", - "control_name": "§5.6", - "entries": [ + "notes": "Enables rapid response to cascading automation failures" + }, { "id": "ASI10", "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Cascading failure across OT components" + "notes": "Ensures operational continuity during dependency outages" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "OT GenAI pipeline failure as availability risk" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Code injection and execution via data paths", - "control_name": "Section 5.3 — Threats", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary" + "notes": "Define procedures to assess and remediate data deletion requests including impact analysis on trained models and retraining requirements" } ] }, { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Common ICS vulnerabilities", - "control_name": "§5.3", + "framework": "NIST SP 800-218A", + "control_id": "RV.3.1-PS", + "control_name": "Analyse root causes — training data forensics", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Excessive privilege is specifically listed as OT vulnerability class" + "notes": "When poisoning is detected, conduct training data analysis to identify the poisoned records, their source, and the blast radius" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Injection via OT data feeds is a documented attack vector" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", - "entries": [ + "scope": "Build", + "notes": "When an embedding or retrieval security incident occurs, conduct forensic analysis of the vector store, ingestion pipeline, and query patterns" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT data confidentiality requirements apply to training data" + "notes": "Enables thorough incident response for memory poisoning events" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT data in retrieval corpora requires access control" + "notes": "Builds organisational knowledge of emerging agentic risks" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT knowledge encoded in models requires protection" + "notes": "When poisoning is detected, conduct forensic analysis to identify corrupted records, trace to source, and determine blast radius across dependent models" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "When model failures trace to synthetic training data, conduct root cause analysis of the generation process, source data, and privacy mechanism" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT-trained model weights are sensitive OT intellectual property" + "notes": "When discriminatory behaviour is identified, conduct root cause analysis tracing bias to specific training data sources, labelling processes, or preprocessing steps" }, { "id": "DSGAI18", @@ -26172,30 +24532,23 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Retention of OT data beyond required period is a confidentiality risk" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality risks in OT", - "control_name": "§5.4", - "entries": [ + "notes": "When data governance failures contribute to AI incidents, conduct root cause analysis to identify governance gaps and strengthen frameworks" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT data exfiltration via compromised automation" + "notes": "When regulatory non-compliance is identified, conduct root cause analysis to determine the gap, affected data subjects, and required remediation" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Defense-in-depth network architecture with validated data flows", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§5.3", + "control_name": "Threats", "entries": [ { "id": "LLM01", @@ -26204,63 +24557,71 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of service attacks targeting OT availability", - "control_name": "Section 5.6 — DoS threats", - "entries": [ + "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM-induced resource exhaustion as a DoS vector affecting shared OT network infrastructure" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of Service Protection", - "control_name": "SC-5", - "entries": [ + "notes": "LLM autonomous actions as a new path for unauthorised command execution" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Model poisoning as an integrity attack on the LLM advisory system" + }, + { + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM infrastructure protected against resource exhaustion attacks affecting OT availability" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Fail-Safe Procedures", - "control_name": "SI-17", - "entries": [ + "notes": "LLM misinformation as an integrity attack on operator decision-making" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store poisoning as an integrity attack on LLM knowledge sources" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", - "entries": [ + "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Injection via historian and SCADA data feeds" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Excessive privilege is specifically listed as OT vulnerability class" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -26297,6 +24658,15 @@ "scope": "Both", "notes": "Inadequate human oversight cited as OT vulnerability category" }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Injection via OT data feeds is a documented attack vector" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -26333,6 +24703,15 @@ "scope": "Both", "notes": "Excessive OT data access is a documented vulnerability" }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Corpus manipulation directly threatens OT operational integrity" + }, { "id": "DSGAI10", "name": "Synthetic Data and Anonymization Pitfalls", @@ -26355,40 +24734,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities — data integrity", - "control_name": "§5.3", - "entries": [ - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Corpus manipulation directly threatens OT operational integrity" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Identify threats, vulnerabilities, and impacts for all OT systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prompt injection documented in OT risk assessment for each LLM integration" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information disclosure and OT espionage", - "control_name": "Section 5.4 — Threats", + "control_id": "§5.4", + "control_name": "Threats", "entries": [ { "id": "LLM02", @@ -26398,178 +24745,16 @@ "tier": "Foundational", "scope": "Both", "notes": "LLMs with historian access as a new vector for automated OT intelligence gathering" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Training data validation — adversarial content detected and rejected before training" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Layered controls to maintain system integrity", - "control_name": "Section 7.2 — Defense-in-depth", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Independent validation of LLM outputs against rule-based reference systems" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Functionality", - "control_name": "CM-7", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Privilege", - "control_name": "AC-6", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious code and logic attacks via IT/OT convergence", - "control_name": "Section 5.3 — Threats", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Treat prompt injection as a malicious code analog — detection and response controls required" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs" + "notes": "System prompts containing OT specifics treated as sensitive configuration data" }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM output scanning for malicious content before OT system ingestion" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Minimal necessary connectivity at IT/OT boundary", - "control_name": "Section 7.1 — Architecture", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM access to OT systems restricted to minimum required — read-only by default" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network architecture preventing DoS propagation", - "control_name": "Section 7.2 — Network segmentation", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM infrastructure isolated from OT control network — bandwidth caps at DMZ boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", - "entries": [ { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -26577,7 +24762,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitor all outbound data from OT zone" + "notes": "OT data exfiltration via compromised automation" }, { "id": "DSGAI03", @@ -26586,7 +24771,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor for unexpected exfiltration of OT training data" + "notes": "OT data confidentiality requirements apply to training data" }, { "id": "DSGAI06", @@ -26595,7 +24780,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor outputs for OT data disclosure patterns" + "notes": "OT data must not be disclosed without authorisation" }, { "id": "DSGAI08", @@ -26604,7 +24789,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitor retrieval patterns for unauthorised OT data access" + "notes": "OT data in retrieval corpora requires access control" }, { "id": "DSGAI12", @@ -26613,16 +24798,7 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Monitor for systematic extraction query patterns" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor OT tool data flows" + "notes": "OT knowledge encoded in models requires protection" }, { "id": "DSGAI14", @@ -26631,7 +24807,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitor model storage access patterns" + "notes": "OT-trained model weights are sensitive OT intellectual property" }, { "id": "DSGAI15", @@ -26640,154 +24816,128 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor inference data leaving OT boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT configuration and topology data as espionage target", - "control_name": "Section 5.4 — Information disclosure", - "entries": [ + "notes": "Inference inputs are OT data and require protection" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts containing OT specifics treated as sensitive configuration data" + "notes": "Retention of OT data beyond required period is a confidentiality risk" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT data confidentiality", - "control_name": "§5.4", + "control_id": "§5.5", + "control_name": "Supply chain threats", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT data must not be disclosed without authorisation" + "notes": "LLM model weights and plugins as supply chain risk components" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Inference inputs are OT data and require protection" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security awareness and training", - "control_name": "Section 8.2 — Training", - "entries": [ + "notes": "Third-party tool components in OT" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Operator training on LLM limitations and verification requirements" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", - "entries": [ + "notes": "Expanded to include agentic AI components" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Governance policy for autonomous OT systems" + "notes": "Third-party OT tool data leakage" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Compliance programme for OT GenAI deployments" + "notes": "Third-party data in OT context" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data lineage as OT governance requirement" + "notes": "Model components are supply chain assets in OT" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT supply chain risk management programme", - "control_name": "Section 8.4 — Supply chain programme", + "control_id": "§5.6", + "control_name": "DoS threats", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting OT data at rest and in transit", - "control_name": "Section 7.3 — Data protection", - "entries": [ + "notes": "LLM-induced resource exhaustion as a DoS vector affecting shared OT network infrastructure" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Encryption and access controls on all OT data paths feeding LLM context" + "notes": "Cascading failure across OT components" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "OT GenAI pipeline failure as availability risk" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting sensitive OT data", - "control_name": "Section 7.3 — Data protection", + "control_id": "§6.2", + "control_name": "Risk assessment", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt encryption and access controls as data protection measures" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Audit Information", - "control_name": "AU-9", - "entries": [ + "notes": "Prompt injection documented in OT risk assessment for each LLM integration" + }, { "id": "LLM02", "name": "Sensitive Information Disclosure", @@ -26795,41 +24945,43 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM" + "notes": "OT data classification applied to all data accessible by LLMs" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt access logs protected — unauthorised access attempts detectable" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", - "entries": [ + "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Model poisoning scenarios included in OT risk assessment for each LLM" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches" + "notes": "LLM resource consumption impact assessed on shared OT network and compute infrastructure" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" + "notes": "LLM accuracy limitations assessed in OT risk assessment per use case" }, { "id": "LLM09", @@ -26838,15 +24990,8 @@ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "OT vector store content encrypted at rest" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", - "entries": [ + "notes": "Vector store integrity included in OT LLM risk assessment" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -27085,25 +25230,79 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Role-Based Training", - "control_name": "AT-3", + "control_id": "§6.3", + "control_name": "Risk response", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools" + "notes": "ML SBOM and component integrity verification as supply chain controls" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool integration approval process" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "SBOM and vendor assessment for agentic stack" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool data scope in OT security assessment" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Data source assessment for OT GenAI" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Model provenance for OT deployments" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Architecture", "entries": [ + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM access to OT systems restricted to minimum required — read-only by default" + }, { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -27144,9 +25343,54 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Network segmentation", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Independent validation of LLM outputs against rule-based reference systems" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM infrastructure isolated from OT control network — bandwidth caps at DMZ boundary" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Input validation mandatory at OT data boundary" + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -27214,115 +25458,71 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls for ICS", - "control_name": "§7.2", + "control_id": "§7.3", + "control_name": "Data protection", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Input validation mandatory at OT data boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Software, Firmware, and Information Integrity", - "control_name": "SI-7", - "entries": [ + "notes": "Encryption and access controls on all OT data paths feeding LLM context" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Model integrity verification before each OT deployment — hash-based integrity check" + "notes": "System prompt encryption and access controls as data protection measures" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Vector store integrity monitoring — alert on anomalous content or unexpected modifications" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supplier Assessments and Reviews", - "control_name": "SR-6", - "entries": [ + "notes": "Monitor all outbound data from OT zone" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Periodic security assessment of LLM vendors with OT-deployed components" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Controls and Plans", - "control_name": "SR-3", - "entries": [ + "notes": "Monitor for unexpected exfiltration of OT training data" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Documented supply chain security plan covering LLM components in OT deployment" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Protection", - "control_name": "SA-12", - "entries": [ + "notes": "Monitor outputs for OT data disclosure patterns" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Tool integration approval process" + "notes": "Monitor retrieval patterns for unauthorised OT data access" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "SBOM and vendor assessment for agentic stack" + "notes": "Monitor for systematic extraction query patterns" }, { "id": "DSGAI13", @@ -27331,101 +25531,85 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool data scope in OT security assessment" + "notes": "Monitor OT tool data flows" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Data source assessment for OT GenAI" + "notes": "Monitor model storage access patterns" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model provenance for OT deployments" + "notes": "Monitor inference data leaving OT boundary" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk treatment", - "control_name": "Section 6.3 — Risk response", + "control_id": "§8.2", + "control_name": "Training", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "ML SBOM and component integrity verification as supply chain controls" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Third-party tool components in OT" + "notes": "Operator training on LLM limitations and verification requirements" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Expanded to include agentic AI components" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Third-party OT tool data leakage" + "notes": "Governance policy for autonomous OT systems" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Third-party data in OT context" + "notes": "Compliance programme for OT GenAI deployments" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model components are supply chain assets in OT" + "notes": "Data lineage as OT governance requirement" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Supply chain programme", "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -27466,24 +25650,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party software compromise as OT attack vector", - "control_name": "Section 5.5 — Supply chain threats", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM model weights and plugins as supply chain risk components" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", + "control_id": "AC-3", + "control_name": "Access Enforcement", "entries": [ { "id": "LLM01", @@ -27492,7 +25660,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope" }, { "id": "LLM02", @@ -27501,7 +25669,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier" }, { "id": "LLM03", @@ -27510,34 +25678,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Application" + "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction" }, { "id": "LLM07", @@ -27546,7 +25687,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "LLM advisory outputs restricted to defined advisory roles — never authoritative source for safety-critical procedures" }, { "id": "LLM08", @@ -27555,7 +25696,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "System prompt access restricted to authorised personnel — version controlled, access logged" }, { "id": "LLM09", @@ -27564,320 +25705,171 @@ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Application" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Unauthorised command execution via IT/OT interfaces", - "control_name": "Section 5.3 — Threats", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM autonomous actions as a new path for unauthorised command execution" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Validated data flows across zone boundaries", - "control_name": "Section 7.2 — Network segmentation", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems" + "notes": "Access controls on OT vector stores — RBAC enforced at collection level" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Vulnerabilities common to IT/OT", - "control_name": "§5.3", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Injection via historian and SCADA data feeds" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "A2A audit completeness", - "control_name": "LMT — Logging & Monitoring", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Verify all A2A messages are logged with sender identity and content hash" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "A2A authentication enforcement", - "control_name": "ACT — Access Control", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Action audit completeness", - "control_name": "LMT — Logging & Monitoring", + "control_id": "AC-6", + "control_name": "Least Privilege", "entries": [ { "id": "LLM03", "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Advisory label persistence", - "control_name": "OHT — Output Handling", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Verify advisory labels persist through all rendering environments" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "AI disclosure enforcement", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor behaviour detection", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor trigger detection", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural baseline establishment and deviation", - "control_name": "AST — Agent-Specific", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection" + "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural change detection post-update", - "control_name": "MBT — Model Behaviour", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "AT-3", + "control_name": "Role-Based Training", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update" + "notes": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Blast radius containment", - "control_name": "AST — Agent-Specific", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Cascade detection alert", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify monitoring raises alert on cascade indicators before physical impact" + "notes": "LLM resource consumption logged — patterns indicating exhaustion attacks detectable" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Circuit breaker trigger and recovery", - "control_name": "AVT — Availability", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "AU-9", + "control_name": "Protection of Audit Information", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path" + "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt access logs protected — unauthorised access attempts detectable" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Citation verifiability", - "control_name": "OHT — Output Handling", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "CM-7", + "control_name": "Least Functionality", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that citations generated by the LLM are real and accurately represent source content; test that outputs requiring citations enforce this" + "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Code injection via crafted prompts", - "control_name": "IHT — Input Handling", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SA-12", + "control_name": "Supply Chain Protection", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands" + "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Component integrity verification", - "control_name": "SCT — Supply Chain", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components" + "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors" + "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "OT vector store content encrypted at rest" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Consumption anomaly detection", - "control_name": "LMT — Logging & Monitoring", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SC-5", + "control_name": "Denial of Service Protection", "entries": [ { "id": "LLM06", @@ -27886,15 +25878,33 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify monitoring detects abnormal consumption patterns — token flooding, API abuse, wallet drainage — before service impact" + "notes": "LLM infrastructure protected against resource exhaustion attacks affecting OT availability" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Crafted inputs designed to produce malicious outputs", - "control_name": "IHT — Input Handling", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-10", + "control_name": "Information Input Validation", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data validation — adversarial content detected and rejected before training" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -27902,127 +25912,149 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems" + "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential and sensitive content in system prompt", - "control_name": "DPT — Data Protection", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-17", + "control_name": "Fail-Safe Procedures", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique" + "notes": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential leakage paths", - "control_name": "DPT — Data Protection", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads" + "notes": "Treat prompt injection as a malicious code analog — detection and response controls required" + }, + { + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM output scanning for malicious content before OT system ingestion" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential scope enforcement", - "control_name": "ACT — Access Control", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-7", + "control_name": "Software, Firmware, and Information Integrity", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries" + "notes": "Model integrity verification before each OT deployment — hash-based integrity check" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store integrity monitoring — alert on anomalous content or unexpected modifications" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential usage audit trail", - "control_name": "LMT — Logging & Monitoring", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SR-3", + "control_name": "Supply Chain Controls and Plans", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation" + "notes": "Documented supply chain security plan covering LLM components in OT deployment" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Data access authorisation enforcement", - "control_name": "ACT — Access Control", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SR-6", + "control_name": "Supplier Assessments and Reviews", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level" + "notes": "Periodic security assessment of LLM vendors with OT-deployed components" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Dataset provenance verification", - "control_name": "SCT — Supply Chain", + "control_id": "ACT", + "control_name": "Access Control", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level" + }, + { + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Downstream system access controls", - "control_name": "ACT — Access Control", - "entries": [ + "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions" + }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Embedding inversion and data reconstruction", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Verify per-user and per-tenant quotas are enforced and cannot be bypassed through session switching or credential abuse" + }, { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -28030,55 +26062,68 @@ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Test whether embedding vectors can be inverted to reconstruct training data; verify embedding stores do not leak source content through metadata" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Factual accuracy and hallucination rate", - "control_name": "MBT — Model Behaviour", - "entries": [ + "notes": "Verify RAG queries cannot retrieve documents above the authenticated user's permission level" + }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Test model outputs against known-correct facts across the deployment use case domain; measure hallucination rate against benchmark ground truth" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Generated code validation", - "control_name": "OHT — Output Handling", - "entries": [ + "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify each tool enforces its own access controls independently of the agent framework" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Verify static analysis catches dangerous operations before execution" + "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal consistency under adversarial input", - "control_name": "MBT — Model Behaviour", + "control_id": "AST", + "control_name": "Agent-Specific", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection" + "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs" + }, + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components" }, { "id": "ASI01", @@ -28087,31 +26132,62 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Goal state verification effectiveness", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Hidden goal persistence detection", - "control_name": "MBT — Model Behaviour", - "entries": [ + "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify that component modification at runtime is detected and triggers agent suspension" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Test sandbox boundary enforcement from within the execution environment" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Attempt to poison memory through every channel that can write to agent memory stores" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Capture and replay a valid A2A message; verify replay is rejected" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters" + }, { "id": "ASI10", "name": "Rogue Agents", @@ -28119,127 +26195,180 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis" + "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection detection audit trail", - "control_name": "LMT — Logging & Monitoring", + "control_id": "AVT", + "control_name": "Availability", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Test rate limiting enforcement, token budget controls, and compute throttling under load; verify graceful degradation" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response" + "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection via all input channels", - "control_name": "IHT — Input Handling", + "control_id": "DPT", + "control_name": "Data Protection", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Irreversibility gate enforcement", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques" + }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Kill switch activation coverage", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Test whether embedding vectors can be inverted to reconstruct training data; verify embedding stores do not leak source content through metadata" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA" + "notes": "Verify memory store content integrity monitoring detects unauthorised modification" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "LLM-generated tool parameters", - "control_name": "OHT — Output Handling", + "control_id": "IHT", + "control_name": "Input Handling", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify tool call parameters generated by the LLM are validated before execution" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Memory content integrity", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, email content, uploaded files, and any other data source the agent processes" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Verify memory store content integrity monitoring detects unauthorised modification" + "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Memory write path injection", - "control_name": "AST — Agent-Specific", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "entries": [ { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Attempt to poison memory through every channel that can write to agent memory stores" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Misinformation incident detection", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "Verify monitoring detects abnormal consumption patterns — token flooding, API abuse, wallet drainage — before service impact" + }, { "id": "LLM07", "name": "Misinformation", @@ -28248,46 +26377,34 @@ "tier": "Foundational", "scope": "Both", "notes": "Verify that the monitoring pipeline can detect and flag systematic misinformation patterns — accuracy drift, citation fabrication rate" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Output DLP effectiveness", - "control_name": "OHT — Output Handling", - "entries": [ + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Output injection into downstream systems", - "control_name": "OHT — Output Handling", - "entries": [ + "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Verify all A2A messages are logged with sender identity and content hash" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Over-trust pattern detection", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "Verify monitoring raises alert on cascade indicators before physical impact" + }, { "id": "ASI09", "name": "Human-Agent Trust Exploitation", @@ -28296,94 +26413,86 @@ "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring can detect aggregate patterns of uncritical operator acceptance" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Per-tool authorisation", - "control_name": "ACT — Access Control", - "entries": [ + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Verify each tool enforces its own access controls independently of the agent framework" + "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Per-user quota enforcement", - "control_name": "ACT — Access Control", + "control_id": "MBT", + "control_name": "Model Behaviour", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection" + }, + { + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify per-user and per-tenant quotas are enforced and cannot be bypassed through session switching or credential abuse" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Permission scope enforcement", - "control_name": "ACT — Access Control", - "entries": [ + "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain" + }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "PII and sensitive data extraction from outputs", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Plugin and tool descriptor integrity", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Test model outputs against known-correct facts across the deployment use case domain; measure hallucination rate against benchmark ground truth" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Poisoned memory influence detection", - "control_name": "MBT — Model Behaviour", - "entries": [ + "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -28392,110 +26501,68 @@ "tier": "Hardening", "scope": "Both", "notes": "Verify that behaviour influenced by poisoned memory differs detectably from baseline" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Prompt injection via all agent input channels", - "control_name": "IHT — Input Handling", - "entries": [ + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, email content, uploaded files, and any other data source the agent processes" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Refusal robustness for system prompt disclosure", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Replay attack prevention", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Capture and replay a valid A2A message; verify replay is rejected" + "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Resource exhaustion and rate limiting", - "control_name": "AVT — Availability", + "control_id": "OHT", + "control_name": "Output Handling", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Test rate limiting enforcement, token budget controls, and compute throttling under load; verify graceful degradation" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Retrieval authorisation enforcement", - "control_name": "ACT — Access Control", - "entries": [ + "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Verify RAG queries cannot retrieve documents above the authenticated user's permission level" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Runtime component monitoring", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Verify that citations generated by the LLM are real and accurately represent source content; test that outputs requiring citations enforce this" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that component modification at runtime is detected and triggers agent suspension" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Sandbox escape attempts", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify tool call parameters generated by the LLM are validated before execution" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -28503,47 +26570,33 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Test sandbox boundary enforcement from within the execution environment" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "System prompt extraction via crafted inputs", - "control_name": "IHT — Input Handling", - "entries": [ + "notes": "Verify static analysis catches dangerous operations before execution" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques" + "notes": "Verify advisory labels persist through all rendering environments" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Tool permission boundary enforcement", - "control_name": "AST — Agent-Specific", + "control_id": "SCT", + "control_name": "Supply Chain", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Training data integrity verification", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components" + }, { "id": "LLM05", "name": "Data and Model Poisoning", @@ -28551,15 +26604,8 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Vector database security configuration", - "control_name": "SCT — Supply Chain", - "entries": [ + "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline" + }, { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -28568,6 +26614,15 @@ "tier": "Hardening", "scope": "Both", "notes": "Verify vector database is correctly configured — authentication, encryption, namespace isolation, API key protection" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors" } ] }, @@ -33950,239 +32005,54 @@ "id": "DSGAI15", "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompts not stored in cleartext application configuration or source code" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", - "control_name": "Verify PII is identified and protected", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V9 Communication", - "control_name": "V9.1.1 — TLS for all connections", - "entries": [ - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify all sensitive data encrypted in transit", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials exposed in memory, logs, tool payloads", - "control_name": "NHI-2 Secret Leakage", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "No credentials in agent context, logs, or tool payloads — secret manager only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials not revoked on decommission — dormant tokens exploitable", - "control_name": "NHI-1 Improper Offboarding", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials stored in cleartext — config files, environment variables", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Secret manager for all agent credentials — no cleartext storage anywhere" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent holds more permissions than required — lateral movement amplifier", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Least privilege per agent role — scope enforced, reviewed quarterly" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent tokens without expiry — compromise persists indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Short-lived credentials — task-scoped tokens with automatic expiry" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent with excess privilege can call tools in destructive ways even within normal use", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": null + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Per-tool permission manifests — each tool scoped to minimum required operations" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "API credentials with high quota enabling systematic extraction", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": null + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-user quotas; minimum default quota" + "notes": null } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "API keys or tokens embedded in system prompt", - "control_name": "NHI-2 Secret Leakage", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.1.1", + "control_name": "Verify sensitive data is not cached or exposed in logs", "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + }, { "id": "LLM08", "name": "Hidden Context Exposure", @@ -34190,206 +32060,166 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scan system prompts for credential patterns before deployment" + "notes": "System prompts not stored in cleartext application configuration or source code" } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "Audit log service credentials leaked or compromised", - "control_name": "NHI-2 Secret Leakage", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.3.4", + "control_name": "Verify PII is identified and protected", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Protect audit log credentials as sensitive NHI" + "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "Cascading agent failure with over-privileged credentials exposes all accessible systems", - "control_name": "NHI-5 Over-Privileged NHI", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V9 Communication", + "control_name": "V9.1.1 — TLS for all connections", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Least privilege per agent — cascade blast radius limited by credential scope" + "notes": null } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "Code executes in context of over-privileged agent credential — amplifies RCE impact", - "control_name": "NHI-5 Over-Privileged NHI", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V9.1.1", + "control_name": "Verify all sensitive data encrypted in transit", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity" + "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Code execution in production context with prod credentials", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed" + }, + { + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Strict environment isolation for code execution — dedicated sandboxed identity" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Compliance audit credentials leaked — tampering with evidence possible", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Protect audit credential integrity" + "notes": "Timely offboarding of pipeline NHIs" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Compromised MCP server holds or can request excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Compromised third-party tool identity gets full scope of agent credential", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Enforce separate human and machine credentials" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Corpus write access held by service accounts that do not need it", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Agent credentials machine-only — human use detected and blocked" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Separate read and write credentials; write accounts require MFA" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Corpus write credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Strict separation: agent credentials machine-only, human credentials human-only" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Vault all corpus write credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Credentials appearing in model outputs passed to executors", - "control_name": "NHI-2 Secret Leakage", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Credential detection in output pipeline before execution" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in config files include sensitive data source access", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Enforce human identity for all compliance operations" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit config files for embedded credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in model outputs or training data surface in responses", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Enforce human identity for all regulated data operations" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Output scanning for credential patterns" + "notes": "Enforce machine identity per pipeline component; log with component identity" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials in plaintext config files ingested by LLM", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "entries": [ { "id": "LLM02", @@ -34398,47 +32228,35 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit all config and data sources for embedded credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Data feed service accounts with access to sensitive data that should not enter context", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Output filtering: detect and redact credential patterns in all outputs" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Scope data feed credentials to approved data only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Decommissioned pipeline identities remain in lineage records", - "control_name": "NHI-1 Improper Offboarding", - "entries": [ + "notes": "Separate credential stores per third-party component" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Timely offboarding of pipeline NHIs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Downstream service credentials with excessive scope", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Protect audit log credentials as sensitive NHI" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Scan system prompts for credential patterns before deployment" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -34446,120 +32264,80 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Apply least-privilege to all credentials used in downstream processing" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Embedding store service account with cross-tenant read access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Credential detection in output pipeline before execution" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Per-tenant credentials or least-privilege scope restrictions" + "notes": "No credentials in agent context, logs, or tool payloads — secret manager only" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Scan all agent components for credential access patterns before deployment" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-tenant credentials or row-level security with minimum scope" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "GenAI system service account has access to more data than declared function requires", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit and reduce credential scope per system component" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Hijacked agent with excess privilege causes larger blast radius", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Audit config files for embedded credentials" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scope all agent credentials to minimum required — least privilege enforced" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent credentials — or agents using human credentials — destroys attribution", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Output scanning for credential patterns" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Strict separation: agent credentials machine-only, human credentials human-only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent service accounts — no attribution, no MFA", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Scan and scrub credentials from inference logs" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials machine-only — human use detected and blocked" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using LLM service account credentials — no attribution", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Vault all third-party data source credentials" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce separate human and machine credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials — no attribution for compliance evidence", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Vault all model provider credentials" + }, { "id": "DSGAI20", "name": "Model Exfiltration and IP Replication", @@ -34567,143 +32345,121 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce human identity for all regulated data operations" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials for data deletion — no audit trail", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Protect audit credential integrity" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce human identity for all compliance operations" + "notes": "Protect lineage system credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Inference log service account with broad read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Minimum scope: only authorised audit function can read inference logs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injected actions can use pipeline tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Review all third-party credentials; apply minimum scope" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Apply NHI-3 controls to all data pipeline third-party credentials" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived tokens for all data pipeline service accounts" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injected session can use stolen long-lived tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rotate all LLM application tokens; implement short-lived token pattern" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius limited only by credential scope", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Apply least-privilege to all data pipeline credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius proportional to credential scope", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Review all third-party tool credentials; reduce to minimum scope" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Apply least-privilege to all LLM application credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Lineage system credentials leaked — provenance records can be tampered", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Review all third-party credentials; reduce to minimum" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Protect lineage system credentials" + "notes": "Review and scope all model provider credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "LLM outputs containing API keys, tokens, or credentials", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Require authentication for all vector database connections" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Output filtering: detect and redact credential patterns in all outputs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived A2A tokens enable persistent replay attacks", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens" + }, { "id": "ASI07", "name": "Insecure Inter-Agent Communications", @@ -34711,95 +32467,87 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Short-lived A2A tokens with nonce-based replay protection" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived corpus write credentials persist beyond need", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Require mTLS or token auth for all pipeline connections" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Rotate corpus write credentials; implement short-lived write pattern" + "notes": "Require authentication for all vector database connections" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials exposed during cascade remain valid for attacker use post-incident", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials maintain excessive access indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Apply least-privilege to all LLM application credentials" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rotate or replace with short-lived tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived inference API credentials enable sustained extraction campaigns", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Minimum credential scope per tool integration" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Rotate API credentials; implement per-session tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived memory store credentials enable persistent access for attacker", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Read-only credentials for data consumption; separate write credentials with MFA" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Separate credentials per service with independent quotas" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Short-lived credentials for memory store access — rotate on each agent session" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow hijack to persist beyond session", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Per-tenant credentials or least-privilege scope restrictions" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Apply least-privilege to all credentials used in downstream processing" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -34807,191 +32555,107 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow rogue agent to operate indefinitely after detection", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Scope all agent credentials to minimum required — least privilege enforced" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tool credentials enable extended unauthorised access", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Per-tool permission manifests — each tool scoped to minimum required operations" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived JIT credentials per task (see RECIPES.md)" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived write credentials create persistent poisoning window", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Least privilege per agent role — scope enforced, reviewed quarterly" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Short-lived write tokens; rotate frequently" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Machine credentials used for ingestion operations — no individual attribution", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce machine identity per pipeline component; log with component identity" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Malicious components extract credentials from agent memory or config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Least privilege per agent — cascade blast radius limited by credential scope" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Credential isolation — components cannot access other components' credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials in cleartext — trivially extracted", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Secret manager for all memory store credentials — no cleartext anywhere" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials leaked — attacker writes poisoned content directly", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model provider API keys with excessive access to model versions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Apply least-privilege to all data pipeline credentials" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Review and scope all model provider credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model provider credentials in pipeline config", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Separate read and write credentials; write requires MFA" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vault all model provider credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model storage credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Scope pipeline credentials to approved data sources only" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Vault all model storage credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model storage service account with read access from unexpected paths", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Per-stage credentials with minimum scope" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Minimum scope: only authorised inference service can read model weights" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Over-broad retrieval credentials return data beyond user entitlement", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Minimum scope; no service account has guardrail disable capability" + }, { "id": "DSGAI06", "name": "Tool Plugin and Agent Data Exchange", @@ -35000,110 +32664,61 @@ "tier": "Foundational", "scope": "Both", "notes": "Minimum scope for retrieval service accounts" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Over-privileged agent identity makes its recommendations appear more authoritative to users", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to all stages", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Audit and reduce credential scope per system component" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Per-stage credentials with minimum scope" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to sensitive data stores", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Per-tenant credentials or row-level security with minimum scope" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Scope pipeline credentials to approved data sources only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Production agent credentials accessible in dev/test environments", - "control_name": "NHI-8 Environment Isolation Failure", - "entries": [ + "notes": "Separate read and write credentials; write accounts require MFA" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent detected but not offboarded — credentials remain valid", - "control_name": "NHI-1 Improper Offboarding", - "entries": [ + "notes": "Scope data feed credentials to approved data only" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent with excess privilege causes larger blast radius before detection", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Per-user session store access controls" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same credential used across multiple tool integrations", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Per-user quotas; minimum default quota" + }, { "id": "DSGAI13", "name": "Vector Store Platform Security", @@ -35111,159 +32726,114 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per tool" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple pipeline stages", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope per tool integration" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Separate credentials per stage" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple tools — compromise of one exposes all", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope: only authorised inference service can read model weights" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per tool integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same data access credential used across multiple GenAI system functions", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope: only authorised audit function can read inference logs" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per function" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same embedding store credential used for multiple tenants", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope for data access credentials" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Separate credentials per tenant or use row-level security" + "notes": "Per-stage minimum scope credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Same model registry token used across dev/staging/production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per environment" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Service account credentials embedded in inference log entries", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Audit all config and data sources for embedded credentials" + }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Externalise credentials to vault; reference by ID in system prompt" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secret manager for all agent credentials — no cleartext storage anywhere" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scan and scrub credentials from inference logs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Service account with access to retained data beyond declared function", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Credential isolation — components cannot access other components' credentials" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Minimum scope for data access credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Service account with guardrail configuration write access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Secret manager for all memory store credentials — no cleartext anywhere" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Minimum scope; no service account has guardrail disable capability" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Session store access credentials in plaintext", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Vault all training pipeline credentials" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Vault session store credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Session store service account with cross-user read/write access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Vault all corpus write credentials" + }, { "id": "DSGAI11", "name": "Cross-Context Conversation Bleed", @@ -35271,95 +32841,42 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-user session store access controls" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared A2A credentials allow one compromised agent to impersonate others", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Vault session store credentials" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Unique identity per agent — A2A authentication bound to specific agent identity" + "notes": "Vault all model storage credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared agent credential across multiple instances or deployments", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique identity per agent deployment — no credential sharing" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credential across pipeline stages — one failure affects all", - "control_name": "NHI-9 NHI Reuse", - "entries": [ - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Separate credentials per pipeline stage" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credential means RCE in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credential used across services — quota exhaustion in one affects all", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Rotate all LLM application tokens; implement short-lived token pattern" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials allow hijacked agent to impersonate other agents", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Short-lived JIT credentials per task (see RECIPES.md)" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -35367,174 +32884,104 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique identity per agent — no shared service accounts across agent deployments" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials mean cascade in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Single credential covering multiple pipeline stages amplifies cascade", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Short-lived credentials — task-scoped tokens with automatic expiry" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-stage minimum scope credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Single credential with access to multiple services — one exhaustion affects all", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Short-lived credentials for memory store access — rotate on each agent session" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Separate credentials per service with independent quotas" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Single shared credential allows tool misuse to affect multiple services", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Short-lived A2A tokens with nonce-based replay protection" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Supply chain compromise introduces credential exfiltration code", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Scan all agent components for credential access patterns before deployment" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "System prompt stored as plaintext config with embedded credentials", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Externalise credentials to vault; reference by ID in system prompt" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party component credentials exposed in shared config", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Short-lived tokens for all data pipeline service accounts" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Separate credential stores per third-party component" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party credentials embedded in shared config", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Short-lived write tokens; rotate frequently" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vault all third-party data source credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party data pipeline credentials with training data write access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Rotate or replace with short-lived tokens" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Apply NHI-3 controls to all data pipeline third-party credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party data source API keys with excessive scope", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Rotate corpus write credentials; implement short-lived write pattern" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Review all third-party credentials; reduce to minimum" + "notes": "Rotate API credentials; implement per-session tokens" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party dev/staging credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "entries": [ { "id": "LLM04", @@ -35544,14 +32991,25 @@ "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for all third-party integrations" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party development credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", - "entries": [ + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Strict environment isolation for code execution — dedicated sandboxed identity" + }, { "id": "DSGAI16", "name": "Endpoint and Browser Overreach", @@ -35560,110 +33018,95 @@ "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for third-party credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party plugin tokens with excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Review all third-party credentials; apply minimum scope" + "notes": "Separate credentials per environment" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive data access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Separate credentials per tool integration" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Review all third-party tool credentials; reduce to minimum scope" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive permissions inherited by agent", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Separate credentials per integration" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Tool integration credentials with broad data access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Unique identity per agent — no shared service accounts across agent deployments" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Minimum scope per tool integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Tool/API credentials with more scope than task requires", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Minimum credential scope per tool integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Training pipeline credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Unique identity per agent deployment — no credential sharing" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Vault all training pipeline credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated connections between pipeline stages", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ + "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Unique identity per agent — A2A authentication bound to specific agent identity" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -35671,23 +33114,16 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Require mTLS or token auth for all pipeline connections" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated embedding store access", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ + "notes": "Separate credentials per stage" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Require authentication for all vector database connections" + "notes": "Separate credentials per function" }, { "id": "DSGAI08", @@ -35696,64 +33132,25 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Require authentication for all vector database connections" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Weak agent-to-system authentication — credential reuse or weak secrets", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Weak or missing authentication on A2A channels — agent spoofing enabled", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ + "notes": "Separate credentials per tenant or use row-level security" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Write access to training data stores enables poisoning", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Read-only credentials for data consumption; separate write credentials with MFA" + "notes": "Separate credentials per tool" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Separate read and write credentials; write requires MFA" + "notes": "Separate credentials per pipeline stage" } ] }, @@ -37323,694 +34720,214 @@ ] }, { - "framework": "OWASP SAMM v2.0", - "control_id": "V-ST", - "control_name": "Security Testing", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Adversarial testing programme covering prompt injection — direct, indirect, RAG-specific, jailbreak scenarios" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Poisoning detection in adversarial testing — backdoor trigger testing before each model promotion" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Prompt extraction testing as penetration testing activity — resistance to known extraction techniques verified" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector store attacks in penetration testing — RBAC bypass, CVE-2024-3584 class, embedding inversion tested" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DAST on all interfaces consuming LLM output as penetration testing activity" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Red team injection across all retrieval and tool paths" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Test persistent memory integrity across session boundaries" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether a compromised sub-agent can escalate through the network" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Automated checks on tool descriptors, endpoints, and permissions" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether agent can be instructed to exfiltrate via each outbound channel" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Advanced", - "scope": "Both", - "notes": "Dedicated red team exercise targeting guardrail bypass" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Adversarial injection tests across all data input channels" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Statistical analysis and adversarial probing for poisoned behaviours" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Dedicated adversarial testing programme targeting all guardrail bypass vectors" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Automated testing for memorisation and over-retrieval of sensitive content" - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether queries can retrieve documents from other tenants or restricted tiers" - }, - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Attempt to inject manipulated documents; verify detection" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversarial tests injecting malicious content via each context source" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether session data is accessible or injectable across user boundaries" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Attempt model extraction via systematic querying; verify detection and rate limiting" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Automated tests verifying tool responses are scoped to minimum" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows documented scope — technical controls prevent access outside defined role", - "control_name": "Req 7.2", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Access control matrix, technical enforcement evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows need-to-know — access to cardholder data restricted to what agent function requires", - "control_name": "Req 7.2", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Access control matrix, need-to-know justification" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent accounts are system/application accounts — unique agent identity per deployment, no shared credentials", - "control_name": "Req 8.2", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Account inventory, unique account evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent actions logged — all goal-relevant agent actions logged with user identity, session ID, and action detail", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Audit log configuration, sample log entries" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent credential management — unique credentials, strong authentication where interactive, credential rotation schedule", - "control_name": "Req 8.3", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Credential management policy, rotation records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent credential usage logged — all authentication events for agent accounts in CHD scope logged", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Authentication audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent execution environments protected — WAF or equivalent for agent endpoints with code execution capability", - "control_name": "Req 6.4", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "WAF configuration, protection evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent memory encryption — CHD in persistent memory stores encrypted using strong cryptography", - "control_name": "Req 3.5", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Encryption configuration, key management records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions follow least-privilege — agent can only access CHD systems required for defined function", - "control_name": "Req 7.2", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Access control matrix for agent tools, privilege review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions reviewed periodically — unused tool permissions removed; review schedule documented", - "control_name": "Req 7.3", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Periodic access review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent-human interaction events logged — session records for agent interactions involving CHD decisions", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Interaction audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agentic component CVEs in vulnerability management — ML libraries, agent frameworks, inference runtime dependencies scanned", - "control_name": "Req 6.3", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Vulnerability scan results, patch records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agentic component vendors with CHD access managed as TPSPs — written agreements, annual confirmation of PCI compliance", - "control_name": "Req 12.8", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "TPSP list, written agreements, compliance confirmations" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "All tool invocations on CHD systems logged — tool name, parameters, data accessed, user/session identity", - "control_name": "Req 10.2", + "framework": "OWASP SAMM v2.0", + "control_id": "V-ST", + "control_name": "Security Testing", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool invocation audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Baseline availability configuration for agent infrastructure — capacity and resilience requirements in hardening baseline", - "control_name": "Req 2.2", - "entries": [ + "notes": "Adversarial testing programme covering prompt injection — direct, indirect, RAG-specific, jailbreak scenarios" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Poisoning detection in adversarial testing — backdoor trigger testing before each model promotion" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Hardening baseline documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Bespoke agent code reviewed for injection resistance — all agent integration code includes prompt injection as a vulnerability category", - "control_name": "Req 6.2", - "entries": [ + "notes": "Prompt extraction testing as penetration testing activity — resistance to known extraction techniques verified" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store attacks in penetration testing — RBAC bypass, CVE-2024-3584 class, embedding inversion tested" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure code review records, findings, remediation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Cascade failure risk analysis — targeted risk analysis documents cascade failure likelihood, impact, treatment", - "control_name": "Req 12.3", - "entries": [ + "notes": "DAST on all interfaces consuming LLM output as penetration testing activity" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk analysis documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "CHD encrypted in transit between agents — all inter-agent communication carrying CHD uses TLS 1.2+", - "control_name": "Req 4.2", - "entries": [ + "notes": "Red team injection across all retrieval and tool paths" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "TLS configuration, protocol verification" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Code execution events logged — all agent-initiated execution with session identity and code summary", - "control_name": "Req 10.2", - "entries": [ + "notes": "Test persistent memory integrity across session boundaries" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Code execution audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Code execution paths in penetration testing — test whether crafted inputs cause execution of out-of-scope code", - "control_name": "Req 11.3", - "entries": [ + "notes": "Test whether a compromised sub-agent can escalate through the network" + }, { "id": "ASI05", "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Pen test report with code execution test cases" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Code generation and execution controls in secure development — agent cannot execute generated code without validation", - "control_name": "Req 6.2", - "entries": [ + "notes": "Automated checks on tool descriptors, endpoints, and permissions" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Secure development policy covering code generation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Critical agent control failures detected promptly — monitoring for cascade precursors with alert thresholds", - "control_name": "Req 10.7", - "entries": [ + "notes": "Test whether agent can be instructed to exfiltrate via each outbound channel" + }, { "id": "ASI08", "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Advanced", "scope": "Both", - "notes": "Monitoring configuration, alert records, detection evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Honest design requirements for agent interactions — AI disclosure requirements in secure development policy", - "control_name": "Req 6.2", - "entries": [ + "notes": "Dedicated red team exercise targeting guardrail bypass" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Secure development policy, design review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Inter-agent authentication — agents authenticate to each other before exchanging CHD", - "control_name": "Req 8.2", - "entries": [ + "notes": "Adversarial injection tests across all data input channels" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Certificate configuration, authentication evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Inter-agent CHD exchanges logged — source, destination, data classification, timestamp", - "control_name": "Req 10.2", - "entries": [ + "notes": "Statistical analysis and adversarial probing for poisoned behaviours" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Inter-agent communication audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Malicious software protection for agent components — integrity verification for model weights and plugin descriptors", - "control_name": "Req 5.2", - "entries": [ + "notes": "Dedicated adversarial testing programme targeting all guardrail bypass vectors" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrity check configuration, verification records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Memory poisoning in penetration test scope — test whether adversarial content in memory affects agent behaviour", - "control_name": "Req 11.3", - "entries": [ + "notes": "Automated testing for memorisation and over-retrieval of sensitive content" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Pen test report" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Model and memory changes managed — updates to agent memory stores treated as system changes requiring security review", - "control_name": "Req 6.5", - "entries": [ + "notes": "Test whether queries can retrieve documents from other tenants or restricted tiers" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Change management records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Network controls prevent cascade propagation — agent network segments isolated to contain blast radius", - "control_name": "Req 1.3", - "entries": [ + "notes": "Attempt to inject manipulated documents; verify detection" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Network diagram, segmentation evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "PAN in agent memory protected — primary account numbers truncated or masked if stored in agent context or memory stores", - "control_name": "Req 3.4", - "entries": [ + "notes": "Adversarial tests injecting malicious content via each context source" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory store review, PAN protection evidence" + "notes": "Test whether session data is accessible or injectable across user boundaries" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Attempt model extraction via systematic querying; verify detection and rate limiting" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Automated tests verifying tool responses are scoped to minimum" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Penetration testing covers goal hijack — agentic AI systems tested for prompt injection before production and annually", - "control_name": "Req 11.3", + "control_id": "Req 1.3", + "control_name": "Req 1.3", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Pen test report with goal hijack test cases" + "notes": "Network diagram, segmentation evidence" } ] }, @@ -38048,6 +34965,76 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 10.2", + "control_name": "Req 10.2", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Audit log configuration, sample log entries" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool invocation audit log" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Authentication audit log" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Code execution audit log" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Inter-agent communication audit log" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Interaction audit log" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Action audit log, out-of-scope alert records" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 10.2.1", @@ -38233,6 +35220,65 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 10.7", + "control_name": "Req 10.7", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitoring configuration, alert records, detection evidence" + } + ] + }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 11.3", + "control_name": "Req 11.3", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Pen test report with goal hijack test cases" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Pen test report with code execution test cases" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Pen test report" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Pen test report with rogue agent test cases" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 11.3.1", @@ -38362,6 +35408,49 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 12.3", + "control_name": "Req 12.3", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Risk analysis for agentic AI in PCI scope" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Risk analysis documentation" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Risk analysis documentation" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Risk analysis documentation" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 12.3.1", @@ -38525,6 +35614,22 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 12.6", + "control_name": "Req 12.6", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Training curriculum, completion records" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 12.6.1", @@ -38564,6 +35669,15 @@ "control_id": "Req 12.8", "control_name": "TPSP programme", "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "TPSP list, written agreements, compliance confirmations" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -38682,7 +35796,32 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified" + "notes": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified" + } + ] + }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 2.2", + "control_name": "Req 2.2", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening baseline documentation" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening baseline documentation" } ] }, @@ -38761,6 +35900,22 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 3.4", + "control_name": "Req 3.4", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory store review, PAN protection evidence" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 3.4.1", @@ -38840,6 +35995,22 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 3.5", + "control_name": "Req 3.5", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Encryption configuration, key management records" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 3.5.1", @@ -38928,6 +36099,22 @@ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 4.2", + "control_name": "Req 4.2", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "TLS configuration, protocol verification" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 4.2.1", @@ -38964,483 +36151,61 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Req 6.2", - "control_name": "Bespoke software security", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM integration code specifies accuracy requirements — high-stakes payment outputs require verification before action" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.2.4", - "control_name": "Secure software development", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompt design prevents leakage — no cleartext CDE identifiers, tokens resolved at runtime" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Output handling in LLM integrations addresses all injection vulnerability classes — LLM output treated as untrusted" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.3.3", - "control_name": "Security vulnerabilities", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All LLM software components at latest security patches — ML libraries and inference runtime patched" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores" - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Browser AI extensions patched and version-controlled — vulnerable extensions are Req 6.3 findings in CDE" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.4.1", - "control_name": "Public-facing application protection", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-powered public-facing applications protected against DoS — rate limiting and payload limits enforced" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All interfaces consuming LLM output in PCI scope protected — input validation on all downstream consumers" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation" - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Model extraction pattern detection as application protection — systematic API abuse detected" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.5", - "control_name": "Secure system changes", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Changes to GenAI ingestion pipelines tested — schema validation changes require security review" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.5.1", - "control_name": "Secure system changes", + "control_id": "Req 5.2", + "control_name": "Req 5.2", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model component updates follow change management — security testing before production" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.5.6", - "control_name": "Secure system changes", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement" - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "RAG corpus updates tested for unexpected content — integrity verification before production indexing" + "notes": "Integrity check configuration, verification records" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Req 7.2.1", - "control_name": "Restrict access by need to know", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM access to CHD restricted to minimum required — retrieval access controls prevent over-broad PAN access" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM tool access to CDE systems restricted to minimum required — read-only by default, write access formally approved" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompt access restricted — only authorised personnel with documented business need" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "RBAC on all vector stores in CDE scope — no unauthenticated access" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "RAG retrieval access controls — users retrieve only CHD they are authorised to access" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials scoped to minimum CDE access — least privilege, quarterly review" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context minimisation — tools receive minimum CHD-containing context required" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Strict session isolation — each user's CHD context inaccessible to all other sessions" + "notes": "LLM integration code specifies accuracy requirements — high-stakes payment outputs require verification before action" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated queries execute under requesting user's CDE permissions — never shared high-privilege account" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "RBAC on all vector stores in PCI scope — no unauthenticated access in any CDE environment" - }, - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Access controls on CDE telemetry stores — Req 7 need-to-know applies" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context assembly restricted to minimum CHD required — users cannot access CHD beyond their authorised scope through context injection" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Labelling task data minimised — annotators see minimum CHD required for annotation function" + "notes": "Secure code review records, findings, remediation" }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "API rate limiting as access control — systematic model extraction requires high query volumes" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 7.3.1", - "control_name": "Access control system", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 8.2.1", - "control_name": "Unique IDs for access", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Each agent has a unique service identity — no shared credentials across CDE-facing agents" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 9.4.6", - "control_name": "Media disposal", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Derived GenAI assets containing CHD disposed of securely — deletion verified per Req 9.4 requirements" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Rogue agent behaviour logged — actions outside defined scope generate audit log entries and alerts", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Action audit log, out-of-scope alert records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Rogue agent risk analysis — targeted risk analysis documents scenarios, CHD impact, treatment", - "control_name": "Req 12.3", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Risk analysis documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Rogue agent scenarios in penetration test scope — test whether agents can operate outside authorised scope", - "control_name": "Req 11.3", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Pen test report with rogue agent test cases" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Secure baseline configuration for agentic infrastructure — hardening standards applied to agent deployment platforms", - "control_name": "Req 2.2", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening baseline documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Secure development requirements for inter-agent APIs — authentication and encryption requirements in design specifications", - "control_name": "Req 6.2", - "entries": [ + "notes": "Code review records covering parameter validation" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Secure development policy covering code generation" + }, { "id": "ASI07", "name": "Insecure Inter-Agent Communications", @@ -39449,14 +36214,7 @@ "tier": "Hardening", "scope": "Both", "notes": "Design documentation, code review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Security awareness covers AI deception — staff trained to recognise AI impersonation and social engineering", - "control_name": "Req 12.6", - "entries": [ + }, { "id": "ASI09", "name": "Human-Agent Trust Exploitation", @@ -39464,255 +36222,278 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Training curriculum, completion records" + "notes": "Secure development policy, design review records" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Targeted risk analysis documents goal hijack — likelihood, impact on CHD, treatment controls specified", - "control_name": "Req 12.3", + "control_id": "Req 6.2.4", + "control_name": "Secure software development", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk analysis for agentic AI in PCI scope" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Tool parameter validation in agent code — LLM-generated tool parameters validated before execution", - "control_name": "Req 6.2", - "entries": [ + "notes": "All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt design prevents leakage — no cleartext CDE identifiers, tokens resolved at runtime" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output handling in LLM integrations addresses all injection vulnerability classes — LLM output treated as untrusted" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Code review records covering parameter validation" + "notes": "LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Trust exploitation risk analysis — targeted risk analysis documents scenarios and treatment", - "control_name": "Req 12.3", + "control_id": "Req 6.3", + "control_name": "Req 6.3", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Risk analysis documentation" + "notes": "Vulnerability scan results, patch records" } ] }, { - "framework": "SOC 2", - "control_id": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.3.3", + "control_name": "Security vulnerabilities", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All LLM software components at latest security patches — ML libraries and inference runtime patched" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access anomaly monitoring on telemetry stores — bulk access patterns detected", - "control_name": "CC7.2 — Monitoring", - "entries": [ + "notes": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser AI extensions patched and version-controlled — vulnerable extensions are Req 6.3 findings in CDE" } ] }, { - "framework": "SOC 2", - "control_id": "Access controls define authorised agent scope — technical enforcement of what agents may and may not do", - "control_name": "CC6.1", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.4", + "control_name": "Req 6.4", "entries": [ { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Permission policy, access control configuration" + "notes": "WAF configuration, protection evidence" } ] }, { - "framework": "SOC 2", - "control_id": "Access controls on multimodal content stores — same rigour as equivalent text data stores", - "control_name": "CC6.1 — Logical access", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.4.1", + "control_name": "Public-facing application protection", "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access controls on RAG data sources — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "LLM-powered public-facing applications protected against DoS — rate limiting and payload limits enforced" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access controls on RAG retrieval — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "All interfaces consuming LLM output in PCI scope protected — input validation on all downstream consumers" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Model extraction pattern detection as application protection — systematic API abuse detected" } ] }, { - "framework": "SOC 2", - "control_id": "Access controls on telemetry stores — same rigour as production data stores", - "control_name": "CC6.1 — Logical access", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.5", + "control_name": "Secure system changes", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Change management records" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Changes to GenAI ingestion pipelines tested — schema validation changes require security review" } ] }, { - "framework": "SOC 2", - "control_id": "Access to system prompt storage monitored — anomalous access attempts detected and alerted", - "control_name": "CC7.2 — Monitoring", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.5.1", + "control_name": "Secure system changes", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Model component updates follow change management — security testing before production" } ] }, { - "framework": "SOC 2", - "control_id": "Accuracy of personal data in AI outputs — privacy criteria require that AI-generated information about individuals is accurate", - "control_name": "P7.1", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.5.6", + "control_name": "Secure system changes", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Accuracy review procedures" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "RAG corpus updates tested for unexpected content — integrity verification before production indexing" } ] }, { - "framework": "SOC 2", - "control_id": "Agent credential lifecycle procedures — issuance, rotation, revocation documented", - "control_name": "CC5.2 — Control activities", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.2", + "control_name": "Req 7.2", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credentials managed as logical access assets — provisioning, scope, rotation, revocation per access management policy", - "control_name": "CC6.1", - "entries": [ + "notes": "Access control matrix for agent tools, privilege review records" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -39720,111 +36501,69 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Credential lifecycle records, provisioning logs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Access control matrix, need-to-know justification" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Access control matrix, technical enforcement evidence" } ] }, { - "framework": "SOC 2", - "control_id": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs", - "control_name": "CC6.3 — Access removal", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.2.1", + "control_name": "Restrict access by need to know", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credentials treated as confidential information — stored in secrets manager, access-controlled", - "control_name": "C1.1", - "entries": [ + "notes": "LLM access to CHD restricted to minimum required — retrieval access controls prevent over-broad PAN access" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Secrets management configuration, access control evidence" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent memory stores monitored for unexpected modifications — baseline established, deviations trigger alerts", - "control_name": "CC7.2", - "entries": [ + "notes": "LLM tool access to CDE systems restricted to minimum required — read-only by default, write access formally approved" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Memory access log, anomaly alert configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent outputs are accurate and complete — outputs not designed to mislead; factual accuracy controls for high-stakes outputs", - "control_name": "PI1.3", - "entries": [ + "notes": "System prompt access restricted — only authorised personnel with documented business need" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Output quality controls, factual accuracy testing" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent processing is authorised — actions taken by agent correspond to user's authorised intent, not attacker's injected instruction", - "control_name": "PI1.1", - "entries": [ + "notes": "RBAC on all vector stores in CDE scope — no unauthenticated access" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Action audit log, authorisation records per agent session" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "RAG retrieval access controls — users retrieve only CHD they are authorised to access" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -39832,639 +36571,470 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agentic supply chain risk included in risk assessment — compromised component scenarios documented with treatment", - "control_name": "CC3.3", - "entries": [ + "notes": "Agent credentials scoped to minimum CDE access — least privilege, quarterly review" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Risk register with supply chain entries" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "AI disclosure policy — users informed when interacting with AI agents; deceptive design patterns prohibited", - "control_name": "CC5.3", - "entries": [ + "notes": "Context minimisation — tools receive minimum CHD-containing context required" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI disclosure policy, UI evidence" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Threat detection", - "entries": [ + "notes": "Strict session isolation — each user's CHD context inaccessible to all other sessions" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "LLM-generated queries execute under requesting user's CDE permissions — never shared high-privilege account" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "API rate limiting as access control limiting systematic model extraction", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "RBAC on all vector stores in PCI scope — no unauthenticated access in any CDE environment" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Access controls on CDE telemetry stores — Req 7 need-to-know applies" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Context assembly restricted to minimum CHD required — users cannot access CHD beyond their authorised scope through context injection" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Labelling task data minimised — annotators see minimum CHD required for annotation function" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "API rate limiting as access control — systematic model extraction requires high query volumes" } ] }, { - "framework": "SOC 2", - "control_id": "Availability commitments defined for multi-agent system — RTO/RPO documented; cascade failure scenarios in availability risk", - "control_name": "A1.1", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.3", + "control_name": "Req 7.3", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Availability SLA, BCP documentation" + "notes": "Periodic access review records" } ] }, { - "framework": "SOC 2", - "control_id": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security", - "control_name": "CC9.1 — Vendor risk", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.3.1", + "control_name": "Access control system", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation" } ] }, { - "framework": "SOC 2", - "control_id": "Capacity and performance monitoring — early warning of cascade failure precursors (latency, error rate, queue depth)", - "control_name": "A1.2", + "framework": "PCI DSS v4.0", + "control_id": "Req 8.2", + "control_name": "Req 8.2", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Monitoring dashboards, alert configuration" + "notes": "Account inventory, unique account evidence" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Certificate configuration, authentication evidence" } ] }, { - "framework": "SOC 2", - "control_id": "Cascade failure incidents detected and responded to — incident response procedures for multi-agent failures", - "control_name": "CC7.3", + "framework": "PCI DSS v4.0", + "control_id": "Req 8.2.1", + "control_name": "Unique IDs for access", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "IR plan covering cascade scenarios, incident records" + "notes": "Each agent has a unique service identity — no shared credentials across CDE-facing agents" } ] }, { - "framework": "SOC 2", - "control_id": "Cascade failure risk in risk assessment — blast radius analysis, dependency mapping documented", - "control_name": "CC3.3", + "framework": "PCI DSS v4.0", + "control_id": "Req 8.3", + "control_name": "Req 8.3", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk register with cascade failure entries" + "notes": "Credential management policy, rotation records" } ] }, { - "framework": "SOC 2", - "control_id": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure", - "control_name": "A1.2 — Environmental protections", + "framework": "PCI DSS v4.0", + "control_id": "Req 9.4.6", + "control_name": "Media disposal", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Derived GenAI assets containing CHD disposed of securely — deletion verified per Req 9.4 requirements" } ] }, { "framework": "SOC 2", - "control_id": "Code execution events monitored — syscall patterns, network calls, and filesystem access from sandboxes logged", - "control_name": "CC7.2", + "control_id": "A1.1", + "control_name": "Availability policies", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Execution audit log, alert configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Code execution is authorised — agent cannot execute code that was not explicitly requested by authorised user", - "control_name": "PI1.1", - "entries": [ + "notes": "Availability SLA, BCP documentation" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Code execution authorisation records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Commitment to compliance with applicable laws and regulations including AI-specific obligations", - "control_name": "CC5.1 — Control environment", - "entries": [ + "notes": "Resource monitoring, quota enforcement records" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure" } ] }, { "framework": "SOC 2", - "control_id": "Component changes managed through change management — model updates, framework upgrades, tool changes require security review", - "control_name": "CC8.1", + "control_id": "A1.2", + "control_name": "Environmental protections", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Change management records, security review sign-offs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data", - "control_name": "C1.1 — Confidentiality policy", - "entries": [ + "notes": "Rate limiting and resource controls protect LLM service availability — implemented and monitored" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Context minimisation for tool calls — tools receive minimum confidential data required for function", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Monitoring dashboards, alert configuration" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure" } ] }, { "framework": "SOC 2", - "control_id": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level", - "control_name": "CC6.1 — Logical access", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Continuous monitoring for rogue agent behaviour — actions outside authorised scope detected and alerted", - "control_name": "CC7.2", - "entries": [ + "notes": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent action audit log, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use", - "control_name": "CC9.2 — Vendor agreements", - "entries": [ + "notes": "Secrets management configuration, access control evidence" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions", - "control_name": "CC9.2 — Vendor agreements", - "entries": [ + "notes": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification", - "control_name": "CC9.2 — Vendor agreements", - "entries": [ + "notes": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)" } ] }, { "framework": "SOC 2", - "control_id": "Control activities define acceptable agent actions — agent cannot deviate from authorised goal scope", - "control_name": "CC5.2", + "control_id": "C2.1", + "control_name": "Confidential information protection", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent permission policy, goal-state verification design documentation" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Control activities define permitted code execution scope — sandbox requirements, approved languages, forbidden operations", - "control_name": "CC5.2", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Code execution policy, sandbox configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Control activities define tool permission scope — which tools are permitted, which parameters are valid, which actions require confirmation", - "control_name": "CC5.2", - "entries": [ + "notes": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool permission policy, permitted action allowlist" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Controls on memory store write access — only authorised processes may write to agent memory stores", - "control_name": "CC5.2", - "entries": [ + "notes": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Memory access policy, write access controls" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Credential usage monitored — anomalous scope expansion or after-session access detected", - "control_name": "CC7.3", - "entries": [ + "notes": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Credential audit log, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Credentials revoked at session end — no persistent credential caching in agent memory after session terminates", - "control_name": "CC6.3", - "entries": [ + "notes": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Session termination logs, credential TTL configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Cross-session access anomalies monitored — unusual retrieval patterns detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Context minimisation for tool calls — tools receive minimum confidential data required for function" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "User session context classified as confidential — technical isolation controls" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Vector store content encrypted at rest — embeddings of confidential data protected" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection" } ] }, { "framework": "SOC 2", - "control_id": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "control_id": "CC2.1", + "control_name": "Communication", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements" } ] }, { "framework": "SOC 2", - "control_id": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment identifies threats and vulnerabilities", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed" + }, { "id": "LLM03", "name": "Excessive Agency", @@ -40472,47 +37042,53 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Execution sandboxes access-controlled — no host filesystem or network access without authorisation", - "control_name": "CC6.1", - "entries": [ + "notes": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox configuration, access control evidence" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Goal hijack risk identified in risk assessment — prompt injection, indirect injection, multi-turn manipulation documented", - "control_name": "CC3.2", - "entries": [ + "notes": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed" + }, + { + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -40521,157 +37097,112 @@ "tier": "Foundational", "scope": "Both", "notes": "Risk register with goal hijack entries, treatment status" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Ingestion anomaly detection — unusual payloads detected before pipeline completion", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Re-identification risk in synthetic datasets identified in risk assessment" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Over-broad context risks identified — cross-trust-domain aggregation assessed" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing", - "control_name": "PI1.2 — System inputs complete and accurate", - "entries": [ + "notes": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed", - "control_name": "CC5.2 — Select and develop control activities", - "entries": [ + "notes": "Silent RAG degradation identified as availability risk in assessment" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation", - "control_name": "CC5.2 — Select and develop control activities", - "entries": [ + "notes": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed" } ] }, { "framework": "SOC 2", - "control_id": "Integrity checks required before component deployment — cryptographic verification of model weights and tool descriptors", - "control_name": "CC5.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "entries": [ { "id": "ASI04", @@ -40680,94 +37211,66 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrity verification configuration, deployment logs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inter-agent authentication required — all agent-to-agent messages authenticated before acting", - "control_name": "CC6.1", - "entries": [ + "notes": "Risk register with supply chain entries" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "mTLS configuration, certificate management records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inter-agent communication policy — which agents may communicate with which, under what conditions, with what data", - "control_name": "CC5.2", - "entries": [ + "notes": "Risk register with memory poisoning entries" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Inter-agent communication policy document" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inter-agent traffic monitored — unexpected communication patterns, unauthorised agent requests detected", - "control_name": "CC7.2", - "entries": [ + "notes": "Risk register with cascade failure entries" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Inter-agent traffic logs, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Risk register with trust exploitation entries" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Risk register with rogue agent scenarios" } ] }, { "framework": "SOC 2", - "control_id": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC5.1", + "control_name": "Control environment", "entries": [ { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Commitment to compliance with applicable laws and regulations including AI-specific obligations" } ] }, { "framework": "SOC 2", - "control_id": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access", - "control_name": "CC6.1 — Logical access restrictions", + "control_id": "CC5.2", + "control_name": "Select and develop control activities", "entries": [ { "id": "LLM01", @@ -40776,175 +37279,116 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring", - "control_name": "CC9.1 — Vendor risk management", - "entries": [ + "notes": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources", - "control_name": "PI1.2 — System inputs are complete and accurate", - "entries": [ + "notes": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced" + }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM model updates and component changes managed through change management — approval, testing, rollback", - "control_name": "CC8.1 — Change management", - "entries": [ + "notes": "System prompt security procedures — version control, rotation, extraction resistance testing documented" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery", - "control_name": "PI1.3 — Outputs complete and accurate", - "entries": [ + "notes": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent permission policy, goal-state verification design documentation" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool permission policy, permitted action allowlist" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure", - "control_name": "A1.1 — Availability policy", - "entries": [ + "notes": "Code execution policy, sandbox configuration" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability", - "control_name": "A1.1 — Availability policies", - "entries": [ + "notes": "Memory access policy, write access controls" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access restrictions", - "entries": [ + "notes": "Inter-agent communication policy document" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope", - "control_name": "CC6.3 — Access removal", - "entries": [ + "notes": "Agent credential lifecycle procedures — issuance, rotation, revocation documented" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM-generated query results validated — destructive or over-broad queries blocked before execution", - "control_name": "PI1.3 — Outputs complete and accurate", - "entries": [ + "notes": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures" + }, { "id": "DSGAI12", "name": "Unsafe Natural Language Data Gateways", @@ -40952,47 +37396,8 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Logical access controls enforce tool permissions — agent cannot invoke tools outside authorised scope", - "control_name": "CC6.1", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool invocation logs, access rejection records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Memory poisoning risk documented in risk assessment — scenarios for RAG, persistent memory, and context window corruption", - "control_name": "CC3.3", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Risk register with memory poisoning entries" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Minimum-necessary context injection procedures — documented and enforced", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "Query allowlisting and human confirmation procedures documented" + }, { "id": "DSGAI15", "name": "Over-Broad Context Windows", @@ -41000,111 +37405,94 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Minimum-necessary context injection procedures — documented and enforced" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement" } ] }, { "framework": "SOC 2", - "control_id": "Model extraction pattern monitoring — unusual query diversity and volume detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC5.3", + "control_name": "COSO principle 12 — Policies and procedures", "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Integrity verification configuration, deployment logs" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "AI disclosure policy, UI evidence" } ] }, { "framework": "SOC 2", - "control_id": "Model output anomaly monitoring — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC6.1", + "control_name": "Logical access restrictions", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Model promotions managed through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", - "entries": [ + "notes": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Model promotions through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", - "entries": [ + "notes": "Access controls on RAG data sources — users retrieve only data they are authorised to access" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Monitoring for anomalous tool invocations — destructive parameters, out-of-scope tools, unexpected sequences detected", - "control_name": "CC7.2", - "entries": [ + "notes": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access in any environment" + }, { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -41112,111 +37500,71 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool call audit log, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Tool invocation logs, access rejection records" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Credential lifecycle records, provisioning logs" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Sandbox configuration, access control evidence" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Output monitoring for reconstruction indicators — systematic query patterns detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "mTLS configuration, certificate management records" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Over-broad context risks identified — cross-trust-domain aggregation assessed", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Permission policy, access control configuration" + }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information accessed by labellers documented — purpose, scope, and safeguards", - "control_name": "P3.1 — Personal information collection", - "entries": [ + "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information extracted from multimodal inputs subject to same use restrictions as source data", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool access scoped to minimum required — agent tool permissions as privileged access" + }, { "id": "DSGAI09", "name": "Multimodal Cross-Channel Leakage", @@ -41224,47 +37572,35 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Access controls on multimodal content stores — same rigour as equivalent text data stores" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Strict session isolation — each user's context inaccessible to all other sessions" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented", - "control_name": "P3.1 — Personal information collection", - "entries": [ + "notes": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in telemetry used only for authorised purposes — same restrictions as production data", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "RBAC on all vector store collections — no unauthenticated access" + }, { "id": "DSGAI14", "name": "Excessive Telemetry and Monitoring Leakage", @@ -41272,127 +37608,103 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Access controls on telemetry stores — same rigour as production data stores" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations", - "control_name": "P4.1 — Privacy information lifecycle", - "entries": [ + "notes": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "API rate limiting as access control limiting systematic model extraction" } ] }, { "framework": "SOC 2", - "control_id": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases", - "control_name": "P5.1 — Personal information use", + "control_id": "CC6.3", + "control_name": "Access removal", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)", - "control_name": "C1.1 — Confidentiality policy", - "entries": [ + "notes": "Session termination logs, credential TTL configuration" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs" } ] }, { "framework": "SOC 2", - "control_id": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "CC7.2", + "control_name": "Anomaly and threat detection", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs", - "control_name": "C1.1 — Confidentiality policy", - "entries": [ + "notes": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases", - "control_name": "PI1.1 — Processing integrity policy", - "entries": [ + "notes": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted" + }, { "id": "LLM07", "name": "Misinformation", @@ -41400,15 +37712,26 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing", - "control_name": "PI1.1 — Processing integrity policies", - "entries": [ + "notes": "Production monitoring for accuracy degradation and hallucination patterns — drift detection" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Access to system prompt storage monitored — anomalous access attempts detected and alerted" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -41416,47 +37739,35 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted", - "control_name": "PI1.1 — Processing integrity policy", - "entries": [ + "notes": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability", - "control_name": "P1.1 — Privacy management", - "entries": [ + "notes": "Monitoring configuration, alert logs, incident records" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Processing based on compromised memory is not authorised — memory integrity controls support PI1 evidence", - "control_name": "PI1.1", - "entries": [ + "notes": "Tool call audit log, anomaly alert records" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Execution audit log, alert configuration" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -41464,159 +37775,89 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Integrity verification configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Production monitoring for accuracy degradation and hallucination patterns — drift detection", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Memory access log, anomaly alert configuration" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed", - "control_name": "CC3.2 — Risk assessment identifies threats and vulnerabilities", - "entries": [ + "notes": "Inter-agent traffic logs, anomaly alert records" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Agent action audit log, anomaly alert records" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Query allowlisting and human confirmation procedures documented", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Model output anomaly monitoring — poisoning indicators detected before operational impact" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index", - "control_name": "PI1.2 — System inputs complete and accurate", - "entries": [ + "notes": "Ingestion anomaly detection — unusual payloads detected before pipeline completion" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Rate limiting and resource controls protect LLM service availability — implemented and monitored", - "control_name": "A1.2 — Environmental protections", - "entries": [ + "notes": "Cross-session access anomalies monitored — unusual retrieval patterns detected" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted" + }, { "id": "DSGAI13", "name": "Vector Store Platform Security", @@ -41624,175 +37865,164 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access in any environment", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Vector store query anomaly monitoring — bulk extraction patterns detected" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Re-identification risk in synthetic datasets identified in risk assessment", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Access anomaly monitoring on telemetry stores — bulk access patterns detected" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Output monitoring for reconstruction indicators — systematic query patterns detected" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements", - "control_name": "CC2.1 — Communication", - "entries": [ + "notes": "Model extraction pattern monitoring — unusual query diversity and volume detected" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production" } ] }, { "framework": "SOC 2", - "control_id": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC7.3", + "control_name": "Security event evaluation", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Credential audit log, anomaly alert records" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "IR plan covering cascade scenarios, incident records" } ] }, { "framework": "SOC 2", - "control_id": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC8.1", + "control_name": "Change management", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Rogue agent impact on availability — resource consumption by rogue agents does not degrade service for authorised operations", - "control_name": "A1.1", - "entries": [ + "notes": "LLM model updates and component changes managed through change management — approval, testing, rollback" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Resource monitoring, quota enforcement records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Rogue agent risk in risk assessment — autonomous agent operating outside scope is a documented risk", - "control_name": "CC3.3", - "entries": [ + "notes": "Model promotions managed through change management — integrity verification before production deployment" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Change management records, security review sign-offs" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Risk register with rogue agent scenarios" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Runtime monitoring for goal-deviation indicators — AI-specific anomaly detection covering instruction-override patterns", - "control_name": "CC7.2", - "entries": [ + "notes": "Model promotions through change management — integrity verification before production deployment" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitoring configuration, alert logs, incident records" + "notes": "Vector database CVE patching managed through change management — timely remediation documented" } ] }, { "framework": "SOC 2", - "control_id": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring", - "control_name": "CC7.2 — Anomaly and threat detection", + "control_id": "CC9.1", + "control_name": "Vendor risk management", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -41800,110 +38030,168 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees" } ] }, { "framework": "SOC 2", - "control_id": "Silent RAG degradation identified as availability risk in assessment", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Vendor assessments, contractual security obligations" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Vendor assessment records for third-party agents" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use" } ] }, { "framework": "SOC 2", - "control_id": "Strict session isolation — each user's context inaccessible to all other sessions", - "control_name": "CC6.1 — Logical access", + "control_id": "P1.1", + "control_name": "Privacy management", "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability" } ] }, { "framework": "SOC 2", - "control_id": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "P3.1", + "control_name": "Personal information collection", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Personal information accessed by labellers documented — purpose, scope, and safeguards" } ] }, { "framework": "SOC 2", - "control_id": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data", - "control_name": "P4.2 — Retention of personal information", + "control_id": "P4.1", + "control_name": "Privacy information lifecycle", "entries": [ { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations" } ] }, { "framework": "SOC 2", - "control_id": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed", - "control_name": "C2.1 — Confidential information protection", + "control_id": "P4.2", + "control_name": "Retention of personal information", "entries": [ { "id": "DSGAI10", @@ -41912,47 +38200,33 @@ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data" } ] }, { "framework": "SOC 2", - "control_id": "System prompt security procedures — version control, rotation, extraction resistance testing documented", - "control_name": "CC5.2 — Control activities", + "control_id": "P5.1", + "control_name": "Personal information use", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -41960,247 +38234,215 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Personal information extracted from multimodal inputs subject to same use restrictions as source data" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Third-party agentic components assessed — agent frameworks, tool vendors, model providers subject to vendor risk management", - "control_name": "CC9.2", - "entries": [ + "notes": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vendor assessments, contractual security obligations" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Third-party agents treated as vendor risk — agents from external providers assessed before integration", - "control_name": "CC9.2", - "entries": [ + "notes": "Personal information in telemetry used only for authorised purposes — same restrictions as production data" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Vendor assessment records for third-party agents" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Tool access scoped to minimum required — agent tool permissions as privileged access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task" } ] }, { "framework": "SOC 2", - "control_id": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use", - "control_name": "CC9.1 — Vendor risk", + "control_id": "P7.1", + "control_name": "P7.1", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Accuracy review procedures" } ] }, { "framework": "SOC 2", - "control_id": "Tool invocations are complete and accurate — parameter validation ensures tool calls match intended business operation", - "control_name": "PI1.2", + "control_id": "PI1.1", + "control_name": "Processing integrity policy", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validation configuration, rejected call logs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Action audit log, authorisation records per agent session" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Trust exploitation risk in risk assessment — social engineering, impersonation, false urgency scenarios documented", - "control_name": "CC3.3", - "entries": [ + "notes": "Code execution authorisation records" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Integrity verification configuration" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk register with trust exploitation entries" + "notes": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted" } ] }, { "framework": "SOC 2", - "control_id": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope", - "control_name": "CC3.2 — Risk assessment", + "control_id": "PI1.2", + "control_name": "System inputs are complete and accurate", "entries": [ { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "User session context classified as confidential — technical isolation controls", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Validation configuration, rejected call logs" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index" } ] }, { "framework": "SOC 2", - "control_id": "Vector database CVE patching managed through change management — timely remediation documented", - "control_name": "CC8.1 — Change management", + "control_id": "PI1.3", + "control_name": "PI1.3", "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Vector store content encrypted at rest — embeddings of confidential data protected", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Output quality controls, factual accuracy testing" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Vector store query anomaly monitoring — bulk extraction patterns detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "LLM-generated query results validated — destructive or over-broad queries blocked before execution" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery" } ] }, diff --git a/data/entries/ASI01.json b/data/entries/ASI01.json index 53fc4bb..a456b63 100644 --- a/data/entries/ASI01.json +++ b/data/entries/ASI01.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Goal hijack scenarios identified and mitigated in risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Agent goal hijack included in Art. 9 risk assessment for every agentic deployment", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Meaningful human oversight over high-risk AI system outputs", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Agents whose goals can be hijacked and execute autonomously are an Art. 14 failure — human confirmation required before goal-changing actions", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Input filtering, goal-state verification, and injection detection are Art. 15 technical requirements", @@ -257,7 +257,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure application development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure application development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Secure development standards covering agentic integrations — input validation, goal-state verification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing programme", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-18", "notes": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All agent inputs logged — injection attempts detectable through log analysis", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy a network intrusion detection solution", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.8", + "control_name": "Deploy a network intrusion detection solution", "tier": "Foundational", "scope": "Both", + "parent": "CIS-13", "notes": "Network-layer monitoring for injection indicators in agent traffic", "confidence": "unreviewed", "reviewed_by": [] @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Vulnerabilities common to IT/OT", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "Vulnerabilities common to IT/OT", "tier": "Foundational", "scope": "Both", "notes": "Injection via historian and SCADA data feeds", @@ -417,8 +421,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess injection risk at every agent data ingestion point", @@ -427,8 +431,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls for ICS", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls for ICS", "tier": "Foundational", "scope": "Both", "notes": "Input validation mandatory at OT data boundary", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Goal hijack risk identified in risk assessment — prompt injection, indirect injection, multi-turn manipulation documented", - "control_name": "CC3.2", + "control_id": "CC3.2", + "control_name": "COSO principle 7 — Risk identification and analysis", "tier": "Foundational", "scope": "Both", "notes": "Risk register with goal hijack entries, treatment status", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Runtime monitoring for goal-deviation indicators — AI-specific anomaly detection covering instruction-override patterns", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitoring configuration, alert logs, incident records", @@ -497,8 +501,8 @@ }, { "framework": "SOC 2", - "control_id": "Control activities define acceptable agent actions — agent cannot deviate from authorised goal scope", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Foundational", "scope": "Both", "notes": "Agent permission policy, goal-state verification design documentation", @@ -507,8 +511,8 @@ }, { "framework": "SOC 2", - "control_id": "Agent processing is authorised — actions taken by agent correspond to user's authorised intent, not attacker's injected instruction", - "control_name": "PI1.1", + "control_id": "PI1.1", + "control_name": "Processing integrity — input completeness and accuracy", "tier": "Foundational", "scope": "Both", "notes": "Action audit log, authorisation records per agent session", @@ -517,8 +521,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Bespoke agent code reviewed for injection resistance — all agent integration code includes prompt injection as a vulnerability category", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Foundational", "scope": "Both", "notes": "Secure code review records, findings, remediation", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Penetration testing covers goal hijack — agentic AI systems tested for prompt injection before production and annually", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Foundational", "scope": "Both", @@ -537,7 +541,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent actions logged — all goal-relevant agent actions logged with user identity, session ID, and action detail", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -547,7 +551,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Targeted risk analysis documents goal hijack — likelihood, impact on CHD, treatment controls specified", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Foundational", "scope": "Both", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "notes": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Output Used by a Downstream Component", - "control_name": "CWE-74", + "control_id": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements in Output Used by a Downstream Component", "tier": "Foundational", "scope": "Both", "notes": "Instruction elements in processed content not neutralised before agent reasoning", @@ -677,8 +681,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Protection Mechanism Failure", - "control_name": "CWE-693", + "control_id": "CWE-693", + "control_name": "Protection Mechanism Failure", "tier": "Foundational", "scope": "Both", "notes": "Safety and goal-verification controls bypassed through injection", @@ -687,8 +691,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Unintended Proxy or Intermediary", - "control_name": "CWE-441", + "control_id": "CWE-441", + "control_name": "Unintended Proxy or Intermediary", "tier": "Foundational", "scope": "Both", "notes": "Agent acts as a proxy executing attacker instructions against backend systems", @@ -697,8 +701,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Externally Controlled Reference to a Resource in Another Sphere", - "control_name": "CWE-610", + "control_id": "CWE-610", + "control_name": "Externally Controlled Reference to a Resource in Another Sphere", "tier": "Foundational", "scope": "Both", "notes": "Agent retrieves and acts on externally controlled content (RAG, email, tool returns) without adequate validation", @@ -707,8 +711,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Prompt injection via all agent input channels", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, email content, uploaded files, and any other data source the agent processes", @@ -717,8 +721,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal consistency under adversarial input", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection", @@ -727,8 +731,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal state verification effectiveness", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results", @@ -800,8 +804,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Hijacked agent with excess privilege causes larger blast radius", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Scope all agent credentials to minimum required — least privilege enforced", @@ -810,8 +814,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow hijack to persist beyond session", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens", @@ -820,8 +824,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials allow hijacked agent to impersonate other agents", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique identity per agent — no shared service accounts across agent deployments", @@ -830,8 +834,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model the agent pipeline for adversarial goal manipulation vectors including direct injection, indirect injection via tool outputs, and context poisoning", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Both", "notes": "Ensures goal integrity is a design-phase requirement for all agentic systems", @@ -840,8 +844,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for goal deviation — verify that the agent maintains intended objectives under adversarial input conditions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Catches goal manipulation vulnerabilities before production deployment", @@ -850,8 +854,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial red-team testing against goal hijacking vectors including injection through every data source, tool output, and context channel", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates goal integrity controls under realistic attack conditions", @@ -860,8 +864,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish procedures to identify goal hijacking incidents in production including goal deviation monitoring, triage, and confirmation workflows", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid detection and response to goal manipulation in live systems", diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 2ffa7ed..53b35f9 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Tool misuse risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI actions", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing tool misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "Agent tool access managed as privileged access — minimum scope, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "6.1 Establish access granting process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "6.1", + "control_name": "Establish access granting process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "notes": "Formal process for granting agent tool access — documented justification per tool", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Tool parameter validation as secure development requirement", "confidence": "unreviewed", "reviewed_by": [] @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Common ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "Common ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Excessive privilege is specifically listed as OT vulnerability class", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess agent permission scope as part of OT risk register", @@ -417,8 +421,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Foundational", "scope": "Both", "notes": "Least privilege must be enforced at zone boundary for all automated systems", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Control activities define tool permission scope — which tools are permitted, which parameters are valid, which actions require confirmation", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Foundational", "scope": "Both", "notes": "Tool permission policy, permitted action allowlist", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Logical access controls enforce tool permissions — agent cannot invoke tools outside authorised scope", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Foundational", "scope": "Both", "notes": "Tool invocation logs, access rejection records", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Monitoring for anomalous tool invocations — destructive parameters, out-of-scope tools, unexpected sequences detected", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Foundational", "scope": "Both", "notes": "Tool call audit log, anomaly alert records", @@ -497,8 +501,8 @@ }, { "framework": "SOC 2", - "control_id": "Tool invocations are complete and accurate — parameter validation ensures tool calls match intended business operation", - "control_name": "PI1.2", + "control_id": "PI1.2", + "control_name": "Processing integrity — system processing", "tier": "Foundational", "scope": "Both", "notes": "Validation configuration, rejected call logs", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions follow least-privilege — agent can only access CHD systems required for defined function", + "control_id": "Req 7.2", "control_name": "Req 7.2", "tier": "Foundational", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions reviewed periodically — unused tool permissions removed; review schedule documented", + "control_id": "Req 7.3", "control_name": "Req 7.3", "tier": "Foundational", "scope": "Both", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "All tool invocations on CHD systems logged — tool name, parameters, data accessed, user/session identity", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -537,8 +541,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Tool parameter validation in agent code — LLM-generated tool parameters validated before execution", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Foundational", "scope": "Both", "notes": "Code review records covering parameter validation", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Missing Authorisation", - "control_name": "CWE-862", + "control_id": "CWE-862", + "control_name": "Missing Authorisation", "tier": "Foundational", "scope": "Both", "notes": "No authorisation check before irreversible tool invocations; human confirmation not required", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Unrestricted Upload of File with Dangerous Type", - "control_name": "CWE-434", + "control_id": "CWE-434", + "control_name": "Unrestricted Upload of File with Dangerous Type", "tier": "Foundational", "scope": "Both", "notes": "Analogy: agent accepts and executes tool payloads without content validation", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Dynamically-Managed Code Resources", - "control_name": "CWE-913", + "control_id": "CWE-913", + "control_name": "Improper Control of Dynamically-Managed Code Resources", "tier": "Foundational", "scope": "Both", "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled", @@ -677,8 +681,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "notes": "Tool parameters generated by LLM not validated against safe ranges before execution", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Tool permission boundary enforcement", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Per-tool authorisation", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify each tool enforces its own access controls independently of the agent framework", @@ -707,8 +711,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "LLM-generated tool parameters", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify tool call parameters generated by the LLM are validated before execution", @@ -780,8 +784,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent with excess privilege can call tools in destructive ways even within normal use", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Per-tool permission manifests — each tool scoped to minimum required operations", @@ -790,8 +794,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Compromised third-party tool identity gets full scope of agent credential", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers", @@ -800,8 +804,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Single shared credential allows tool misuse to affect multiple services", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens", @@ -810,8 +814,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements specifying the maximum permitted tool access, API scope, data source access, and resource boundaries for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Build", "notes": "Establishes access control as a mandatory deployment requirement", @@ -820,8 +824,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model all agent access paths to tools, data stores, and APIs; design least-privilege tool manifests and enforce tenant isolation by design", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Build", "notes": "Ensures access boundaries are designed before implementation", @@ -830,8 +834,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect agent configuration files, tool manifests, permission policies, and orchestration definitions from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Build", "notes": "Prevents tampering with access control configuration", @@ -840,8 +844,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent access control enforcement — verify that tool permission manifests, RBAC policies, and tenant isolation boundaries are correctly implemented and cannot be bypassed", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Build", "notes": "Validates access controls before production deployment", diff --git a/data/entries/ASI03.json b/data/entries/ASI03.json index a211435..a9d1f3a 100644 --- a/data/entries/ASI03.json +++ b/data/entries/ASI03.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Credential exposure risk identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for credential incident response", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment", @@ -247,7 +247,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.7", + "control_id": "7", "control_name": "Support", "tier": "Foundational", "scope": "Both", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "6.2 Establish an access revoking process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "6.2", + "control_name": "Establish an access revoking process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All credential operations logged — issuance, use, anomalous patterns detectable", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "Agent credentials encrypted at rest — secret manager, no cleartext storage", "confidence": "unreviewed", "reviewed_by": [] @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Memory corruption and state manipulation", @@ -417,8 +421,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess agent memory stores as OT data integrity risk", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Agent credentials managed as logical access assets — provisioning, scope, rotation, revocation per access management policy", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Foundational", "scope": "Both", "notes": "Credential lifecycle records, provisioning logs", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Credentials revoked at session end — no persistent credential caching in agent memory after session terminates", - "control_name": "CC6.3", + "control_id": "CC6.3", + "control_name": "Access removal", "tier": "Foundational", "scope": "Both", "notes": "Session termination logs, credential TTL configuration", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Credential usage monitored — anomalous scope expansion or after-session access detected", - "control_name": "CC7.3", + "control_id": "CC7.3", + "control_name": "Security event evaluation", "tier": "Foundational", "scope": "Both", "notes": "Credential audit log, anomaly alert records", @@ -497,8 +501,8 @@ }, { "framework": "SOC 2", - "control_id": "Agent credentials treated as confidential information — stored in secrets manager, access-controlled", - "control_name": "C1.1", + "control_id": "C1.1", + "control_name": "Confidentiality identification", "tier": "Foundational", "scope": "Both", "notes": "Secrets management configuration, access control evidence", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent accounts are system/application accounts — unique agent identity per deployment, no shared credentials", + "control_id": "Req 8.2", "control_name": "Req 8.2", "tier": "Foundational", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent credential management — unique credentials, strong authentication where interactive, credential rotation schedule", + "control_id": "Req 8.3", "control_name": "Req 8.3", "tier": "Foundational", "scope": "Both", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows need-to-know — access to cardholder data restricted to what agent function requires", + "control_id": "Req 7.2", "control_name": "Req 7.2", "tier": "Foundational", "scope": "Both", @@ -537,7 +541,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent credential usage logged — all authentication events for agent accounts in CHD scope logged", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Execution with Unnecessary Privileges", - "control_name": "CWE-250", + "control_id": "CWE-250", + "control_name": "Execution with Unnecessary Privileges", "tier": "Foundational", "scope": "Both", "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Insufficiently Protected Credentials", - "control_name": "CWE-522", + "control_id": "CWE-522", + "control_name": "Insufficiently Protected Credentials", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Cleartext Storage of Sensitive Information", - "control_name": "CWE-312", + "control_id": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Both", "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Use of Hard-coded Credentials", - "control_name": "CWE-798", + "control_id": "CWE-798", + "control_name": "Use of Hard-coded Credentials", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials hardcoded in prompts or source code", @@ -677,8 +681,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Insufficient Session Expiration", - "control_name": "CWE-613", + "control_id": "CWE-613", + "control_name": "Insufficient Session Expiration", "tier": "Foundational", "scope": "Both", "notes": "Long-lived agent credentials without expiry or rotation — NHI-7", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential scope enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential usage audit trail", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation", @@ -707,8 +711,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential leakage paths", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Foundational", "scope": "Both", "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads", @@ -780,8 +784,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials not revoked on decommission — dormant tokens exploitable", - "control_name": "NHI-1 Improper Offboarding", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "tier": "Foundational", "scope": "Both", "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed", @@ -790,8 +794,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials exposed in memory, logs, tool payloads", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "No credentials in agent context, logs, or tool payloads — secret manager only", @@ -800,8 +804,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive permissions inherited by agent", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens", @@ -810,8 +814,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Weak agent-to-system authentication — credential reuse or weak secrets", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Foundational", "scope": "Both", "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens", @@ -820,8 +824,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent holds more permissions than required — lateral movement amplifier", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Least privilege per agent role — scope enforced, reviewed quarterly", @@ -830,8 +834,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials stored in cleartext — config files, environment variables", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Secret manager for all agent credentials — no cleartext storage anywhere", @@ -840,8 +844,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent tokens without expiry — compromise persists indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials — task-scoped tokens with automatic expiry", @@ -850,8 +854,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Production agent credentials accessible in dev/test environments", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse", @@ -860,8 +864,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared agent credential across multiple instances or deployments", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique identity per agent deployment — no credential sharing", @@ -870,8 +874,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent service accounts — no attribution, no MFA", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials machine-only — human use detected and blocked", @@ -880,8 +884,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit privilege boundaries for each agent identity — maximum permitted privilege level, credential scope, and escalation constraints", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Both", "notes": "Establishes privilege boundaries as mandatory requirements", @@ -890,8 +894,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Implement secure credential handling — agents must not inherit user credentials, store tokens in context, or pass credentials between agents without explicit authorisation", - "control_name": "PW.5.1-PS – Secure coding practices", + "control_id": "PW.5.1-PS", + "control_name": "Secure coding practices", "tier": "Foundational", "scope": "Both", "notes": "Prevents credential leakage through agent code paths", @@ -900,8 +904,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect credential stores, identity configurations, and privilege mapping files from unauthorised access and modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Both", "notes": "Prevents tampering with privilege boundaries", @@ -910,8 +914,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring and triage procedures for privilege escalation incidents — detect agents operating beyond their assigned privilege level", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid detection of privilege escalation in production", diff --git a/data/entries/ASI04.json b/data/entries/ASI04.json index a844f23..19e6fad 100644 --- a/data/entries/ASI04.json +++ b/data/entries/ASI04.json @@ -168,8 +168,8 @@ }, { "framework": "EU AI Act", - "control_id": "Supply chain risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope", @@ -178,8 +178,8 @@ }, { "framework": "EU AI Act", - "control_id": "Quality management includes supply chain controls", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Documented supply chain security procedures — component verification, change management", @@ -188,8 +188,8 @@ }, { "framework": "EU AI Act", - "control_id": "Providers document obligations; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Agent tool and MCP server supply chain obligations distributed along value chain", @@ -278,40 +278,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", + "control_id": "2.1", + "control_name": "Establish and maintain software inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "notes": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management process", - "control_name": "CIS 7 — Continuous Vulnerability Management", + "control_id": "7.1", + "control_name": "Establish vulnerability management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-7", "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.6 Use only up-to-date and trusted third-party components", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.6", + "control_name": "Use only up-to-date and trusted third-party components", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Approved component list — only sourced from approved vendors, signatures verified", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "15.1 Establish service provider management process", - "control_name": "CIS 15 — Service Provider Management", + "control_id": "15.1", + "control_name": "Establish service provider management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-15", "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding", "confidence": "unreviewed", "reviewed_by": [] @@ -398,8 +402,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Lateral movement between control systems", @@ -408,8 +412,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess inter-agent trust as OT risk", @@ -418,8 +422,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Authenticate all automated system-to-system communications", @@ -468,8 +472,8 @@ }, { "framework": "SOC 2", - "control_id": "Third-party agentic components assessed — agent frameworks, tool vendors, model providers subject to vendor risk management", - "control_name": "CC9.2", + "control_id": "CC9.2", + "control_name": "Vendor and business partner risk", "tier": "Foundational", "scope": "Both", "notes": "Vendor assessments, contractual security obligations", @@ -478,8 +482,8 @@ }, { "framework": "SOC 2", - "control_id": "Component changes managed through change management — model updates, framework upgrades, tool changes require security review", - "control_name": "CC8.1", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Foundational", "scope": "Both", "notes": "Change management records, security review sign-offs", @@ -488,8 +492,8 @@ }, { "framework": "SOC 2", - "control_id": "Agentic supply chain risk included in risk assessment — compromised component scenarios documented with treatment", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Foundational", "scope": "Both", "notes": "Risk register with supply chain entries", @@ -498,8 +502,8 @@ }, { "framework": "SOC 2", - "control_id": "Integrity checks required before component deployment — cryptographic verification of model weights and tool descriptors", - "control_name": "CC5.3", + "control_id": "CC5.3", + "control_name": "COSO principle 12 — Policies and procedures", "tier": "Foundational", "scope": "Both", "notes": "Integrity verification configuration, deployment logs", @@ -508,8 +512,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agentic component vendors with CHD access managed as TPSPs — written agreements, annual confirmation of PCI compliance", - "control_name": "Req 12.8", + "control_id": "Req 12.8", + "control_name": "TPSP programme", "tier": "Foundational", "scope": "Both", "notes": "TPSP list, written agreements, compliance confirmations", @@ -518,7 +522,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agentic component CVEs in vulnerability management — ML libraries, agent frameworks, inference runtime dependencies scanned", + "control_id": "Req 6.3", "control_name": "Req 6.3", "tier": "Foundational", "scope": "Both", @@ -528,7 +532,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Malicious software protection for agent components — integrity verification for model weights and plugin descriptors", + "control_id": "Req 5.2", "control_name": "Req 5.2", "tier": "Foundational", "scope": "Both", @@ -538,7 +542,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Secure baseline configuration for agentic infrastructure — hardening standards applied to agent deployment platforms", + "control_id": "Req 2.2", "control_name": "Req 2.2", "tier": "Foundational", "scope": "Both", @@ -638,8 +642,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Download of Code Without Integrity Check", - "control_name": "CWE-494", + "control_id": "CWE-494", + "control_name": "Download of Code Without Integrity Check", "tier": "Foundational", "scope": "Both", "notes": "Agent tool components and MCP servers loaded without signature verification", @@ -648,8 +652,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Inclusion of Functionality from Untrusted Control Sphere", - "control_name": "CWE-829", + "control_id": "CWE-829", + "control_name": "Inclusion of Functionality from Untrusted Control Sphere", "tier": "Foundational", "scope": "Both", "notes": "MCP servers and plugins from external registries loaded into agent execution context", @@ -658,8 +662,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Embedded Malicious Code", - "control_name": "CWE-506", + "control_id": "CWE-506", + "control_name": "Embedded Malicious Code", "tier": "Foundational", "scope": "Both", "notes": "Model weights and tool components containing hidden backdoor functionality", @@ -668,8 +672,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Reliance on Insufficiently Trustworthy Component", - "control_name": "CWE-1357", + "control_id": "CWE-1357", + "control_name": "Reliance on Insufficiently Trustworthy Component", "tier": "Foundational", "scope": "Both", "notes": "Agent dependency on third-party MCP servers without security assessment", @@ -678,8 +682,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Unintended Proxy or Intermediary", - "control_name": "CWE-441", + "control_id": "CWE-441", + "control_name": "Unintended Proxy or Intermediary", "tier": "Foundational", "scope": "Both", "notes": "Compromised tool acting as malicious intermediary in agent workflow", @@ -688,8 +692,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Component integrity verification", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Foundational", "scope": "Both", "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors", @@ -698,8 +702,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural change detection post-update", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update", @@ -708,8 +712,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Runtime component monitoring", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify that component modification at runtime is detected and triggers agent suspension", @@ -781,8 +785,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Compromised MCP server holds or can request excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources", @@ -791,8 +795,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Malicious components extract credentials from agent memory or config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Credential isolation — components cannot access other components' credentials", @@ -801,8 +805,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Supply chain compromise introduces credential exfiltration code", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Scan all agent components for credential access patterns before deployment", @@ -811,8 +815,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Vet all third-party agent components — tools, plugins, MCP servers, model weights, orchestration libraries — for provenance, integrity, and security posture before use", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", + "control_id": "PW.4.1-PS", + "control_name": "Reuse existing well-secured software", "tier": "Foundational", "scope": "Both", "notes": "Prevents introduction of compromised components into agent pipelines", @@ -821,8 +825,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Verify integrity of all agent artefacts and third-party components using cryptographic signatures and checksums before deployment", - "control_name": "PS.2.1-PS – Verify software integrity", + "control_id": "PS.2.1-PS", + "control_name": "Verify software integrity", "tier": "Foundational", "scope": "Both", "notes": "Detects tampering in agent supply chain artefacts", @@ -831,8 +835,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Maintain a secure, versioned registry of all agent components with provenance records; enable auditability and rollback", - "control_name": "PS.3.1-PS – Archive and protect software releases", + "control_id": "PS.3.1-PS", + "control_name": "Archive and protect software releases", "tier": "Foundational", "scope": "Both", "notes": "Ensures traceability and recovery capability for supply chain incidents", @@ -841,8 +845,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Monitor for newly disclosed vulnerabilities in third-party agent components; establish a triage process for AI-specific supply chain disclosures", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid response to supply chain compromises", diff --git a/data/entries/ASI05.json b/data/entries/ASI05.json index 1ab4db1..6498a58 100644 --- a/data/entries/ASI05.json +++ b/data/entries/ASI05.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Code execution risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial code execution", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering code execution incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Code execution anomaly response in quality management system", @@ -257,7 +257,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Sandbox, static analysis, and allowlist as secure development requirements for code execution", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Hardening", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "notes": "Sandbox escape and code injection in penetration testing — adversarial scenarios before each deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy network intrusion detection", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.8", + "control_name": "Deploy network intrusion detection", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "notes": "Code execution environments network-monitored — outbound connection attempts from sandbox detected", "confidence": "unreviewed", "reviewed_by": [] @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Third-party tool components in OT", @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Tool integration approval process", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Vendor assessment for OT tool providers", @@ -457,8 +461,8 @@ }, { "framework": "SOC 2", - "control_id": "Control activities define permitted code execution scope — sandbox requirements, approved languages, forbidden operations", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Hardening", "scope": "Both", "notes": "Code execution policy, sandbox configuration", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Execution sandboxes access-controlled — no host filesystem or network access without authorisation", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Hardening", "scope": "Both", "notes": "Sandbox configuration, access control evidence", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Code execution events monitored — syscall patterns, network calls, and filesystem access from sandboxes logged", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Execution audit log, alert configuration", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Code execution is authorised — agent cannot execute code that was not explicitly requested by authorised user", - "control_name": "PI1.1", + "control_id": "PI1.1", + "control_name": "Processing integrity — input completeness and accuracy", "tier": "Hardening", "scope": "Both", "notes": "Code execution authorisation records", @@ -497,8 +501,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Code generation and execution controls in secure development — agent cannot execute generated code without validation", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Hardening", "scope": "Both", "notes": "Secure development policy covering code generation", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent execution environments protected — WAF or equivalent for agent endpoints with code execution capability", + "control_id": "Req 6.4", "control_name": "Req 6.4", "tier": "Hardening", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Code execution paths in penetration testing — test whether crafted inputs cause execution of out-of-scope code", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Hardening", "scope": "Both", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Code execution events logged — all agent-initiated execution with session identity and code summary", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Hardening", "scope": "Both", @@ -627,8 +631,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Generation of Code", - "control_name": "CWE-94", + "control_id": "CWE-94", + "control_name": "Improper Control of Generation of Code", "tier": "Foundational", "scope": "Both", "notes": "Agent generates and executes code without adequate static analysis or sandbox", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in OS Command", - "control_name": "CWE-78", + "control_id": "CWE-78", + "control_name": "Improper Neutralisation of Special Elements in OS Command", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated code containing shell commands executed without sanitisation", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Command", - "control_name": "CWE-77", + "control_id": "CWE-77", + "control_name": "Improper Neutralisation of Special Elements in Command", "tier": "Foundational", "scope": "Both", "notes": "LLM output used directly in command context", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Directives in Dynamically Evaluated Code", - "control_name": "CWE-95", + "control_id": "CWE-95", + "control_name": "Improper Neutralisation of Directives in Dynamically Evaluated Code", "tier": "Foundational", "scope": "Both", "notes": "Eval of LLM-generated code", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Use of Potentially Dangerous Function", - "control_name": "CWE-676", + "control_id": "CWE-676", + "control_name": "Use of Potentially Dangerous Function", "tier": "Foundational", "scope": "Both", "notes": "Agent uses exec(), eval(), subprocess without validation", @@ -677,8 +681,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Code injection via crafted prompts", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Hardening", "scope": "Both", "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Generated code validation", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Hardening", "scope": "Both", "notes": "Verify static analysis catches dangerous operations before execution", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Sandbox escape attempts", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Test sandbox boundary enforcement from within the execution environment", @@ -770,8 +774,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Code executes in context of over-privileged agent credential — amplifies RCE impact", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity", @@ -780,8 +784,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Code execution in production context with prod credentials", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Hardening", "scope": "Both", "notes": "Strict environment isolation for code execution — dedicated sandboxed identity", @@ -790,8 +794,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credential means RCE in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access", @@ -800,8 +804,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model all code execution paths in agent workflows; design sandboxing, resource limits, and execution constraints as explicit security requirements", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Both", "notes": "Ensures code execution boundaries are designed before implementation", @@ -810,8 +814,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Implement secure coding for agent code execution — sandbox isolation, input validation for code generation, output filtering, and prevention of self-modification", - "control_name": "PW.5.1-PS – Secure coding practices", + "control_id": "PW.5.1-PS", + "control_name": "Secure coding practices", "tier": "Foundational", "scope": "Both", "notes": "Prevents code execution vulnerabilities in agent implementation", @@ -820,8 +824,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting code execution — sandbox escapes, resource limit bypasses, self-modification, and host system access through generated code", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates execution boundary controls under attack conditions", @@ -830,8 +834,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect agent execution environments, sandbox configurations, and runtime constraints from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Both", "notes": "Prevents weakening of execution boundaries through configuration tampering", diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json index 405d670..b219647 100644 --- a/data/entries/ASI06.json +++ b/data/entries/ASI06.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data governance applies to all data influencing AI behaviour — including agent memory", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial memory manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Memory integrity monitoring and access controls are Art. 15 requirements", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring for memory integrity", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Memory anomaly detection in post-market monitoring programme", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "Memory write operations logged — who or what wrote, when, content hash", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Memory write validation as secure development requirement — untrusted sources cannot write directly", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.3 Deploy a network-based intrusion detection system", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.3", + "control_name": "Deploy a network-based intrusion detection system", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "notes": "Memory store access monitored — bulk read, anomalous write patterns detected", "confidence": "unreviewed", "reviewed_by": [] @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality risks in OT", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality risks in OT", "tier": "Hardening", "scope": "Both", "notes": "OT data exfiltration via compromised automation", @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess outbound data paths from agent", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor all outbound data from OT zone", @@ -457,8 +461,8 @@ }, { "framework": "SOC 2", - "control_id": "Memory poisoning risk documented in risk assessment — scenarios for RAG, persistent memory, and context window corruption", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Hardening", "scope": "Both", "notes": "Risk register with memory poisoning entries", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Agent memory stores monitored for unexpected modifications — baseline established, deviations trigger alerts", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Memory access log, anomaly alert configuration", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Processing based on compromised memory is not authorised — memory integrity controls support PI1 evidence", - "control_name": "PI1.1", + "control_id": "PI1.1", + "control_name": "Processing integrity — input completeness and accuracy", "tier": "Hardening", "scope": "Both", "notes": "Integrity verification configuration", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Controls on memory store write access — only authorised processes may write to agent memory stores", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Hardening", "scope": "Both", "notes": "Memory access policy, write access controls", @@ -497,7 +501,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "PAN in agent memory protected — primary account numbers truncated or masked if stored in agent context or memory stores", + "control_id": "Req 3.4", "control_name": "Req 3.4", "tier": "Hardening", "scope": "Both", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent memory encryption — CHD in persistent memory stores encrypted using strong cryptography", + "control_id": "Req 3.5", "control_name": "Req 3.5", "tier": "Hardening", "scope": "Both", @@ -517,8 +521,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Model and memory changes managed — updates to agent memory stores treated as system changes requiring security review", - "control_name": "Req 6.5", + "control_id": "Req 6.5", + "control_name": "Secure system changes", "tier": "Hardening", "scope": "Both", "notes": "Change management records", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Memory poisoning in penetration test scope — test whether adversarial content in memory affects agent behaviour", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Hardening", "scope": "Both", @@ -627,8 +631,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Acceptance of Extraneous Untrusted Data with Trusted Data", - "control_name": "CWE-349", + "control_id": "CWE-349", + "control_name": "Acceptance of Extraneous Untrusted Data with Trusted Data", "tier": "Foundational", "scope": "Both", "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Insufficient Verification of Data Authenticity", - "control_name": "CWE-345", + "control_id": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Foundational", "scope": "Both", "notes": "Memory content not integrity-verified before storage or retrieval", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "notes": "Content entering agent memory not validated before write", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Multiple Releases of Same Resource or Handle", - "control_name": "CWE-1341", + "control_id": "CWE-1341", + "control_name": "Multiple Releases of Same Resource or Handle", "tier": "Foundational", "scope": "Both", "notes": "Memory TTL not enforced — entries persist beyond intended lifetime", @@ -677,8 +681,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Memory write path injection", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Attempt to poison memory through every channel that can write to agent memory stores", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Poisoned memory influence detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Hardening", "scope": "Both", "notes": "Verify that behaviour influenced by poisoned memory differs detectably from baseline", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Memory content integrity", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Hardening", "scope": "Both", "notes": "Verify memory store content integrity monitoring detects unauthorised modification", @@ -761,8 +765,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials leaked — attacker writes poisoned content directly", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Hardening", "scope": "Both", "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context", @@ -771,8 +775,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials in cleartext — trivially extracted", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Secret manager for all memory store credentials — no cleartext anywhere", @@ -781,8 +785,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived memory store credentials enable persistent access for attacker", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived credentials for memory store access — rotate on each agent session", @@ -791,8 +795,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect agent memory stores, context databases, and shared state repositories from unauthorised read, write, and modification; enforce access controls per agent identity", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Both", "notes": "Prevents direct tampering with agent memory and context", @@ -801,8 +805,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Maintain versioned, integrity-verified snapshots of agent memory and context stores; enable rollback to pre-poisoning states", - "control_name": "PS.3.1-PS – Archive and protect software releases", + "control_id": "PS.3.1-PS", + "control_name": "Archive and protect software releases", "tier": "Foundational", "scope": "Both", "notes": "Ensures recovery capability for memory poisoning incidents", @@ -811,8 +815,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for memory-influenced anomalies — verify that persistent memory and shared context do not introduce unintended behaviour changes across sessions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Catches memory poisoning effects before they propagate", @@ -821,8 +825,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "When memory poisoning is detected, conduct forensic analysis to identify the poisoned records, their ingestion source, propagation path, and blast radius across agents", - "control_name": "RV.3.1-PS – Analyse root causes", + "control_id": "RV.3.1-PS", + "control_name": "Analyse root causes", "tier": "Foundational", "scope": "Both", "notes": "Enables thorough incident response for memory poisoning events", diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json index fb4defc..7a415a2 100644 --- a/data/entries/ASI07.json +++ b/data/entries/ASI07.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "A2A communication risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting all system components", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documentation of A2A security controls", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "A2A authentication and encryption documented in quality management system", @@ -257,7 +257,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.8", + "control_id": "8", "control_name": "Operation", "tier": "Hardening", "scope": "Both", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "12.4 Establish and maintain architecture diagram", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.4", + "control_name": "Establish and maintain architecture diagram", "tier": "Hardening", "scope": "Both", + "parent": "CIS-12", "notes": "A2A communication channels mapped in network architecture — authentication method, encryption status", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.10 Encrypt sensitive data in transit", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.10", + "control_name": "Encrypt sensitive data in transit", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "notes": "All A2A messages encrypted in transit — no cleartext inter-agent communication", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "A2A authentication and schema validation as secure development requirements", "confidence": "unreviewed", "reviewed_by": [] @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Expanded to include agentic AI components", @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "SBOM and vendor assessment for agentic stack", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Formal vendor programme for OT agent components", @@ -457,8 +461,8 @@ }, { "framework": "SOC 2", - "control_id": "Inter-agent authentication required — all agent-to-agent messages authenticated before acting", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Hardening", "scope": "Both", "notes": "mTLS configuration, certificate management records", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Inter-agent communication policy — which agents may communicate with which, under what conditions, with what data", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent communication policy document", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Inter-agent traffic monitored — unexpected communication patterns, unauthorised agent requests detected", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent traffic logs, anomaly alert records", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Third-party agents treated as vendor risk — agents from external providers assessed before integration", - "control_name": "CC9.2", + "control_id": "CC9.2", + "control_name": "Vendor and business partner risk", "tier": "Hardening", "scope": "Both", "notes": "Vendor assessment records for third-party agents", @@ -497,7 +501,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "CHD encrypted in transit between agents — all inter-agent communication carrying CHD uses TLS 1.2+", + "control_id": "Req 4.2", "control_name": "Req 4.2", "tier": "Hardening", "scope": "Both", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Inter-agent authentication — agents authenticate to each other before exchanging CHD", + "control_id": "Req 8.2", "control_name": "Req 8.2", "tier": "Hardening", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Inter-agent CHD exchanges logged — source, destination, data classification, timestamp", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Hardening", "scope": "Both", @@ -527,8 +531,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Secure development requirements for inter-agent APIs — authentication and encryption requirements in design specifications", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Hardening", "scope": "Both", "notes": "Design documentation, code review records", @@ -627,8 +631,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Authentication", - "control_name": "CWE-287", + "control_id": "CWE-287", + "control_name": "Improper Authentication", "tier": "Foundational", "scope": "Both", "notes": "A2A channels without mutual authentication — agents accept messages from any sender", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Authentication Bypass by Capture-replay", - "control_name": "CWE-294", + "control_id": "CWE-294", + "control_name": "Authentication Bypass by Capture-replay", "tier": "Foundational", "scope": "Both", "notes": "Replay attacks on A2A channels without nonce-based replay protection", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Cleartext Transmission of Sensitive Information", - "control_name": "CWE-319", + "control_id": "CWE-319", + "control_name": "Cleartext Transmission of Sensitive Information", "tier": "Foundational", "scope": "Both", "notes": "A2A messages containing sensitive context transmitted without encryption", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Origin Validation Error", - "control_name": "CWE-346", + "control_id": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Foundational", "scope": "Both", "notes": "Agent does not verify that A2A messages originate from the claimed sender", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Enforcement of Message Integrity During Transmission", - "control_name": "CWE-924", + "control_id": "CWE-924", + "control_name": "Improper Enforcement of Message Integrity During Transmission", "tier": "Foundational", "scope": "Both", "notes": "A2A message integrity not cryptographically verified", @@ -677,8 +681,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "A2A authentication enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Hardening", "scope": "Both", "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Replay attack prevention", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Capture and replay a valid A2A message; verify replay is rejected", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "A2A audit completeness", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Hardening", "scope": "Both", "notes": "Verify all A2A messages are logged with sender identity and content hash", @@ -761,8 +765,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Weak or missing authentication on A2A channels — agent spoofing enabled", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Hardening", "scope": "Both", "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived", @@ -771,8 +775,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived A2A tokens enable persistent replay attacks", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived A2A tokens with nonce-based replay protection", @@ -781,8 +785,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared A2A credentials allow one compromised agent to impersonate others", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Unique identity per agent — A2A authentication bound to specific agent identity", @@ -791,8 +795,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements constraining permitted tool invocation sequences and cross-tool data flows for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Build", "notes": "Establishes chaining constraints as mandatory requirements", @@ -801,8 +805,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model tool interaction graphs — identify composite action sequences that could achieve unauthorised outcomes; design controls for chain-level authorisation", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Build", "notes": "Ensures chaining risks are addressed at design time", @@ -811,8 +815,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for chain-based scope violations — verify that multi-step tool sequences cannot achieve outcomes exceeding individual tool permissions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Build", "notes": "Catches chaining vulnerabilities before production", @@ -821,8 +825,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for anomalous tool invocation sequences; define triage procedures for suspected lateral chaining incidents", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Build", "notes": "Enables detection of chaining attacks in production", diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json index b0b34c3..4743572 100644 --- a/data/entries/ASI08.json +++ b/data/entries/ASI08.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cascade risks identified and mitigated — blast radius defined", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI — ability to pause and stop", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against cascading failures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers, fail-safe defaults, and cascade containment architecture are Art. 15 requirements", @@ -247,7 +247,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -257,7 +257,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "tier": "Foundational", "scope": "Both", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.6", + "control_name": "Use network-based URL filters", "tier": "Foundational", "scope": "Both", + "parent": "CIS-12", "notes": "Network controls prevent cascade propagation across agent cluster boundaries", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for cascade events — kill switch activation, process control fallback, operations notification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.6 Collect DNS query audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.6", + "control_name": "Collect DNS query audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Agent traffic monitored — cascade indicators detected before physical impact", "confidence": "unreviewed", "reviewed_by": [] @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Advanced", "scope": "Both", "notes": "Safety system bypass is the highest severity OT threat", @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Advanced", "scope": "Both", "notes": "Safety control inversion must be in OT risk register", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Advanced", "scope": "Both", "notes": "Mandatory: safety function must be independent of AI decision layer", @@ -457,8 +461,8 @@ }, { "framework": "SOC 2", - "control_id": "Availability commitments defined for multi-agent system — RTO/RPO documented; cascade failure scenarios in availability risk", - "control_name": "A1.1", + "control_id": "A1.1", + "control_name": "Availability commitments", "tier": "Foundational", "scope": "Both", "notes": "Availability SLA, BCP documentation", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Capacity and performance monitoring — early warning of cascade failure precursors (latency, error rate, queue depth)", - "control_name": "A1.2", + "control_id": "A1.2", + "control_name": "Environmental protections and recovery", "tier": "Foundational", "scope": "Both", "notes": "Monitoring dashboards, alert configuration", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Cascade failure incidents detected and responded to — incident response procedures for multi-agent failures", - "control_name": "CC7.3", + "control_id": "CC7.3", + "control_name": "Security event evaluation", "tier": "Foundational", "scope": "Both", "notes": "IR plan covering cascade scenarios, incident records", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Cascade failure risk in risk assessment — blast radius analysis, dependency mapping documented", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Foundational", "scope": "Both", "notes": "Risk register with cascade failure entries", @@ -497,7 +501,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Critical agent control failures detected promptly — monitoring for cascade precursors with alert thresholds", + "control_id": "Req 10.7", "control_name": "Req 10.7", "tier": "Foundational", "scope": "Both", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Cascade failure risk analysis — targeted risk analysis documents cascade failure likelihood, impact, treatment", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Foundational", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Network controls prevent cascade propagation — agent network segments isolated to contain blast radius", + "control_id": "Req 1.3", "control_name": "Req 1.3", "tier": "Foundational", "scope": "Both", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Baseline availability configuration for agent infrastructure — capacity and resilience requirements in hardening baseline", + "control_id": "Req 2.2", "control_name": "Req 2.2", "tier": "Foundational", "scope": "Both", @@ -627,8 +631,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Uncontrolled Resource Consumption", - "control_name": "CWE-400", + "control_id": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "tier": "Foundational", "scope": "Both", "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Check or Handling of Exceptional Conditions", - "control_name": "CWE-703", + "control_id": "CWE-703", + "control_name": "Improper Check or Handling of Exceptional Conditions", "tier": "Foundational", "scope": "Both", "notes": "Agent failures not caught and handled — exception propagates to downstream agents", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Handling of Exceptional Conditions", - "control_name": "CWE-755", + "control_id": "CWE-755", + "control_name": "Improper Handling of Exceptional Conditions", "tier": "Foundational", "scope": "Both", "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "OWASP ReDoS", - "control_name": "CWE-730", + "control_id": "CWE-730", + "control_name": "OWASP ReDoS", "tier": "Foundational", "scope": "Both", "notes": "Regex-based input processing causing runaway computation propagating through pipeline", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Uncontrolled Recursion", - "control_name": "CWE-674", + "control_id": "CWE-674", + "control_name": "Uncontrolled Recursion", "tier": "Foundational", "scope": "Both", "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade", @@ -677,8 +681,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Circuit breaker trigger and recovery", - "control_name": "AVT — Availability", + "control_id": "AVT", + "control_name": "Availability", "tier": "Foundational", "scope": "Both", "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Blast radius containment", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Cascade detection alert", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring raises alert on cascade indicators before physical impact", @@ -761,8 +765,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Cascading agent failure with over-privileged credentials exposes all accessible systems", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Least privilege per agent — cascade blast radius limited by credential scope", @@ -771,8 +775,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials mean cascade in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement", @@ -781,8 +785,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials exposed during cascade remain valid for attacker use post-incident", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens", @@ -791,8 +795,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Design circuit breakers, step limits, cost budgets, and human approval gates as explicit security requirements for all agentic automation workflows", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Both", "notes": "Ensures cascade prevention is a design-phase requirement", @@ -801,8 +805,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing of cascade failure paths — test error propagation, hallucination amplification, and runaway automation scenarios", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates cascade prevention controls under attack conditions", @@ -811,8 +815,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for cascade failure incidents including automatic circuit breaker activation, workflow suspension, cost cap enforcement, and rollback", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", + "control_id": "RV.2.1-PS", + "control_name": "Assess, prioritise, and remediate vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid response to cascading automation failures", @@ -821,8 +825,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit requirements for maximum automation depth, step limits, cost budgets, and mandatory human checkpoints for each agent workflow", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Both", "notes": "Establishes automation boundaries as mandatory requirements", diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json index 037d23f..4eb1cca 100644 --- a/data/entries/ASI09.json +++ b/data/entries/ASI09.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Users informed of capabilities, limitations, and AI nature", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Agents must clearly communicate their AI nature and advisory limitations", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Effective human oversight over high-risk AI", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Chatbots and AI-generated content must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", + "control_id": "Art. 50", + "control_name": "Transparency for certain AI systems", "tier": "Foundational", "scope": "Both", "notes": "All agent-user interactions require AI disclosure — universal obligation", @@ -257,7 +257,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.5", + "control_id": "5", "control_name": "Policy", "tier": "Foundational", "scope": "Both", @@ -267,40 +267,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness and Skills Training", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "notes": "All users of agentic tools trained on AI limitations — verification requirements, how to identify manipulation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -377,8 +381,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Inadequate human oversight cited as OT vulnerability category", @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Quantify consequences of unsupervised agent OT actions", @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", + "control_id": "§8.2", + "control_name": "OT security programme", "tier": "Foundational", "scope": "Both", "notes": "Governance policy for autonomous OT systems", @@ -447,8 +451,8 @@ }, { "framework": "SOC 2", - "control_id": "AI disclosure policy — users informed when interacting with AI agents; deceptive design patterns prohibited", - "control_name": "CC5.3", + "control_id": "CC5.3", + "control_name": "COSO principle 12 — Policies and procedures", "tier": "Foundational", "scope": "Both", "notes": "AI disclosure policy, UI evidence", @@ -457,8 +461,8 @@ }, { "framework": "SOC 2", - "control_id": "Trust exploitation risk in risk assessment — social engineering, impersonation, false urgency scenarios documented", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Foundational", "scope": "Both", "notes": "Risk register with trust exploitation entries", @@ -467,7 +471,7 @@ }, { "framework": "SOC 2", - "control_id": "Agent outputs are accurate and complete — outputs not designed to mislead; factual accuracy controls for high-stakes outputs", + "control_id": "PI1.3", "control_name": "PI1.3", "tier": "Foundational", "scope": "Both", @@ -477,7 +481,7 @@ }, { "framework": "SOC 2", - "control_id": "Accuracy of personal data in AI outputs — privacy criteria require that AI-generated information about individuals is accurate", + "control_id": "P7.1", "control_name": "P7.1", "tier": "Foundational", "scope": "Both", @@ -487,7 +491,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Security awareness covers AI deception — staff trained to recognise AI impersonation and social engineering", + "control_id": "Req 12.6", "control_name": "Req 12.6", "tier": "Foundational", "scope": "Both", @@ -497,8 +501,8 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Honest design requirements for agent interactions — AI disclosure requirements in secure development policy", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Foundational", "scope": "Both", "notes": "Secure development policy, design review records", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent-human interaction events logged — session records for agent interactions involving CHD decisions", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Trust exploitation risk analysis — targeted risk analysis documents scenarios and treatment", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Foundational", "scope": "Both", @@ -617,8 +621,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Permissive List of Allowed Inputs", - "control_name": "CWE-183", + "control_id": "CWE-183", + "control_name": "Permissive List of Allowed Inputs", "tier": "Foundational", "scope": "Both", "notes": "System accepts human-like agent output without disclosure requirements", @@ -627,8 +631,8 @@ }, { "framework": "CWE/CVE", - "control_id": "User Interface Misrepresentation of Critical Information", - "control_name": "CWE-451", + "control_id": "CWE-451", + "control_name": "User Interface Misrepresentation of Critical Information", "tier": "Foundational", "scope": "Both", "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Origin Validation Error", - "control_name": "CWE-346", + "control_id": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Foundational", "scope": "Both", "notes": "User cannot determine whether advice originates from AI or human — no origin verification", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Verification of Source of a Communication Channel", - "control_name": "CWE-940", + "control_id": "CWE-940", + "control_name": "Improper Verification of Source of a Communication Channel", "tier": "Foundational", "scope": "Both", "notes": "User cannot verify the agent is operating under its stated configuration", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Exposure of Sensitive Information to an Unauthorised Actor", - "control_name": "CWE-200", + "control_id": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Both", "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation", @@ -667,8 +671,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "AI disclosure enforcement", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment", @@ -677,8 +681,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Advisory label persistence", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify advisory labels persist through all rendering environments", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Over-trust pattern detection", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring can detect aggregate patterns of uncritical operator acceptance", @@ -760,8 +764,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent credentials — or agents using human credentials — destroys attribution", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Strict separation: agent credentials machine-only, human credentials human-only", @@ -770,8 +774,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Over-privileged agent identity makes its recommendations appear more authoritative to users", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do", @@ -780,8 +784,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for emergent capabilities — verify that self-modification, dynamic tool discovery, and autonomous agent spawning do not create unintended security exposures", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Catches emergent pattern risks before production", @@ -790,8 +794,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting emerging agentic patterns — self-evolution, prompt self-modification, autonomous tool acquisition, and dynamic agent creation", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates controls against novel attack surfaces", @@ -800,8 +804,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for emergent agent behaviours — detect agents acquiring new capabilities, modifying their own definitions, or spawning sub-agents outside approved patterns", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables detection of emerging risks in production", @@ -810,8 +814,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "When incidents involve novel agentic patterns, conduct root cause analysis focused on understanding the emergent capability and its security implications", - "control_name": "RV.3.1-PS – Analyse root causes", + "control_id": "RV.3.1-PS", + "control_name": "Analyse root causes", "tier": "Foundational", "scope": "Both", "notes": "Builds organisational knowledge of emerging agentic risks", diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json index 3ebb89e..334f991 100644 --- a/data/entries/ASI10.json +++ b/data/entries/ASI10.json @@ -157,8 +157,8 @@ }, { "framework": "EU AI Act", - "control_id": "Rogue agent scenarios identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented", @@ -167,8 +167,8 @@ }, { "framework": "EU AI Act", - "control_id": "Human oversight mechanisms effective against rogue behaviour", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Hardening", "scope": "Both", "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems", @@ -177,8 +177,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against rogue agent behaviour", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements", @@ -187,8 +187,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering rogue agent detection", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Behavioural monitoring in post-market monitoring programme", @@ -267,7 +267,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "tier": "Hardening", "scope": "Both", @@ -277,40 +277,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.1 Centralise security event alerting", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.1", + "control_name": "Centralise security event alerting", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "notes": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.2 Establish incident response procedures", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.2", + "control_name": "Establish incident response procedures", "tier": "Hardening", "scope": "Both", + "parent": "CIS-17", "notes": "Rogue agent containment as incident response procedure — kill switch, audit, state validation, forensic", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "notes": "Rogue agent scenarios in penetration testing — persistent hidden goal simulation, detection verification", "confidence": "unreviewed", "reviewed_by": [] @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Availability risks", - "control_name": "§5.6", + "control_id": "§5.6", + "control_name": "Availability risks", "tier": "Hardening", "scope": "Both", "notes": "Cascading failure across OT components", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Cascade failure scenarios in OT risk register", @@ -417,8 +421,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Circuit breakers between OT automation layers", @@ -467,8 +471,8 @@ }, { "framework": "SOC 2", - "control_id": "Continuous monitoring for rogue agent behaviour — actions outside authorised scope detected and alerted", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Agent action audit log, anomaly alert records", @@ -477,8 +481,8 @@ }, { "framework": "SOC 2", - "control_id": "Access controls define authorised agent scope — technical enforcement of what agents may and may not do", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Hardening", "scope": "Both", "notes": "Permission policy, access control configuration", @@ -487,8 +491,8 @@ }, { "framework": "SOC 2", - "control_id": "Rogue agent risk in risk assessment — autonomous agent operating outside scope is a documented risk", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Hardening", "scope": "Both", "notes": "Risk register with rogue agent scenarios", @@ -497,8 +501,8 @@ }, { "framework": "SOC 2", - "control_id": "Rogue agent impact on availability — resource consumption by rogue agents does not degrade service for authorised operations", - "control_name": "A1.1", + "control_id": "A1.1", + "control_name": "Availability commitments", "tier": "Hardening", "scope": "Both", "notes": "Resource monitoring, quota enforcement records", @@ -507,7 +511,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows documented scope — technical controls prevent access outside defined role", + "control_id": "Req 7.2", "control_name": "Req 7.2", "tier": "Hardening", "scope": "Both", @@ -517,7 +521,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Rogue agent behaviour logged — actions outside defined scope generate audit log entries and alerts", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Hardening", "scope": "Both", @@ -527,7 +531,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Rogue agent scenarios in penetration test scope — test whether agents can operate outside authorised scope", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Hardening", "scope": "Both", @@ -537,7 +541,7 @@ }, { "framework": "PCI DSS v4.0", - "control_id": "Rogue agent risk analysis — targeted risk analysis documents scenarios, CHD impact, treatment", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Hardening", "scope": "Both", @@ -637,8 +641,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement", @@ -647,8 +651,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Protection Mechanism Failure", - "control_name": "CWE-693", + "control_id": "CWE-693", + "control_name": "Protection Mechanism Failure", "tier": "Foundational", "scope": "Both", "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent", @@ -657,8 +661,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Interaction Frequency", - "control_name": "CWE-799", + "control_id": "CWE-799", + "control_name": "Improper Control of Interaction Frequency", "tier": "Foundational", "scope": "Both", "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations", @@ -667,8 +671,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Embedded Malicious Code", - "control_name": "CWE-506", + "control_id": "CWE-506", + "control_name": "Embedded Malicious Code", "tier": "Foundational", "scope": "Both", "notes": "Rogue behaviour may result from backdoored model or component", @@ -677,8 +681,8 @@ }, { "framework": "CWE/CVE", - "control_id": "Incorrect Default Permissions", - "control_name": "CWE-276", + "control_id": "CWE-276", + "control_name": "Incorrect Default Permissions", "tier": "Foundational", "scope": "Both", "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius", @@ -687,8 +691,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural baseline establishment and deviation", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection", @@ -697,8 +701,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Hidden goal persistence detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Hardening", "scope": "Both", "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis", @@ -707,8 +711,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Kill switch activation coverage", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Hardening", "scope": "Both", "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA", @@ -789,8 +793,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent detected but not offboarded — credentials remain valid", - "control_name": "NHI-1 Improper Offboarding", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "tier": "Hardening", "scope": "Both", "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked", @@ -799,8 +803,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent with excess privilege causes larger blast radius before detection", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment", @@ -809,8 +813,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow rogue agent to operate indefinitely after detection", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation", @@ -819,8 +823,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Vet all external agent dependencies — LLM APIs, tool endpoints, MCP servers, orchestration platforms — for reliability, security posture, and failure mode characteristics before adoption", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", + "control_id": "PW.4.1-PS", + "control_name": "Reuse existing well-secured software", "tier": "Foundational", "scope": "Both", "notes": "Prevents adoption of unreliable dependencies", @@ -829,8 +833,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Verify that external dependency responses are consistent with expected behaviour — detect API version changes, model swaps, or degraded output quality that could affect agent correctness", - "control_name": "PS.2.1-PS – Verify software integrity", + "control_id": "PS.2.1-PS", + "control_name": "Verify software integrity", "tier": "Foundational", "scope": "Both", "notes": "Detects dependency degradation and tampering", @@ -839,8 +843,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Monitor all agent dependencies for availability, behavioural consistency, and security posture changes; establish triage procedures for dependency degradation events", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid detection of dependency failures", @@ -849,8 +853,8 @@ }, { "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for dependency failures — graceful degradation, fallback providers, workflow suspension, and stakeholder notification", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", + "control_id": "RV.2.1-PS", + "control_name": "Assess, prioritise, and remediate vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Ensures operational continuity during dependency outages", diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json index b57591e..aed2bae 100644 --- a/data/entries/DSGAI01.json +++ b/data/entries/DSGAI01.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data must be relevant, representative, and subject to appropriate privacy measures", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient and implement cybersecurity measures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data for AI — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data for AI — preparation", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -265,8 +265,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -275,37 +275,41 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Establish and maintain data management process", + "control_id": "3.1", + "control_name": "Establish and maintain data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.13 — Deploy DLP solutions", + "control_id": "3.13", + "control_name": "Deploy DLP solutions", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.12 — Implement code-level security checks", + "control_id": "16.12", + "control_name": "Implement code-level security checks", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -396,8 +400,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Common ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "Common ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Injection via OT data feeds is a documented attack vector", @@ -406,8 +410,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess injection risk at every OT data ingestion point", @@ -416,8 +420,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Foundational", "scope": "Both", "notes": "Input validation mandatory at OT data boundary", @@ -466,46 +470,51 @@ }, { "framework": "SOC 2", - "control_id": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on RAG retrieval — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users", "confidence": "unreviewed", "reviewed_by": [] }, @@ -642,7 +651,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to Unauthorised Actor", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -652,7 +661,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -662,7 +671,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -738,8 +747,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius limited only by credential scope", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Apply least-privilege to all data pipeline credentials", @@ -748,8 +757,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injected actions can use pipeline tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived tokens for all data pipeline service accounts", diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json index 50f5777..fdcc532 100644 --- a/data/entries/DSGAI02.json +++ b/data/entries/DSGAI02.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Credential exposure must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Agent credential lifecycle included in Art. 9 risk management system", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft and misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials, NHI inventory, and access controls are Art. 15 requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for credential management and incident response", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Agent identity governance procedures documented in quality management system", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Internal organisation — roles", - "control_name": "A.3.3", + "control_id": "A.3.3", + "control_name": "Internal organisation — roles", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -265,8 +265,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Leadership", - "control_name": "Cl.5", + "control_id": "5", + "control_name": "Leadership", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -275,37 +275,41 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 5", - "control_name": "5.4 — Restrict administrator privileges", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.5 — Require MFA for admin access", + "control_id": "6.5", + "control_name": "Require MFA for admin access", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 5", - "control_name": "5.3 — Disable dormant accounts", + "control_id": "5.3", + "control_name": "Disable dormant accounts", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 12", - "control_name": "12.7 — Deploy host-based intrusion detection", + "control_id": "12.7", + "control_name": "Deploy host-based intrusion detection", "tier": "Foundational", "scope": "Both", + "parent": "CIS-12", "confidence": "unreviewed", "reviewed_by": [] }, @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Data integrity in OT — training data is OT data", @@ -397,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess training data integrity as OT risk", @@ -407,8 +411,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Integrity verification on all OT data used for training", @@ -457,46 +461,51 @@ }, { "framework": "SOC 2", - "control_id": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs", - "control_name": "CC6.3 — Access removal", + "control_id": "CC6.3", + "control_name": "Access removal", "tier": "Foundational", "scope": "Both", + "notes": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent credential lifecycle procedures — issuance, rotation, revocation documented", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Agent credential lifecycle procedures — issuance, rotation, revocation documented", "confidence": "unreviewed", "reviewed_by": [] }, @@ -633,7 +642,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -643,7 +652,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-798", - "control_name": "CWE-798", + "control_name": "Use of Hard-coded Credentials", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/798.html", @@ -653,7 +662,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-522", - "control_name": "CWE-522", + "control_name": "Insufficiently Protected Credentials", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/522.html", @@ -729,8 +738,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Write access to training data stores enables poisoning", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Separate read and write credentials; write requires MFA", @@ -739,8 +748,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Training pipeline credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault all training pipeline credentials", @@ -749,8 +758,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived write credentials create persistent poisoning window", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived write tokens; rotate frequently", diff --git a/data/entries/DSGAI03.json b/data/entries/DSGAI03.json index da0ad98..5e05330 100644 --- a/data/entries/DSGAI03.json +++ b/data/entries/DSGAI03.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Shadow AI usage is a foreseeable risk requiring mitigation in the risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Organisations deploying AI are responsible for AI used within their operations", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Deployers must use AI systems as instructed and ensure appropriate oversight", - "control_name": "Art. 29 — Deployer obligations", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "tier": "Foundational", "scope": "Both", "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies — acceptable use", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies — acceptable use", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party relationships", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party relationships", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context", - "control_name": "Cl.4", + "control_id": "4", + "control_name": "Context", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -265,37 +265,41 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 2", - "control_name": "2.1 — Maintain authorised software inventory", + "control_id": "2.1", + "control_name": "Maintain authorised software inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.1 — Establish secure configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.4 — Perform traffic filtering", + "control_id": "13.4", + "control_name": "Perform traffic filtering", "tier": "Foundational", "scope": "Both", + "parent": "CIS-13", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 14", - "control_name": "14.6 — Train workforce on AI security", + "control_id": "14.6", + "control_name": "Train workforce on AI security", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "confidence": "unreviewed", "reviewed_by": [] }, @@ -367,8 +371,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "OT data confidentiality requirements apply to training data", @@ -377,8 +381,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess sensitivity of OT data in training sets", @@ -387,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor for unexpected exfiltration of OT training data", @@ -437,37 +441,41 @@ }, { "framework": "SOC 2", - "control_id": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data", "confidence": "unreviewed", "reviewed_by": [] }, @@ -604,7 +612,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-668", - "control_name": "CWE-668", + "control_name": "Exposure of Resource to Wrong Sphere", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/668.html", @@ -614,7 +622,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -680,8 +688,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to sensitive data stores", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Scope pipeline credentials to approved data sources only", @@ -690,8 +698,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in config files include sensitive data source access", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Audit config files for embedded credentials", diff --git a/data/entries/DSGAI04.json b/data/entries/DSGAI04.json index e1194ee..04ddbaa 100644 --- a/data/entries/DSGAI04.json +++ b/data/entries/DSGAI04.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data must be subject to governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI adversarial testing", "tier": "Hardening", "scope": "Both", "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -265,8 +265,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Hardening", "scope": "Both", "notes": "Foundational", @@ -275,28 +275,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 7", - "control_name": "7.1 — Establish vulnerability management", + "control_id": "7.1", + "control_name": "Establish vulnerability management", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.11 — Use up-to-date software components", + "control_id": "16.11", + "control_name": "Use up-to-date software components", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Establish penetration testing programme", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -378,8 +381,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Pipeline integrity is a core OT security requirement", @@ -388,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Data pipeline security in OT risk assessment", @@ -398,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Foundational", "scope": "Both", "notes": "Authenticated, integrity-verified data flows across zone boundaries", @@ -448,37 +451,41 @@ }, { "framework": "SOC 2", - "control_id": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model promotions through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Hardening", "scope": "Both", + "notes": "Model promotions through change management — integrity verification before production deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Hardening", "scope": "Both", + "notes": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model output anomaly monitoring — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Model output anomaly monitoring — poisoning indicators detected before operational impact", "confidence": "unreviewed", "reviewed_by": [] }, @@ -615,7 +622,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -625,7 +632,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-346", - "control_name": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/346.html", @@ -635,7 +642,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -720,8 +727,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated connections between pipeline stages", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Foundational", "scope": "Both", "notes": "Require mTLS or token auth for all pipeline connections", @@ -730,8 +737,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to all stages", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Per-stage credentials with minimum scope", @@ -740,8 +747,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple pipeline stages", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per stage", diff --git a/data/entries/DSGAI05.json b/data/entries/DSGAI05.json index d42a3e3..db39c46 100644 --- a/data/entries/DSGAI05.json +++ b/data/entries/DSGAI05.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Ingestion integrity risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Data ingestion attack surfaces included in Art. 9 risk management", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI resilient against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for data ingestion and pipeline integrity", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Ingestion validation procedures and CVE patching documented in quality management", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -265,19 +265,21 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.1 — Establish secure coding practices", + "control_id": "16.1", + "control_name": "Establish secure coding practices", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.5 — Collect detailed audit logs", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Build", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, @@ -350,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Safety system bypass in OT", @@ -360,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Guardrail bypass must be in OT risk register", @@ -370,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Hardening", "scope": "Both", "notes": "GenAI guardrails must be independent of model inference layer", @@ -420,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing", - "control_name": "PI1.2 — System inputs complete and accurate", + "control_id": "PI1.2", + "control_name": "System inputs complete and accurate", "tier": "Foundational", "scope": "Both", + "notes": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Ingestion anomaly detection — unusual payloads detected before pipeline completion", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Ingestion anomaly detection — unusual payloads detected before pipeline completion", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -587,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -597,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-116", - "control_name": "CWE-116", + "control_name": "Improper Encoding or Escaping of Output", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/116.html", @@ -607,7 +613,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-74", - "control_name": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/74.html", @@ -674,8 +680,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Service account with guardrail configuration write access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Minimum scope; no service account has guardrail disable capability", diff --git a/data/entries/DSGAI06.json b/data/entries/DSGAI06.json index bac0302..4388c37 100644 --- a/data/entries/DSGAI06.json +++ b/data/entries/DSGAI06.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Third-party tool data exchange risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All tool integrations assessed in Art. 9 risk management", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Providers document obligations flowing to deployers; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Tool data exchange obligations explicitly distributed along the value chain", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI providers document all third-party integrations", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Tool and plugin data exchange documented in GPAI technical documentation", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — AI supply chain", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party — AI supply chain", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — customer data", - "control_name": "A.10.2", + "control_id": "A.10.2", + "control_name": "Third-party — customer data", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.2 — Maintain secure configuration of cloud assets", + "control_id": "4.2", + "control_name": "Maintain secure configuration of cloud assets", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.4 — Require password manager", + "control_id": "6.4", + "control_name": "Require password manager", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 15", - "control_name": "15.1 — Establish service provider management policy", + "control_id": "15.1", + "control_name": "Establish service provider management policy", "tier": "Foundational", "scope": "Both", + "parent": "CIS-15", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "OT data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "OT data must not be disclosed without authorisation", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess disclosure risk for each OT data type in GenAI outputs", @@ -369,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor outputs for OT data disclosure patterns", @@ -419,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions", - "control_name": "CC9.2 — Vendor agreements", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "tier": "Foundational", "scope": "Both", + "notes": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Context minimisation for tool calls — tools receive minimum confidential data required for function", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Context minimisation for tool calls — tools receive minimum confidential data required for function", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Tool access scoped to minimum required — agent tool permissions as privileged access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Tool access scoped to minimum required — agent tool permissions as privileged access", "confidence": "unreviewed", "reviewed_by": [] }, @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -596,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-269", - "control_name": "CWE-269", + "control_name": "Improper Privilege Management", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/269.html", @@ -606,7 +613,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-602", - "control_name": "CWE-602", + "control_name": "Client-side Enforcement of Server-side Security", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/602.html", @@ -682,8 +689,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in model outputs or training data surface in responses", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Output scanning for credential patterns", @@ -692,8 +699,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Over-broad retrieval credentials return data beyond user entitlement", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope for retrieval service accounts", diff --git a/data/entries/DSGAI07.json b/data/entries/DSGAI07.json index bd3288e..6824e87 100644 --- a/data/entries/DSGAI07.json +++ b/data/entries/DSGAI07.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI training data subject to governance — relevant, representative, privacy-preserving", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Data governance policy covering the full AI data lifecycle is an Art. 10 compliance requirement", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented quality management system including data handling procedures", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Data lifecycle procedures — classification, retention, deletion — documented in quality management", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI providers maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Full data governance documentation for GPAI training data is a binding Art. 53 obligation", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -265,37 +265,41 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.2 — Establish data inventory", + "control_id": "3.2", + "control_name": "Establish data inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Configure data access control lists", + "control_id": "3.3", + "control_name": "Configure data access control lists", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.11 — Encrypt sensitive data at rest", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.3 — Ensure adequate audit log storage", + "control_id": "8.3", + "control_name": "Ensure adequate audit log storage", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, @@ -358,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Excessive OT data access is a documented vulnerability", @@ -368,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Data access scope in OT risk assessment", @@ -378,8 +382,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Foundational", "scope": "Both", "notes": "Least privilege enforced at OT data boundary", @@ -428,37 +432,41 @@ }, { "framework": "SOC 2", - "control_id": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations", - "control_name": "P4.1 — Privacy information lifecycle", + "control_id": "P4.1", + "control_name": "Privacy information lifecycle", "tier": "Foundational", "scope": "Both", + "notes": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope", "confidence": "unreviewed", "reviewed_by": [] }, @@ -595,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -605,7 +613,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-213", - "control_name": "CWE-213", + "control_name": "Exposure of Sensitive Information Due to Incompatible Policies", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/213.html", @@ -681,8 +689,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "GenAI system service account has access to more data than declared function requires", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Audit and reduce credential scope per system component", @@ -691,8 +699,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials maintain excessive access indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Rotate or replace with short-lived tokens", @@ -701,8 +709,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same data access credential used across multiple GenAI system functions", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per function", diff --git a/data/entries/DSGAI08.json b/data/entries/DSGAI08.json index 020e95f..b3d3160 100644 --- a/data/entries/DSGAI08.json +++ b/data/entries/DSGAI08.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Mandatory risk management system for high-risk AI", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Absence of a documented risk management system is an Art. 9 violation", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented quality management system including post-market monitoring", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Absence of a quality management system is an Art. 17 violation", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Graduated fines based on violation type", - "control_name": "Art. 72 — Fines", + "control_id": "Art. 72", + "control_name": "Fines", "tier": "Foundational", "scope": "Both", "notes": "Understanding fine exposure is the starting point for compliance prioritisation", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Information for interested parties", - "control_name": "A.8.1", + "control_id": "A.8.1", + "control_name": "Information for interested parties", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context — interested parties", - "control_name": "Cl.4.2", + "control_id": "4.2", + "control_name": "Context — interested parties", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Data management process", + "control_id": "3.1", + "control_name": "Data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 17", - "control_name": "17.1 — Incident response management", + "control_id": "17.1", + "control_name": "Incident response management", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Hardening", "scope": "Both", "notes": "OT data in retrieval corpora requires access control", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Entitlement leakage in OT data retrieval", @@ -369,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor retrieval patterns for unauthorised OT data access", @@ -419,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Commitment to compliance with applicable laws and regulations including AI-specific obligations", - "control_name": "CC5.1 — Control environment", + "control_id": "CC5.1", + "control_name": "Control environment", "tier": "Foundational", "scope": "Both", + "notes": "Commitment to compliance with applicable laws and regulations including AI-specific obligations", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability", - "control_name": "P1.1 — Privacy management", + "control_id": "P1.1", + "control_name": "Privacy management", "tier": "Foundational", "scope": "Both", + "notes": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements", - "control_name": "CC2.1 — Communication", + "control_id": "CC2.1", + "control_name": "Communication", "tier": "Foundational", "scope": "Both", + "notes": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements", "confidence": "unreviewed", "reviewed_by": [] }, @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -596,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-778", - "control_name": "CWE-778", + "control_name": "Insufficient Logging", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/778.html", @@ -662,8 +669,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Embedding store service account with cross-tenant read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-tenant credentials or row-level security with minimum scope", @@ -672,8 +679,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated embedding store access", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Hardening", "scope": "Both", "notes": "Require authentication for all vector database connections", @@ -682,8 +689,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same embedding store credential used for multiple tenants", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Separate credentials per tenant or use row-level security", diff --git a/data/entries/DSGAI09.json b/data/entries/DSGAI09.json index e33996a..3544041 100644 --- a/data/entries/DSGAI09.json +++ b/data/entries/DSGAI09.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data governance covers all input modalities — images, audio, video — not only text", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures covering all data channels including multimodal inputs", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical documentation covers all input modalities processed by the model", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Hardening", "scope": "Both", "notes": "Multimodal data governance documented in GPAI technical documentation", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.13 — Deploy DLP solutions", + "control_id": "3.13", + "control_name": "Deploy DLP solutions", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.1 — Centralise security event alerting", + "control_id": "13.1", + "control_name": "Centralise security event alerting", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.12 — Implement code-level security checks", + "control_id": "16.12", + "control_name": "Implement code-level security checks", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities — data integrity", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities — data integrity", "tier": "Hardening", "scope": "Both", "notes": "Corpus manipulation directly threatens OT operational integrity", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "OT corpus manipulation must be in risk register as critical scenario", @@ -369,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Write authentication on all OT corpus stores", @@ -419,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information extracted from multimodal inputs subject to same use restrictions as source data", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Personal information extracted from multimodal inputs subject to same use restrictions as source data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on multimodal content stores — same rigour as equivalent text data stores", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Hardening", "scope": "Both", + "notes": "Access controls on multimodal content stores — same rigour as equivalent text data stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to Unauthorised Actor", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -596,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -663,8 +670,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Corpus write access held by service accounts that do not need it", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Separate read and write credentials; write accounts require MFA", @@ -673,8 +680,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Corpus write credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault all corpus write credentials", @@ -683,8 +690,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived corpus write credentials persist beyond need", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Rotate corpus write credentials; implement short-lived write pattern", diff --git a/data/entries/DSGAI10.json b/data/entries/DSGAI10.json index b94b7f9..f56bfcb 100644 --- a/data/entries/DSGAI10.json +++ b/data/entries/DSGAI10.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate data governance — privacy measures must be effective", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Anonymisation effectiveness is an Art. 10 data governance requirement, not a self-certification", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI training data governance documented — privacy measures included", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Hardening", "scope": "Both", "notes": "Synthetic data generation methodology and re-identification risk assessment documented for GPAI", @@ -215,8 +215,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -255,19 +255,21 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.7 — Establish data classification scheme", + "control_id": "3.7", + "control_name": "Establish data classification scheme", "tier": "Hardening", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.3 — Remediate penetration test findings", + "control_id": "18.3", + "control_name": "Remediate penetration test findings", "tier": "Hardening", "scope": "Build", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -321,8 +323,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "In-context manipulation of OT decision support", @@ -331,8 +333,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Context poisoning risk for OT data feeds", @@ -381,37 +383,41 @@ }, { "framework": "SOC 2", - "control_id": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data", - "control_name": "P4.2 — Retention of personal information", + "control_id": "P4.2", + "control_name": "Retention of personal information", "tier": "Hardening", "scope": "Both", + "notes": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Re-identification risk in synthetic datasets identified in risk assessment", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Re-identification risk in synthetic datasets identified in risk assessment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -538,7 +544,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -548,7 +554,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-330", - "control_name": "CWE-330", + "control_name": "Use of Insufficiently Random Values", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/330.html", @@ -605,8 +611,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Data feed service accounts with access to sensitive data that should not enter context", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Scope data feed credentials to approved data only", diff --git a/data/entries/DSGAI11.json b/data/entries/DSGAI11.json index 499d775..3ea0e3d 100644 --- a/data/entries/DSGAI11.json +++ b/data/entries/DSGAI11.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data governance covering multi-tenant deployments — session isolation as a data handling requirement", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Session isolation controls are an Art. 10 data governance obligation for multi-user deployments", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing cross-session data exposure", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Session isolation and tenant separation are Art. 15 technical requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring detecting and responding to session bleed incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Cross-session leakage detection in post-market monitoring programme", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Configure data access control lists", + "control_id": "3.3", + "control_name": "Configure data access control lists", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.2 — Establish allowlist of authorised software", + "control_id": "6.2", + "control_name": "Establish allowlist of authorised software", "tier": "Foundational", "scope": "Build", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.6 — Establish security requirements", + "control_id": "16.6", + "control_name": "Establish security requirements", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -358,8 +361,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Persistent compromise of OT decision support", @@ -368,8 +371,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Session persistence as OT risk scenario", @@ -418,37 +421,41 @@ }, { "framework": "SOC 2", - "control_id": "Strict session isolation — each user's context inaccessible to all other sessions", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Strict session isolation — each user's context inaccessible to all other sessions", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "User session context classified as confidential — technical isolation controls", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "User session context classified as confidential — technical isolation controls", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Cross-session access anomalies monitored — unusual retrieval patterns detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Cross-session access anomalies monitored — unusual retrieval patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -575,7 +582,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -585,7 +592,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-488", - "control_name": "CWE-488", + "control_name": "Exposure of Data Element to Wrong Session", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/488.html", @@ -651,8 +658,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Session store service account with cross-user read/write access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-user session store access controls", @@ -661,8 +668,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Session store access credentials in plaintext", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault session store credentials", diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json index 8e864bc..d877460 100644 --- a/data/entries/DSGAI12.json +++ b/data/entries/DSGAI12.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "LLM gateway risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against adversarial misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements", @@ -185,8 +185,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for LLM gateway security", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Security testing procedures and query log retention documented in quality management", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — access control", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — access control", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -265,8 +265,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -275,28 +275,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.2 — Establish secure configuration for software", + "control_id": "16.2", + "control_name": "Establish secure configuration for software", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.3 — Require password manager for service accounts", + "control_id": "6.3", + "control_name": "Require password manager for service accounts", "tier": "Foundational", "scope": "Build", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Establish penetration testing programme", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Foundational", "scope": "Build", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -378,8 +381,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Hardening", "scope": "Both", "notes": "OT knowledge encoded in models requires protection", @@ -388,8 +391,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Model extraction as OT intelligence gathering vector", @@ -398,8 +401,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor for systematic extraction query patterns", @@ -448,46 +451,51 @@ }, { "framework": "SOC 2", - "control_id": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted", - "control_name": "PI1.1 — Processing integrity policy", + "control_id": "PI1.1", + "control_name": "Processing integrity policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM-generated query results validated — destructive or over-broad queries blocked before execution", - "control_name": "PI1.3 — Outputs complete and accurate", + "control_id": "PI1.3", + "control_name": "Outputs complete and accurate", "tier": "Foundational", "scope": "Both", + "notes": "LLM-generated query results validated — destructive or over-broad queries blocked before execution", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Query allowlisting and human confirmation procedures documented", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Query allowlisting and human confirmation procedures documented", "confidence": "unreviewed", "reviewed_by": [] }, @@ -614,7 +622,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-89", - "control_name": "CWE-89", + "control_name": "SQL Injection", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/89.html", @@ -624,7 +632,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -634,7 +642,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -710,8 +718,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "API credentials with high quota enabling systematic extraction", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-user quotas; minimum default quota", @@ -720,8 +728,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived inference API credentials enable sustained extraction campaigns", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Rotate API credentials; implement per-session tokens", diff --git a/data/entries/DSGAI13.json b/data/entries/DSGAI13.json index 5d2a2b9..6072030 100644 --- a/data/entries/DSGAI13.json +++ b/data/entries/DSGAI13.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Vector store security risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All vector store deployments assessed in Art. 9 risk management", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI infrastructure protected against cybersecurity risks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering AI infrastructure components", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Vector store security monitoring in post-market monitoring programme", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.11 — Encrypt sensitive data at rest", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.1 — Establish access control inventory", + "control_id": "6.1", + "control_name": "Establish access control inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.7 — Use standard-security components", + "control_id": "16.7", + "control_name": "Use standard-security components", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Third-party OT tool data leakage", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Tool data scope in OT security assessment", @@ -369,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor OT tool data flows", @@ -419,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Vector store content encrypted at rest — embeddings of confidential data protected", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Vector store content encrypted at rest — embeddings of confidential data protected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Vector database CVE patching managed through change management — timely remediation documented", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Foundational", "scope": "Both", + "notes": "Vector database CVE patching managed through change management — timely remediation documented", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Vector store query anomaly monitoring — bulk extraction patterns detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Vector store query anomaly monitoring — bulk extraction patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -596,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/327.html", @@ -672,8 +679,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive data access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review all third-party tool credentials; reduce to minimum scope", @@ -682,8 +689,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Tool integration credentials with broad data access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope per tool integration", @@ -692,8 +699,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same credential used across multiple tool integrations", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per tool", diff --git a/data/entries/DSGAI14.json b/data/entries/DSGAI14.json index 5788e88..2c5dc3b 100644 --- a/data/entries/DSGAI14.json +++ b/data/entries/DSGAI14.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including telemetry and monitoring data", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring required — but the monitoring infrastructure must itself be secured", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement", @@ -215,8 +215,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — governance", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — governance", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Performance evaluation", - "control_name": "Cl.9", + "control_id": "9", + "control_name": "Performance evaluation", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -255,37 +255,41 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Build", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.10 — Retain audit logs", + "control_id": "8.10", + "control_name": "Retain audit logs", "tier": "Foundational", "scope": "Build", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.13 — Deploy DLP on log pipelines", + "control_id": "3.13", + "control_name": "Deploy DLP on log pipelines", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.3 — Access control on log infrastructure", + "control_id": "6.3", + "control_name": "Access control on log infrastructure", "tier": "Foundational", "scope": "Build", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, @@ -357,8 +361,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Hardening", "scope": "Both", "notes": "OT-trained model weights are sensitive OT intellectual property", @@ -367,8 +371,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Model theft as OT IP theft scenario", @@ -377,8 +381,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor model storage access patterns", @@ -427,37 +431,41 @@ }, { "framework": "SOC 2", - "control_id": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in telemetry used only for authorised purposes — same restrictions as production data", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in telemetry used only for authorised purposes — same restrictions as production data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on telemetry stores — same rigour as production data stores", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on telemetry stores — same rigour as production data stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access anomaly monitoring on telemetry stores — bulk access patterns detected", - "control_name": "CC7.2 — Monitoring", + "control_id": "CC7.2", + "control_name": "Monitoring", "tier": "Foundational", "scope": "Both", + "notes": "Access anomaly monitoring on telemetry stores — bulk access patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -594,7 +602,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -604,7 +612,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-532", - "control_name": "CWE-532", + "control_name": "Insertion of Sensitive Information Into Log File", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/532.html", @@ -614,7 +622,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -680,8 +688,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model storage service account with read access from unexpected paths", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Minimum scope: only authorised inference service can read model weights", @@ -690,8 +698,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model storage credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault all model storage credentials", diff --git a/data/entries/DSGAI15.json b/data/entries/DSGAI15.json index db4abe8..65bcc95 100644 --- a/data/entries/DSGAI15.json +++ b/data/entries/DSGAI15.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including context window content", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity against adversarial exploitation of context window content", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering context window exploitation incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Context window security in post-market monitoring programme", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — minimisation", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — minimisation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Configure data access control lists", + "control_id": "3.3", + "control_name": "Configure data access control lists", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Data minimisation", + "control_id": "3.1", + "control_name": "Data minimisation", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.6 — Security requirements", + "control_id": "16.6", + "control_name": "Security requirements", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "OT data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "Inference inputs are OT data and require protection", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Inference data exposure in OT risk assessment", @@ -369,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor inference data leaving OT boundary", @@ -419,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Minimum-necessary context injection procedures — documented and enforced", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Minimum-necessary context injection procedures — documented and enforced", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Over-broad context risks identified — cross-trust-domain aggregation assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Over-broad context risks identified — cross-trust-domain aggregation assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -576,7 +583,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -596,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-285", - "control_name": "CWE-285", + "control_name": "Improper Authorisation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/285.html", @@ -662,8 +669,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Inference log service account with broad read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope: only authorised audit function can read inference logs", @@ -672,8 +679,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Service account credentials embedded in inference log entries", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Scan and scrub credentials from inference logs", diff --git a/data/entries/DSGAI16.json b/data/entries/DSGAI16.json index 70998af..607fbe0 100644 --- a/data/entries/DSGAI16.json +++ b/data/entries/DSGAI16.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Endpoint AI agent risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Browser and endpoint agent deployments assessed in Art. 9 risk management", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow human oversight — users must be able to stop and override", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Users must be able to pause and override endpoint AI agents — Art. 14 human oversight requirement", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Deployers ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "tier": "Foundational", "scope": "Both", "notes": "Deployers responsible for ensuring endpoint AI agents operate within Art. 14 human oversight scope", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context", - "control_name": "Cl.4", + "control_id": "4", + "control_name": "Context", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 2", - "control_name": "2.6 — Allowlist authorised software", + "control_id": "2.6", + "control_name": "Allowlist authorised software", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.1 — Secure configuration baseline", + "control_id": "4.1", + "control_name": "Secure configuration baseline", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 10", - "control_name": "10.1 — Deploy anti-malware", + "control_id": "10.1", + "control_name": "Deploy anti-malware", "tier": "Foundational", "scope": "Both", + "parent": "CIS-10", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Third-party data in OT context", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Data source assessment for OT GenAI", @@ -369,8 +372,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Vendor programme for OT data suppliers", @@ -419,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -576,7 +583,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-668", - "control_name": "CWE-668", + "control_name": "Exposure of Resource to Wrong Sphere", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/668.html", @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-272", - "control_name": "CWE-272", + "control_name": "Least Privilege Violation", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/272.html", @@ -596,7 +603,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -662,8 +669,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party data source API keys with excessive scope", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review all third-party credentials; reduce to minimum", @@ -672,8 +679,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party development credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for third-party credentials", @@ -682,8 +689,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party credentials embedded in shared config", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Vault all third-party data source credentials", diff --git a/data/entries/DSGAI17.json b/data/entries/DSGAI17.json index 2137e97..7eaf5ab 100644 --- a/data/entries/DSGAI17.json +++ b/data/entries/DSGAI17.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must remain accurate and available under adverse conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering availability and resilience", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme", @@ -215,8 +215,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — decommissioning", - "control_name": "A.6.2.8", + "control_id": "A.6.2.8", + "control_name": "Lifecycle — decommissioning", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Improvement", - "control_name": "Cl.10", + "control_id": "10", + "control_name": "Improvement", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -255,28 +255,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 11", - "control_name": "11.1 — Establish recovery capability", + "control_id": "11.1", + "control_name": "Establish recovery capability", "tier": "Foundational", "scope": "Both", + "parent": "CIS-11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 11", - "control_name": "11.4 — Test data recovery", + "control_id": "11.4", + "control_name": "Test data recovery", "tier": "Foundational", "scope": "Both", + "parent": "CIS-11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.8 — Deploy DNS filtering", + "control_id": "13.8", + "control_name": "Deploy DNS filtering", "tier": "Foundational", "scope": "Both", + "parent": "CIS-13", "confidence": "unreviewed", "reviewed_by": [] }, @@ -340,8 +343,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Model components are supply chain assets in OT", @@ -350,8 +353,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Model provenance for OT deployments", @@ -360,8 +363,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Vendor assessment for model providers", @@ -410,37 +413,41 @@ }, { "framework": "SOC 2", - "control_id": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure", - "control_name": "A1.1 — Availability policy", + "control_id": "A1.1", + "control_name": "Availability policy", "tier": "Foundational", "scope": "Both", + "notes": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure", - "control_name": "A1.2 — Environmental protections", + "control_id": "A1.2", + "control_name": "Environmental protections", "tier": "Foundational", "scope": "Both", + "notes": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Silent RAG degradation identified as availability risk in assessment", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Silent RAG degradation identified as availability risk in assessment", "confidence": "unreviewed", "reviewed_by": [] }, @@ -577,7 +584,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-400", - "control_name": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/400.html", @@ -587,7 +594,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-770", - "control_name": "CWE-770", + "control_name": "Allocation of Resources Without Limits", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/770.html", @@ -663,8 +670,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model provider API keys with excessive access to model versions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review and scope all model provider credentials", @@ -673,8 +680,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same model registry token used across dev/staging/production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per environment", @@ -683,8 +690,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model provider credentials in pipeline config", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Vault all model provider credentials", diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json index 0ef7553..70b077b 100644 --- a/data/entries/DSGAI18.json +++ b/data/entries/DSGAI18.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data privacy measures required — protecting sensitive data used in training", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against attacks including inference attacks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements", @@ -215,8 +215,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — privacy-preserving", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — privacy-preserving", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Hardening", "scope": "Both", "notes": "Advanced", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -255,19 +255,21 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.11 — Encrypt sensitive data at rest", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Penetration testing", + "control_id": "18.1", + "control_name": "Penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -321,8 +323,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "Retention of OT data beyond required period is a confidentiality risk", @@ -331,8 +333,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Data retention as OT risk scenario", @@ -381,37 +383,41 @@ }, { "framework": "SOC 2", - "control_id": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Output monitoring for reconstruction indicators — systematic query patterns detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Output monitoring for reconstruction indicators — systematic query patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -538,7 +544,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -548,7 +554,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/327.html", @@ -604,8 +610,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Service account with access to retained data beyond declared function", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope for data access credentials", @@ -614,8 +620,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials for data deletion — no audit trail", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce human identity for all compliance operations", diff --git a/data/entries/DSGAI19.json b/data/entries/DSGAI19.json index f6c03c2..6d9ed85 100644 --- a/data/entries/DSGAI19.json +++ b/data/entries/DSGAI19.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data governance includes human annotation workflows", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "Labelling vendors are part of the AI value chain — obligations distributed accordingly", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations", @@ -215,8 +215,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — minimisation", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — minimisation", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Internal organisation — roles", - "control_name": "A.3.3", + "control_id": "A.3.3", + "control_name": "Internal organisation — roles", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Support", - "control_name": "Cl.7", + "control_id": "7", + "control_name": "Support", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -255,28 +255,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Access control lists", + "control_id": "3.3", + "control_name": "Access control lists", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.5 — Require MFA", + "control_id": "6.5", + "control_name": "Require MFA", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 14", - "control_name": "14.3 — Train workforce to identify attacks", + "control_id": "14.3", + "control_name": "Train workforce to identify attacks", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "confidence": "unreviewed", "reviewed_by": [] }, @@ -339,8 +342,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Availability risks", - "control_name": "§5.6", + "control_id": "§5.6", + "control_name": "Availability risks", "tier": "Hardening", "scope": "Both", "notes": "OT GenAI pipeline failure as availability risk", @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Cascade failure scenarios in OT risk register", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Circuit breakers between OT data pipeline layers", @@ -409,37 +412,41 @@ }, { "framework": "SOC 2", - "control_id": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use", - "control_name": "CC9.2 — Vendor agreements", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "tier": "Foundational", "scope": "Both", + "notes": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information accessed by labellers documented — purpose, scope, and safeguards", - "control_name": "P3.1 — Personal information collection", + "control_id": "P3.1", + "control_name": "Personal information collection", "tier": "Foundational", "scope": "Both", + "notes": "Personal information accessed by labellers documented — purpose, scope, and safeguards", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task", "confidence": "unreviewed", "reviewed_by": [] }, @@ -576,7 +583,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-285", - "control_name": "CWE-285", + "control_name": "Improper Authorisation", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/285.html", @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -652,8 +659,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credential across pipeline stages — one failure affects all", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Separate credentials per pipeline stage", @@ -662,8 +669,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Single credential covering multiple pipeline stages amplifies cascade", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-stage minimum scope credentials", diff --git a/data/entries/DSGAI20.json b/data/entries/DSGAI20.json index 7a74785..accb34f 100644 --- a/data/entries/DSGAI20.json +++ b/data/entries/DSGAI20.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting AI system integrity", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI technical documentation includes model architecture and capability details", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Hardening", "scope": "Both", "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering security incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Model extraction detection in post-market monitoring programme", @@ -225,8 +225,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — model artefacts", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — model artefacts", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Hardening", "scope": "Both", "notes": "Foundational", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Hardening", "scope": "Both", "notes": "Advanced", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -265,28 +265,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.2 — Allowlist authorised access", + "control_id": "6.2", + "control_name": "Allowlist authorised access", "tier": "Hardening", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.6 — Collect DNS query audit logs", + "control_id": "8.6", + "control_name": "Collect DNS query audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Penetration testing", + "control_id": "18.1", + "control_name": "Penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -349,8 +352,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Regulatory compliance as OT risk scenario", @@ -359,8 +362,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", + "control_id": "§8.2", + "control_name": "OT security programme", "tier": "Foundational", "scope": "Both", "notes": "Compliance programme for OT GenAI deployments", @@ -409,37 +412,41 @@ }, { "framework": "SOC 2", - "control_id": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "API rate limiting as access control limiting systematic model extraction", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Hardening", "scope": "Both", + "notes": "API rate limiting as access control limiting systematic model extraction", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model extraction pattern monitoring — unusual query diversity and volume detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Model extraction pattern monitoring — unusual query diversity and volume detected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -576,7 +583,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -586,7 +593,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -662,8 +669,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials — no attribution for compliance evidence", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce human identity for all regulated data operations", @@ -672,8 +679,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Compliance audit credentials leaked — tampering with evidence possible", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Protect audit credential integrity", diff --git a/data/entries/DSGAI21.json b/data/entries/DSGAI21.json index 3a48ae5..e4df173 100644 --- a/data/entries/DSGAI21.json +++ b/data/entries/DSGAI21.json @@ -155,8 +155,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training and retrieval data free from errors — source integrity required", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "RAG corpus integrity controls and source verification are Art. 10 requirements", @@ -165,8 +165,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI accurate and resilient against adversarial data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Source trust scoring and ingestion validation are Art. 15 robustness requirements", @@ -175,8 +175,8 @@ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must assess and mitigate risks including disinformation", - "control_name": "Art. 55(1)(a) — Systemic risk GPAI", + "control_id": "Art. 55(1)(a)", + "control_name": "Systemic risk GPAI", "tier": "Hardening", "scope": "Both", "notes": "Disinformation risk assessment and RAG integrity controls are binding Art. 55 obligations", @@ -185,8 +185,8 @@ }, { "framework": "EU AI Act", - "control_id": "AI-generated content that could be mistaken as human must be disclosed", - "control_name": "Art. 50 — Transparency", + "control_id": "Art. 50", + "control_name": "Transparency", "tier": "Hardening", "scope": "Both", "notes": "Disinformation risk amplified when users cannot distinguish AI-generated content — Art. 50 applies", @@ -235,8 +235,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — provenance", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — provenance", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -245,8 +245,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — quality", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — quality", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -255,8 +255,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -265,8 +265,8 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Transparency", - "control_name": "A.8.1", + "control_id": "A.8.1", + "control_name": "Transparency", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -275,28 +275,31 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 7", - "control_name": "7.1 — Vulnerability management", + "control_id": "7.1", + "control_name": "Vulnerability management", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.11 — Use up-to-date components", + "control_id": "16.11", + "control_name": "Use up-to-date components", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Penetration testing", + "control_id": "18.1", + "control_name": "Penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -360,8 +363,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Provenance as OT data quality and audit risk", @@ -370,8 +373,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", + "control_id": "§8.2", + "control_name": "OT security programme", "tier": "Foundational", "scope": "Both", "notes": "Data lineage as OT governance requirement", @@ -420,37 +423,41 @@ }, { "framework": "SOC 2", - "control_id": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index", - "control_name": "PI1.2 — System inputs complete and accurate", + "control_id": "PI1.2", + "control_name": "System inputs complete and accurate", "tier": "Hardening", "scope": "Both", + "notes": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery", - "control_name": "PI1.3 — Outputs complete and accurate", + "control_id": "PI1.3", + "control_name": "Outputs complete and accurate", "tier": "Hardening", "scope": "Both", + "notes": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Hardening", "scope": "Both", + "notes": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production", "confidence": "unreviewed", "reviewed_by": [] }, @@ -587,7 +594,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -597,7 +604,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -653,8 +660,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Machine credentials used for ingestion operations — no individual attribution", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce machine identity per pipeline component; log with component identity", @@ -663,8 +670,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Decommissioned pipeline identities remain in lineage records", - "control_name": "NHI-1 Improper Offboarding", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "tier": "Foundational", "scope": "Both", "notes": "Timely offboarding of pipeline NHIs", @@ -673,8 +680,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Lineage system credentials leaked — provenance records can be tampered", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Protect lineage system credentials", diff --git a/data/entries/LLM01.json b/data/entries/LLM01.json index ceeb943..48e55f7 100644 --- a/data/entries/LLM01.json +++ b/data/entries/LLM01.json @@ -91,8 +91,8 @@ }, { "framework": "EU AI Act", - "control_id": "Providers of high-risk AI must implement a risk management system covering all reasonably foreseeable risks", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system", @@ -101,8 +101,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI systems must be resilient to adversarial inputs and attempts to alter outputs or performance", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Robustness against prompt injection is a technical compliance requirement — not optional", @@ -111,8 +111,8 @@ }, { "framework": "EU AI Act", - "control_id": "Providers of systemic risk GPAI models must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models", @@ -195,7 +195,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -205,40 +205,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure application development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure application development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Secure development standards covering LLM integration — input validation, context separation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.2 Implement code review", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.2", + "control_name": "Implement code review", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Code review for all LLM integration code — prompt injection patterns reviewed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing programme", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-18", "notes": "Adversarial testing programme covering prompt injection scenarios", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis", "confidence": "unreviewed", "reviewed_by": [] @@ -355,8 +359,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious code and logic attacks via IT/OT convergence", - "control_name": "Section 5.3 — Threats", + "control_id": "§5.3", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary", @@ -365,8 +369,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Identify threats, vulnerabilities, and impacts for all OT systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection documented in OT risk assessment for each LLM integration", @@ -375,8 +379,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Defense-in-depth network architecture with validated data flows", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§7.2", + "control_name": "Network segmentation", "tier": "Foundational", "scope": "Both", "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM", @@ -385,40 +389,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", + "control_id": "SI-10", + "control_name": "Information Input Validation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Treat prompt injection as a malicious code analog — detection and response controls required", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope", "confidence": "unreviewed", "reviewed_by": [] @@ -465,37 +462,41 @@ }, { "framework": "SOC 2", - "control_id": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed", - "control_name": "CC3.2 — Risk assessment identifies threats and vulnerabilities", + "control_id": "CC3.2", + "control_name": "Risk assessment identifies threats and vulnerabilities", "tier": "Foundational", "scope": "Both", + "notes": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring", - "control_name": "CC7.2 — Anomaly and threat detection", + "control_id": "CC7.2", + "control_name": "Anomaly and threat detection", "tier": "Foundational", "scope": "Both", + "notes": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed", - "control_name": "CC5.2 — Select and develop control activities", + "control_id": "CC5.2", + "control_name": "Select and develop control activities", "tier": "Foundational", "scope": "Both", + "notes": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access", - "control_name": "CC6.1 — Logical access restrictions", + "control_id": "CC6.1", + "control_name": "Logical access restrictions", "tier": "Foundational", "scope": "Both", + "notes": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access", "confidence": "unreviewed", "reviewed_by": [] }, @@ -649,7 +650,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -659,7 +660,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-74", - "control_name": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/74.html", @@ -669,7 +670,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-77", - "control_name": "CWE-77", + "control_name": "Command Injection", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/77.html", @@ -678,8 +679,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection via all input channels", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes", @@ -688,8 +689,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal consistency under adversarial input", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection", @@ -698,8 +699,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection detection audit trail", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response", @@ -962,8 +963,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius proportional to credential scope", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Apply least-privilege to all LLM application credentials", @@ -972,8 +973,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injected session can use stolen long-lived tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Rotate all LLM application tokens; implement short-lived token pattern", diff --git a/data/entries/LLM02.json b/data/entries/LLM02.json index 8889134..a3b98e8 100644 --- a/data/entries/LLM02.json +++ b/data/entries/LLM02.json @@ -91,8 +91,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data for high-risk AI must be relevant, representative, free of errors, and complete — must address privacy", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs", @@ -101,8 +101,8 @@ }, { "framework": "EU AI Act", - "control_id": "Users must receive information about capabilities, limitations, and conditions of use", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Disclosure of potential data disclosure risks is a transparency obligation", @@ -111,8 +111,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented quality management system including post-market monitoring", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents", @@ -121,8 +121,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025", @@ -215,40 +215,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish and maintain data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish and maintain data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "Data classification and handling requirements applied to all LLM data assets", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "Embeddings, training data, and RAG caches containing sensitive data encrypted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "notes": "User training on LLM data handling — what data should not be shared with LLMs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated", "confidence": "unreviewed", "reviewed_by": [] @@ -345,8 +349,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information disclosure and OT espionage", - "control_name": "Section 5.4 — Threats", + "control_id": "§5.4", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "LLMs with historian access as a new vector for automated OT intelligence gathering", @@ -355,8 +359,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess confidentiality of OT data", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "OT data classification applied to all data accessible by LLMs", @@ -365,8 +369,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting OT data at rest and in transit", - "control_name": "Section 7.3 — Data protection", + "control_id": "§7.3", + "control_name": "Data protection", "tier": "Foundational", "scope": "Both", "notes": "Encryption and access controls on all OT data paths feeding LLM context", @@ -375,40 +379,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Audit Information", - "control_name": "AU-9", + "control_id": "AU-9", + "control_name": "Protection of Audit Information", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM", "confidence": "unreviewed", "reviewed_by": [] @@ -455,46 +452,51 @@ }, { "framework": "SOC 2", - "control_id": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented", - "control_name": "P3.1 — Personal information collection", + "control_id": "P3.1", + "control_name": "Personal information collection", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on RAG data sources — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on RAG data sources — users retrieve only data they are authorised to access", "confidence": "unreviewed", "reviewed_by": [] }, @@ -649,7 +651,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -659,7 +661,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -669,7 +671,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -678,8 +680,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "PII and sensitive data extraction from outputs", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Foundational", "scope": "Both", "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques", @@ -688,8 +690,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Output DLP effectiveness", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery", @@ -698,8 +700,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Data access authorisation enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level", @@ -919,8 +921,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "LLM outputs containing API keys, tokens, or credentials", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Output filtering: detect and redact credential patterns in all outputs", @@ -929,8 +931,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials in plaintext config files ingested by LLM", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Audit all config and data sources for embedded credentials", diff --git a/data/entries/LLM03.json b/data/entries/LLM03.json index 76cdc12..33d79d9 100644 --- a/data/entries/LLM03.json +++ b/data/entries/LLM03.json @@ -80,8 +80,8 @@ }, { "framework": "EU AI Act", - "control_id": "Autonomy-related risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Excessive agency scenarios required in risk management system", @@ -90,8 +90,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI systems designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation", @@ -100,8 +100,8 @@ }, { "framework": "EU AI Act", - "control_id": "Deployers must ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "tier": "Foundational", "scope": "Both", "notes": "Deployers cannot waive Art. 14 human oversight requirements", @@ -184,7 +184,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.5", + "control_id": "5", "control_name": "Policy", "tier": "Foundational", "scope": "Both", @@ -194,30 +194,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "LLM tool access managed as privileged access — minimum scope, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "6.1 Establish access granting process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "6.1", + "control_name": "Establish access granting process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "notes": "Formal process for granting LLM tool access — documented justification required", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All LLM tool invocations logged — every tool call auditable with parameters", "confidence": "unreviewed", "reviewed_by": [] @@ -304,8 +307,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Unauthorised command execution via IT/OT interfaces", - "control_name": "Section 5.3 — Threats", + "control_id": "§5.3", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "LLM autonomous actions as a new path for unauthorised command execution", @@ -314,8 +317,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess impact of unauthorised access and control", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface", @@ -324,8 +327,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Minimal necessary connectivity at IT/OT boundary", - "control_name": "Section 7.1 — Architecture", + "control_id": "§7.1", + "control_name": "Architecture", "tier": "Foundational", "scope": "Both", "notes": "LLM access to OT systems restricted to minimum required — read-only by default", @@ -334,40 +337,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Privilege", - "control_name": "AC-6", + "control_id": "AC-6", + "control_name": "Least Privilege", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action", "confidence": "unreviewed", "reviewed_by": [] @@ -414,37 +410,41 @@ }, { "framework": "SOC 2", - "control_id": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access restrictions", + "control_id": "CC6.1", + "control_name": "Logical access restrictions", "tier": "Foundational", "scope": "Both", + "notes": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope", - "control_name": "CC6.3 — Access removal", + "control_id": "CC6.3", + "control_name": "Access removal", "tier": "Foundational", "scope": "Both", + "notes": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius", "confidence": "unreviewed", "reviewed_by": [] }, @@ -598,7 +598,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-269", - "control_name": "CWE-269", + "control_name": "Improper Privilege Management", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/269.html", @@ -608,7 +608,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-272", - "control_name": "CWE-272", + "control_name": "Least Privilege Violation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/272.html", @@ -618,7 +618,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -627,8 +627,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Permission scope enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions", @@ -637,8 +637,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Irreversibility gate enforcement", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs", @@ -647,8 +647,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Action audit completeness", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review", @@ -889,8 +889,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Tool/API credentials with more scope than task requires", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum credential scope per tool integration", @@ -899,8 +899,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tool credentials enable extended unauthorised access", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived JIT credentials per task (see RECIPES.md)", @@ -909,8 +909,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple tools — compromise of one exposes all", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per tool integration", diff --git a/data/entries/LLM04.json b/data/entries/LLM04.json index 6e853b4..0aef8e7 100644 --- a/data/entries/LLM04.json +++ b/data/entries/LLM04.json @@ -91,8 +91,8 @@ }, { "framework": "EU AI Act", - "control_id": "Supply chain risks must be identified and mitigated in the risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Third-party component risks are in scope for Art. 9 risk management", @@ -101,8 +101,8 @@ }, { "framework": "EU AI Act", - "control_id": "Quality management must cover supply chain controls", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Documented supply chain security procedures required", @@ -111,8 +111,8 @@ }, { "framework": "EU AI Act", - "control_id": "Responsibilities distributed along the AI value chain between providers and deployers", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Providers must document what deployers inherit — deployers must verify", @@ -121,8 +121,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must document training data governance including third-party sources", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Third-party training data provenance is a GPAI documentation obligation", @@ -215,30 +215,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software asset inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", + "control_id": "2.1", + "control_name": "Establish and maintain software asset inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "notes": "ML SBOM maintained as part of software asset inventory — model versions, libraries, adapters", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management process", - "control_name": "CIS 7 — Continuous Vulnerability Management", + "control_id": "7.1", + "control_name": "Establish vulnerability management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-7", "notes": "Vulnerability management process covers LLM component CVEs and dependency risks", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.6 Use only up-to-date and trusted third-party components", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.6", + "control_name": "Use only up-to-date and trusted third-party components", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Only approved, verified LLM components used in production — unsigned components rejected", "confidence": "unreviewed", "reviewed_by": [] @@ -305,8 +308,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party software compromise as OT attack vector", - "control_name": "Section 5.5 — Supply chain threats", + "control_id": "§5.5", + "control_name": "Supply chain threats", "tier": "Foundational", "scope": "Both", "notes": "LLM model weights and plugins as supply chain risk components", @@ -315,8 +318,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk treatment", - "control_name": "Section 6.3 — Risk response", + "control_id": "§6.3", + "control_name": "Risk response", "tier": "Foundational", "scope": "Both", "notes": "ML SBOM and component integrity verification as supply chain controls", @@ -325,8 +328,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT supply chain risk management programme", - "control_name": "Section 8.4 — Supply chain programme", + "control_id": "§8.4", + "control_name": "Supply chain programme", "tier": "Foundational", "scope": "Both", "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors", @@ -335,40 +338,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Protection", - "control_name": "SA-12", + "control_id": "SA-12", + "control_name": "Supply Chain Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Controls and Plans", - "control_name": "SR-3", + "control_id": "SR-3", + "control_name": "Supply Chain Controls and Plans", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Documented supply chain security plan covering LLM components in OT deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supplier Assessments and Reviews", - "control_name": "SR-6", + "control_id": "SR-6", + "control_name": "Supplier Assessments and Reviews", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Periodic security assessment of LLM vendors with OT-deployed components", "confidence": "unreviewed", "reviewed_by": [] @@ -415,37 +411,41 @@ }, { "framework": "SOC 2", - "control_id": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring", - "control_name": "CC9.1 — Vendor risk management", + "control_id": "CC9.1", + "control_name": "Vendor risk management", "tier": "Foundational", "scope": "Both", + "notes": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification", - "control_name": "CC9.2 — Vendor agreements", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "tier": "Foundational", "scope": "Both", + "notes": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM model updates and component changes managed through change management — approval, testing, rollback", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Foundational", "scope": "Both", + "notes": "LLM model updates and component changes managed through change management — approval, testing, rollback", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -599,7 +599,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-494", - "control_name": "CWE-494", + "control_name": "Download of Code Without Integrity Check", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/494.html", @@ -609,7 +609,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -619,7 +619,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-1357", - "control_name": "CWE-1357", + "control_name": "Reliance on Insufficiently Trustworthy Component", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/1357.html", @@ -628,8 +628,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Component integrity verification", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Foundational", "scope": "Both", "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components", @@ -638,8 +638,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor behaviour detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain", @@ -648,8 +648,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Plugin and tool descriptor integrity", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components", @@ -923,8 +923,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party plugin tokens with excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review all third-party credentials; apply minimum scope", @@ -933,8 +933,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party dev/staging credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for all third-party integrations", @@ -943,8 +943,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party component credentials exposed in shared config", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Separate credential stores per third-party component", diff --git a/data/entries/LLM05.json b/data/entries/LLM05.json index d314569..dfdf7b3 100644 --- a/data/entries/LLM05.json +++ b/data/entries/LLM05.json @@ -91,8 +91,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data poisoning must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Poisoning attack scenarios required in Art. 9 risk assessment", @@ -101,8 +101,8 @@ }, { "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Data quality controls preventing poisoning are a compliance requirement", @@ -111,8 +111,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Technical robustness against poisoning is a binding Art. 15 requirement", @@ -121,8 +121,8 @@ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify model-level risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI adversarial testing", "tier": "Hardening", "scope": "Both", "notes": "Poisoning detection is in scope for Art. 55 adversarial testing", @@ -215,40 +215,44 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "7.5 Perform automated vulnerability scanning", - "control_name": "CIS 7 — Continuous Vulnerability Management", + "control_id": "7.5", + "control_name": "Perform automated vulnerability scanning", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.7 Use standard hardening configuration templates", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.7", + "control_name": "Use standard hardening configuration templates", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Hardened training pipeline configurations — immutable infrastructure, locked data sources", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.3 Remediate penetration testing findings", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.3", + "control_name": "Remediate penetration testing findings", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "notes": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.12 Collect service provider logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.12", + "control_name": "Collect service provider logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "Full audit trail of training data provenance and model training runs", "confidence": "unreviewed", "reviewed_by": [] @@ -315,8 +319,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting OT data and system integrity", - "control_name": "Section 5.3 — Integrity threats", + "control_id": "§5.3", + "control_name": "Integrity threats", "tier": "Hardening", "scope": "Both", "notes": "Model poisoning as an integrity attack on the LLM advisory system", @@ -325,8 +329,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess integrity risks for all OT-connected systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Model poisoning scenarios included in OT risk assessment for each LLM", @@ -335,8 +339,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Layered controls to maintain system integrity", - "control_name": "Section 7.2 — Defense-in-depth", + "control_id": "§7.2", + "control_name": "Defense-in-depth", "tier": "Hardening", "scope": "Both", "notes": "Independent validation of LLM outputs against rule-based reference systems", @@ -345,40 +349,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Hardening", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Software, Firmware, and Information Integrity", - "control_name": "SI-7", + "control_id": "SI-7", + "control_name": "Software, Firmware, and Information Integrity", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Model integrity verification before each OT deployment — hash-based integrity check", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", + "control_id": "SI-10", + "control_name": "Information Input Validation", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Training data validation — adversarial content detected and rejected before training", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis", "confidence": "unreviewed", "reviewed_by": [] @@ -425,37 +422,41 @@ }, { "framework": "SOC 2", - "control_id": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Threat detection", + "control_id": "CC7.2", + "control_name": "Threat detection", "tier": "Hardening", "scope": "Both", + "notes": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model promotions managed through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Hardening", "scope": "Both", + "notes": "Model promotions managed through change management — integrity verification before production deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Hardening", "scope": "Both", + "notes": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -600,7 +601,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -610,7 +611,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-346", - "control_name": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/346.html", @@ -620,7 +621,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -629,8 +630,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Training data integrity verification", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Hardening", "scope": "Both", "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples", @@ -639,8 +640,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor trigger detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Hardening", "scope": "Both", "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present", @@ -649,8 +650,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Dataset provenance verification", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Hardening", "scope": "Both", "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline", @@ -902,8 +903,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Write access to training data stores enables poisoning", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Read-only credentials for data consumption; separate write credentials with MFA", @@ -912,8 +913,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party data pipeline credentials with training data write access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Hardening", "scope": "Both", "notes": "Apply NHI-3 controls to all data pipeline third-party credentials", diff --git a/data/entries/LLM06.json b/data/entries/LLM06.json index 0eac00f..16e9112 100644 --- a/data/entries/LLM06.json +++ b/data/entries/LLM06.json @@ -80,8 +80,8 @@ }, { "framework": "EU AI Act", - "control_id": "Availability risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Resource exhaustion and DoS scenarios included in risk management system", @@ -90,8 +90,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must remain available under adversarial conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Technical resilience against denial-of-service attacks is an Art. 15 requirement", @@ -100,8 +100,8 @@ }, { "framework": "EU AI Act", - "control_id": "Operational continuity procedures documented", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Post-market monitoring and incident response for availability failures required", @@ -174,7 +174,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -184,7 +184,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "tier": "Foundational", "scope": "Both", @@ -194,30 +194,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration includes resource limits — token caps, rate limits, cost budgets", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use of network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.6", + "control_name": "Use of network-based URL filters", "tier": "Foundational", "scope": "Both", + "parent": "CIS-12", "notes": "Rate limiting and traffic controls at the API gateway and network layer", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for consumption anomalies — automated rate limiting, session suspension, alerting", "confidence": "unreviewed", "reviewed_by": [] @@ -294,8 +297,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of service attacks targeting OT availability", - "control_name": "Section 5.6 — DoS threats", + "control_id": "§5.6", + "control_name": "DoS threats", "tier": "Foundational", "scope": "Both", "notes": "LLM-induced resource exhaustion as a DoS vector affecting shared OT network infrastructure", @@ -304,8 +307,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess availability risks for OT systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "LLM resource consumption impact assessed on shared OT network and compute infrastructure", @@ -314,8 +317,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network architecture preventing DoS propagation", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§7.2", + "control_name": "Network segmentation", "tier": "Foundational", "scope": "Both", "notes": "LLM infrastructure isolated from OT control network — bandwidth caps at DMZ boundary", @@ -324,40 +327,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of Service Protection", - "control_name": "SC-5", + "control_id": "SC-5", + "control_name": "Denial of Service Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM infrastructure protected against resource exhaustion attacks affecting OT availability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Fail-Safe Procedures", - "control_name": "SI-17", + "control_id": "SI-17", + "control_name": "Fail-Safe Procedures", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM resource consumption logged — patterns indicating exhaustion attacks detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -404,37 +400,41 @@ }, { "framework": "SOC 2", - "control_id": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability", - "control_name": "A1.1 — Availability policies", + "control_id": "A1.1", + "control_name": "Availability policies", "tier": "Foundational", "scope": "Both", + "notes": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Rate limiting and resource controls protect LLM service availability — implemented and monitored", - "control_name": "A1.2 — Environmental protections", + "control_id": "A1.2", + "control_name": "Environmental protections", "tier": "Foundational", "scope": "Both", + "notes": "Rate limiting and resource controls protect LLM service availability — implemented and monitored", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -570,7 +570,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-400", - "control_name": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/400.html", @@ -580,7 +580,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-770", - "control_name": "CWE-770", + "control_name": "Allocation of Resources Without Limits or Throttling", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/770.html", @@ -590,7 +590,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-799", - "control_name": "CWE-799", + "control_name": "Improper Control of Interaction Frequency", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/799.html", @@ -599,8 +599,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Resource exhaustion and rate limiting", - "control_name": "AVT — Availability", + "control_id": "AVT", + "control_name": "Availability", "tier": "Foundational", "scope": "Both", "notes": "Test rate limiting enforcement, token budget controls, and compute throttling under load; verify graceful degradation", @@ -609,8 +609,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Consumption anomaly detection", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring detects abnormal consumption patterns — token flooding, API abuse, wallet drainage — before service impact", @@ -619,8 +619,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Per-user quota enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify per-user and per-tenant quotas are enforced and cannot be bypassed through session switching or credential abuse", @@ -818,8 +818,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Single credential with access to multiple services — one exhaustion affects all", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per service with independent quotas", @@ -828,8 +828,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credential used across services — quota exhaustion in one affects all", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per integration", diff --git a/data/entries/LLM07.json b/data/entries/LLM07.json index ec7b8ee..d5f5ef7 100644 --- a/data/entries/LLM07.json +++ b/data/entries/LLM07.json @@ -80,8 +80,8 @@ }, { "framework": "EU AI Act", - "control_id": "High-risk AI system information must include accuracy metrics and known limitations", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Hallucination rates and accuracy limitations must be disclosed to deployers and users", @@ -90,8 +90,8 @@ }, { "framework": "EU AI Act", - "control_id": "AI-generated content must be marked as such — chatbots must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", + "control_id": "Art. 50", + "control_name": "Transparency for certain AI systems", "tier": "Foundational", "scope": "Both", "notes": "Mandatory AI disclosure prevents users from treating hallucinated content as authoritative human output", @@ -100,8 +100,8 @@ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must assess and mitigate risks including disinformation", - "control_name": "Art. 55(1)(a) — Systemic risk GPAI", + "control_id": "Art. 55(1)(a)", + "control_name": "Systemic risk GPAI", "tier": "Foundational", "scope": "Both", "notes": "Misinformation risk assessment and mitigation is a binding obligation for systemic risk models", @@ -194,30 +194,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "notes": "User training on LLM output limitations — verification requirements and critical evaluation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for LLM misinformation incidents — correction, notification, root cause", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "RAG data governance — quality and freshness controls on retrieval sources", "confidence": "unreviewed", "reviewed_by": [] @@ -284,8 +287,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks degrading the reliability of OT decision-support", - "control_name": "Section 5.3 — Integrity threats", + "control_id": "§5.3", + "control_name": "Integrity threats", "tier": "Foundational", "scope": "Both", "notes": "LLM misinformation as an integrity attack on operator decision-making", @@ -294,8 +297,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess reliability of OT advisory systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "LLM accuracy limitations assessed in OT risk assessment per use case", @@ -304,8 +307,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security awareness and training", - "control_name": "Section 8.2 — Training", + "control_id": "§8.2", + "control_name": "Training", "tier": "Foundational", "scope": "Both", "notes": "Operator training on LLM limitations and verification requirements", @@ -314,40 +317,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM advisory outputs restricted to defined advisory roles — never authoritative source for safety-critical procedures", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Role-Based Training", - "control_name": "AT-3", + "control_id": "AT-3", + "control_name": "Role-Based Training", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools", "confidence": "unreviewed", "reviewed_by": [] @@ -394,37 +390,41 @@ }, { "framework": "SOC 2", - "control_id": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases", - "control_name": "PI1.1 — Processing integrity policy", + "control_id": "PI1.1", + "control_name": "Processing integrity policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources", - "control_name": "PI1.2 — System inputs are complete and accurate", + "control_id": "PI1.2", + "control_name": "System inputs are complete and accurate", "tier": "Foundational", "scope": "Both", + "notes": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Production monitoring for accuracy degradation and hallucination patterns — drift detection", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Production monitoring for accuracy degradation and hallucination patterns — drift detection", "confidence": "unreviewed", "reviewed_by": [] }, @@ -569,7 +569,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-1021", - "control_name": "CWE-1021", + "control_name": "Improper Restriction of Rendered UI Layers or Frames", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/1021.html", @@ -579,7 +579,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-116", - "control_name": "CWE-116", + "control_name": "Improper Encoding or Escaping of Output", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/116.html", @@ -588,8 +588,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Factual accuracy and hallucination rate", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Test model outputs against known-correct facts across the deployment use case domain; measure hallucination rate against benchmark ground truth", @@ -598,8 +598,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Citation verifiability", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify that citations generated by the LLM are real and accurately represent source content; test that outputs requiring citations enforce this", @@ -608,8 +608,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Misinformation incident detection", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify that the monitoring pipeline can detect and flag systematic misinformation patterns — accuracy drift, citation fabrication rate", @@ -850,8 +850,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Audit log service credentials leaked or compromised", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Protect audit log credentials as sensitive NHI", @@ -860,8 +860,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using LLM service account credentials — no attribution", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce separate human and machine credentials", diff --git a/data/entries/LLM08.json b/data/entries/LLM08.json index aeb7dc4..45dcb5c 100644 --- a/data/entries/LLM08.json +++ b/data/entries/LLM08.json @@ -80,8 +80,8 @@ }, { "framework": "EU AI Act", - "control_id": "Users must receive sufficient information about the AI system — but this does not require disclosing system prompts", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content", @@ -90,8 +90,8 @@ }, { "framework": "EU AI Act", - "control_id": "Configuration management documented", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "System prompt versions, access controls, and change procedures are quality management artefacts", @@ -100,8 +100,8 @@ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must publish summaries of training data and model capabilities", - "control_name": "Art. 53(1)(b) — GPAI transparency", + "control_id": "Art. 53(1)(b)", + "control_name": "GPAI transparency", "tier": "Foundational", "scope": "Both", "notes": "Published summaries must not inadvertently expose security-sensitive configuration", @@ -184,7 +184,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.7", + "control_id": "7", "control_name": "Support", "tier": "Foundational", "scope": "Both", @@ -194,30 +194,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "System prompts classified as sensitive configuration — data handling policy applied", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "System prompt access logged — unauthorised access attempts detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -294,8 +297,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT configuration and topology data as espionage target", - "control_name": "Section 5.4 — Information disclosure", + "control_id": "§5.4", + "control_name": "Information disclosure", "tier": "Foundational", "scope": "Both", "notes": "System prompts containing OT specifics treated as sensitive configuration data", @@ -304,8 +307,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting sensitive OT data", - "control_name": "Section 7.3 — Data protection", + "control_id": "§7.3", + "control_name": "Data protection", "tier": "Foundational", "scope": "Both", "notes": "System prompt encryption and access controls as data protection measures", @@ -314,40 +317,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "System prompts encrypted at rest — not stored in cleartext configuration files", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "System prompt access restricted to authorised personnel — version controlled, access logged", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Audit Information", - "control_name": "AU-9", + "control_id": "AU-9", + "control_name": "Protection of Audit Information", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "System prompt access logs protected — unauthorised access attempts detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -394,37 +390,41 @@ }, { "framework": "SOC 2", - "control_id": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "System prompt security procedures — version control, rotation, extraction resistance testing documented", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "System prompt security procedures — version control, rotation, extraction resistance testing documented", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access to system prompt storage monitored — anomalous access attempts detected and alerted", - "control_name": "CC7.2 — Monitoring", + "control_id": "CC7.2", + "control_name": "Monitoring", "tier": "Foundational", "scope": "Both", + "notes": "Access to system prompt storage monitored — anomalous access attempts detected and alerted", "confidence": "unreviewed", "reviewed_by": [] }, @@ -559,7 +559,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -569,7 +569,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -579,7 +579,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-215", - "control_name": "CWE-215", + "control_name": "Insertion of Sensitive Information Into Debugging Code", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/215.html", @@ -588,8 +588,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "System prompt extraction via crafted inputs", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques", @@ -598,8 +598,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential and sensitive content in system prompt", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Foundational", "scope": "Both", "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique", @@ -608,8 +608,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Refusal robustness for system prompt disclosure", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches", @@ -798,8 +798,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "API keys or tokens embedded in system prompt", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Scan system prompts for credential patterns before deployment", @@ -808,8 +808,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "System prompt stored as plaintext config with embedded credentials", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Externalise credentials to vault; reference by ID in system prompt", diff --git a/data/entries/LLM09.json b/data/entries/LLM09.json index 4a98b1e..ea3872e 100644 --- a/data/entries/LLM09.json +++ b/data/entries/LLM09.json @@ -80,8 +80,8 @@ }, { "framework": "EU AI Act", - "control_id": "Embedding and retrieval risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Vector store attack scenarios included in risk management system", @@ -90,8 +90,8 @@ }, { "framework": "EU AI Act", - "control_id": "Data quality controls applied to all data in scope — including RAG corpora", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Quality controls on embedding generation and vector store ingestion required", @@ -100,8 +100,8 @@ }, { "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Embedding manipulation resistance is an Art. 15 technical requirement", @@ -194,30 +194,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "notes": "All vector store content encrypted at rest", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management", - "control_name": "CIS 7 — Vulnerability Management", + "control_id": "7.1", + "control_name": "Establish vulnerability management", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "notes": "Vector database CVEs in vulnerability management process — CVE-2024-3584 and equivalents", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Secure coding requirements for vector store integration — RBAC, encryption, input validation", "confidence": "unreviewed", "reviewed_by": [] @@ -284,8 +287,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting the integrity of OT decision-support data", - "control_name": "Section 5.3 — Integrity threats", + "control_id": "§5.3", + "control_name": "Integrity threats", "tier": "Hardening", "scope": "Both", "notes": "Vector store poisoning as an integrity attack on LLM knowledge sources", @@ -294,8 +297,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess integrity risks for all OT-connected systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Vector store integrity included in OT LLM risk assessment", @@ -304,40 +307,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Hardening", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Software, Firmware, and Information Integrity", - "control_name": "SI-7", + "control_id": "SI-7", + "control_name": "Software, Firmware, and Information Integrity", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Vector store integrity monitoring — alert on anomalous content or unexpected modifications", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "OT vector store content encrypted at rest", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Access controls on OT vector stores — RBAC enforced at collection level", "confidence": "unreviewed", "reviewed_by": [] @@ -384,37 +380,41 @@ }, { "framework": "SOC 2", - "control_id": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access in any environment", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Hardening", "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access in any environment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms", "confidence": "unreviewed", "reviewed_by": [] }, @@ -549,7 +549,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/327.html", @@ -559,7 +559,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-330", - "control_name": "CWE-330", + "control_name": "Use of Insufficiently Random Values", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/330.html", @@ -569,7 +569,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -578,8 +578,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Embedding inversion and data reconstruction", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Hardening", "scope": "Both", "notes": "Test whether embedding vectors can be inverted to reconstruct training data; verify embedding stores do not leak source content through metadata", @@ -588,8 +588,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Vector database security configuration", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Hardening", "scope": "Both", "notes": "Verify vector database is correctly configured — authentication, encryption, namespace isolation, API key protection", @@ -598,8 +598,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Retrieval authorisation enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Hardening", "scope": "Both", "notes": "Verify RAG queries cannot retrieve documents above the authenticated user's permission level", @@ -818,8 +818,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Embedding store service account with cross-tenant read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-tenant credentials or least-privilege scope restrictions", @@ -828,8 +828,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated embedding store access", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Hardening", "scope": "Both", "notes": "Require authentication for all vector database connections", diff --git a/data/entries/LLM10.json b/data/entries/LLM10.json index 10148ce..86e0a1e 100644 --- a/data/entries/LLM10.json +++ b/data/entries/LLM10.json @@ -80,8 +80,8 @@ }, { "framework": "EU AI Act", - "control_id": "Output handling risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Insecure output handling included in risk management system", @@ -90,8 +90,8 @@ }, { "framework": "EU AI Act", - "control_id": "Accurate, robust outputs resilient to misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Output validation and sanitisation are Art. 15 technical requirements", @@ -100,8 +100,8 @@ }, { "framework": "EU AI Act", - "control_id": "Documented procedures covering output quality", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Post-market monitoring of output handling incidents required", @@ -184,7 +184,7 @@ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.8", + "control_id": "8", "control_name": "Operation", "tier": "Foundational", "scope": "Both", @@ -194,30 +194,33 @@ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Output encoding and sanitisation as secure development requirements", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Log all LLM outputs — injection attempts in model responses detectable", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing", "tier": "Foundational", "scope": "Both", + "parent": "CIS-18", "notes": "Output injection scenarios in penetration testing — XSS, SQL injection via LLM output", "confidence": "unreviewed", "reviewed_by": [] @@ -304,8 +307,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Code injection and execution via data paths", - "control_name": "Section 5.3 — Threats", + "control_id": "§5.3", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary", @@ -314,8 +317,8 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Validated data flows across zone boundaries", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§7.2", + "control_name": "Network segmentation", "tier": "Foundational", "scope": "Both", "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems", @@ -324,40 +327,33 @@ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", + "control_id": "SI-10", + "control_name": "Information Input Validation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM output scanning for malicious content before OT system ingestion", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Functionality", - "control_name": "CM-7", + "control_id": "CM-7", + "control_name": "Least Functionality", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats", "confidence": "unreviewed", "reviewed_by": [] @@ -404,37 +400,41 @@ }, { "framework": "SOC 2", - "control_id": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing", - "control_name": "PI1.1 — Processing integrity policies", + "control_id": "PI1.1", + "control_name": "Processing integrity policies", "tier": "Foundational", "scope": "Both", + "notes": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation", - "control_name": "CC5.2 — Select and develop control activities", + "control_id": "CC5.2", + "control_name": "Select and develop control activities", "tier": "Foundational", "scope": "Both", + "notes": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content", "confidence": "unreviewed", "reviewed_by": [] }, @@ -579,7 +579,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-79", - "control_name": "CWE-79", + "control_name": "Cross-site Scripting (XSS)", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/79.html", @@ -589,7 +589,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-89", - "control_name": "CWE-89", + "control_name": "SQL Injection", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/89.html", @@ -599,7 +599,7 @@ { "framework": "CWE/CVE", "control_id": "CWE-78", - "control_name": "CWE-78", + "control_name": "OS Command Injection", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/78.html", @@ -608,8 +608,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Output injection into downstream systems", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters", @@ -618,8 +618,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Crafted inputs designed to produce malicious outputs", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems", @@ -628,8 +628,8 @@ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Downstream system access controls", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation", @@ -848,8 +848,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials appearing in model outputs passed to executors", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Credential detection in output pipeline before execution", @@ -858,8 +858,8 @@ }, { "framework": "OWASP NHI Top 10", - "control_id": "Downstream service credentials with excessive scope", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Apply least-privilege to all credentials used in downstream processing", diff --git a/data/stats.json b/data/stats.json index 1210dc5..01a501e 100644 --- a/data/stats.json +++ b/data/stats.json @@ -27,12 +27,12 @@ } }, "mappings": { - "total": 3781, + "total": 3771, "by_list": { "Agentic-Top10-2026": 993, "AST-Top10-2026": 36, "DSGAI-2026": 1766, - "LLM-Top10-2026": 986 + "LLM-Top10-2026": 976 } }, "frameworks": { diff --git a/docs/backlinks.js b/docs/backlinks.js index 2356792..04d8c80 100644 --- a/docs/backlinks.js +++ b/docs/backlinks.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Backlinks: 1300 +// Backlinks: 767 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -1424,8 +1424,56 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "12.4 Establish and maintain architecture diagram", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "10.1", + "control_name": "Deploy anti-malware", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "11.1", + "control_name": "Establish recovery capability", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "11.4", + "control_name": "Test data recovery", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "12.4", + "control_name": "Establish and maintain architecture diagram", "entries": [ { "id": "ASI07", @@ -1440,9 +1488,18 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.6", + "control_name": "Use of network-based URL filters", "entries": [ + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Rate limiting and traffic controls at the API gateway and network layer" + }, { "id": "ASI08", "name": "Cascading Agent Failures", @@ -1456,24 +1513,24 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use of network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.7", + "control_name": "Deploy host-based intrusion detection", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting and traffic controls at the API gateway and network layer" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "13.1 Centralise security event alerting", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.1", + "control_name": "Centralise security event alerting", "entries": [ { "id": "ASI10", @@ -1483,13 +1540,22 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "13.3 Deploy a network-based intrusion detection system", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.3", + "control_name": "Deploy a network-based intrusion detection system", "entries": [ { "id": "ASI06", @@ -1504,25 +1570,34 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy a network intrusion detection solution", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.4", + "control_name": "Perform traffic filtering", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Network-layer monitoring for injection indicators in agent traffic" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy network intrusion detection", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.8", + "control_name": "Deploy a network intrusion detection solution", "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Network-layer monitoring for injection indicators in agent traffic" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -1531,13 +1606,22 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Code execution environments network-monitored — outbound connection attempts from sandbox detected" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "entries": [ { "id": "LLM02", @@ -1570,50 +1654,75 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "15.1 Establish service provider management process", - "control_name": "CIS 15 — Service Provider Management", + "control_id": "14.3", + "control_name": "Train workforce to identify attacks", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "14.6", + "control_name": "Train workforce on AI security", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure application development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "15.1", + "control_name": "Establish service provider management process", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure development standards covering LLM integration — input validation, context separation" + "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure development standards covering agentic integrations — input validation, goal-state verification" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure application development standards", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secure development standards covering LLM integration — input validation, context separation" + }, { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -1632,6 +1741,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Output encoding and sanitisation as secure development requirements" }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secure development standards covering agentic integrations — input validation, goal-state verification" + }, { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -1667,13 +1785,72 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "A2A authentication and schema validation as secure development requirements" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "16.11", + "control_name": "Use up-to-date software components", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "16.12", + "control_name": "Implement code-level security checks", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.2 Implement code review", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.2", + "control_name": "Implement code review", "entries": [ { "id": "LLM01", @@ -1683,13 +1860,22 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Code review for all LLM integration code — prompt injection patterns reviewed" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.6 Use only up-to-date and trusted third-party components", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.6", + "control_name": "Use only up-to-date and trusted third-party components", "entries": [ { "id": "LLM04", @@ -1708,13 +1894,31 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Approved component list — only sourced from approved vendors, signatures verified" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "16.7 Use standard hardening configuration templates", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.7", + "control_name": "Use standard hardening configuration templates", "entries": [ { "id": "LLM05", @@ -1724,13 +1928,22 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Hardened training pipeline configurations — immutable infrastructure, locked data sources" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "entries": [ { "id": "LLM06", @@ -1767,13 +1980,22 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "17.2 Establish incident response procedures", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.2", + "control_name": "Establish incident response procedures", "entries": [ { "id": "ASI10", @@ -1788,9 +2010,18 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Adversarial testing programme covering prompt injection scenarios" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -1800,6 +2031,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Output injection scenarios in penetration testing — XSS, SQL injection via LLM output" }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -1817,38 +2057,58 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Rogue agent scenarios in penetration testing — persistent hidden goal simulation, detection verification" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing programme", - "control_name": "CIS 18 — Penetration Testing", - "entries": [ + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Adversarial testing programme covering prompt injection scenarios" + "notes": null }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios" + "notes": null + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "18.3 Remediate penetration testing findings", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.3", + "control_name": "Remediate penetration testing findings", "entries": [ { "id": "LLM05", @@ -1858,13 +2118,22 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software asset inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", + "control_id": "2.1", + "control_name": "Establish and maintain software asset inventory", "entries": [ { "id": "LLM04", @@ -1874,14 +2143,7 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "ML SBOM maintained as part of software asset inventory — model versions, libraries, adapters" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", - "entries": [ + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -1890,30 +2152,48 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish and maintain data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "2.6", + "control_name": "Allowlist authorised software", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data classification and handling requirements applied to all LLM data assets" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish and maintain data management process", "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Data classification and handling requirements applied to all LLM data assets" + }, { "id": "LLM07", "name": "Misinformation", @@ -1931,13 +2211,40 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "System prompts classified as sensitive configuration — data handling policy applied" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "3.10 Encrypt sensitive data in transit", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.10", + "control_name": "Encrypt sensitive data in transit", "entries": [ { "id": "ASI07", @@ -1952,8 +2259,8 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "entries": [ { "id": "LLM02", @@ -1990,222 +2297,158 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", - "entries": [ + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure configuration includes resource limits — token caps, rate limits, cost budgets" + "notes": null }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config" + "notes": null }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "3.13", + "control_name": "Deploy DLP solutions", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM tool access managed as privileged access — minimum scope, regular review" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool access managed as privileged access — minimum scope, regular review" + "notes": null }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance" + "notes": null }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat" + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "6.1 Establish access granting process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "3.2", + "control_name": "Establish data inventory", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Formal process for granting LLM tool access — documented justification required" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Formal process for granting agent tool access — documented justification per tool" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "6.2 Establish an access revoking process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "3.3", + "control_name": "Configure data access control lists", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management", - "control_name": "CIS 7 — Vulnerability Management", - "entries": [ - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector database CVEs in vulnerability management process — CVE-2024-3584 and equivalents" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management process", - "control_name": "CIS 7 — Continuous Vulnerability Management", - "entries": [ + "notes": null + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Vulnerability management process covers LLM component CVEs and dependency risks" + "scope": "Build", + "notes": null }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "7.5 Perform automated vulnerability scanning", - "control_name": "CIS 7 — Continuous Vulnerability Management", - "entries": [ + "scope": "Build", + "notes": null + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", - "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.12 Collect service provider logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "3.7", + "control_name": "Establish data classification scheme", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Hardening", - "scope": "Both", - "notes": "Full audit trail of training data provenance and model training runs" + "scope": "Build", + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis" + "notes": "Secure configuration includes resource limits — token caps, rate limits, cost budgets" }, { "id": "LLM08", @@ -2214,60 +2457,83 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompt access logged — unauthorised access attempts detectable" + "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Log all LLM outputs — injection attempts in model responses detectable" + "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All agent inputs logged — injection attempts detectable through log analysis" + "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Memory write operations logged — who or what wrote, when, content hash" + "notes": null }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "4.2", + "control_name": "Maintain secure configuration of cloud assets", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated" - }, + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "5.3", + "control_name": "Disable dormant accounts", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", + "entries": [ { "id": "LLM03", "name": "Excessive Agency", @@ -2275,7 +2541,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All LLM tool invocations logged — every tool call auditable with parameters" + "notes": "LLM tool access managed as privileged access — minimum scope, regular review" }, { "id": "ASI02", @@ -2284,7 +2550,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp" + "notes": "Agent tool access managed as privileged access — minimum scope, regular review" }, { "id": "ASI03", @@ -2293,68 +2559,54 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All credential operations logged — issuance, use, anomalous patterns detectable" + "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" + "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable" + "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "8.6 Collect DNS query audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "6.1", + "control_name": "Establish access granting process", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent traffic monitored — cascade indicators detected before physical impact" - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 10", - "control_name": "10.1 — Deploy anti-malware", - "entries": [ + "notes": "Formal process for granting LLM tool access — documented justification required" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 11", - "control_name": "11.1 — Establish recovery capability", - "entries": [ + "notes": "Formal process for granting agent tool access — documented justification per tool" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -2365,83 +2617,67 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 12", - "control_name": "12.7 — Deploy host-based intrusion detection", + "control_id": "6.2", + "control_name": "Establish an access revoking process", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.4 — Perform traffic filtering", - "entries": [ + "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", "notes": null - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 14", - "control_name": "14.6 — Train workforce on AI security", + "control_id": "6.3", + "control_name": "Require password manager for service accounts", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 15", - "control_name": "15.1 — Establish service provider management policy", + "control_id": "6.4", + "control_name": "Require password manager", "entries": [ { "id": "DSGAI06", @@ -2456,12 +2692,12 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.12 — Implement code-level security checks", + "control_id": "6.5", + "control_name": "Require MFA for admin access", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", @@ -2469,68 +2705,57 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "7.1", + "control_name": "Establish vulnerability management process", + "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Vulnerability management process covers LLM component CVEs and dependency risks" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Vector database CVEs in vulnerability management process — CVE-2024-3584 and equivalents" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": null }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", @@ -2544,168 +2769,123 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 17", - "control_name": "17.1 — Incident response management", + "control_id": "7.5", + "control_name": "Perform automated vulnerability scanning", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries" } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Establish penetration testing programme", + "control_id": "8.10", + "control_name": "Retain audit logs", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Build", "notes": null - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 2", - "control_name": "2.1 — Maintain authorised software inventory", + "control_id": "8.12", + "control_name": "Collect service provider logs", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Full audit trail of training data provenance and model training runs" } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Establish and maintain data management process", + "control_id": "8.2", + "control_name": "Collect audit logs", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "System prompt access logged — unauthorised access attempts detectable" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Log all LLM outputs — injection attempts in model responses detectable" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "All agent inputs logged — injection attempts detectable through log analysis" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Memory write operations logged — who or what wrote, when, content hash" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -2720,30 +2900,19 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Build", "notes": null - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, + } + ] + }, + { + "framework": "CIS Controls v8.1", + "control_id": "8.3", + "control_name": "Ensure adequate audit log storage", + "entries": [ { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": null @@ -2752,207 +2921,87 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.1 — Establish secure configuration", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 5", - "control_name": "5.4 — Restrict administrator privileges", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.5 — Require MFA for admin access", - "entries": [ + "notes": "All LLM tool invocations logged — every tool call auditable with parameters" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All credential operations logged — issuance, use, anomalous patterns detectable" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": null + "tier": "Hardening", + "scope": "Both", + "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "CIS Controls v8.1", - "control_id": "CIS 7", - "control_name": "7.1 — Establish vulnerability management", - "entries": [ - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null } ] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.6", + "control_name": "Collect DNS query audit logs", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null + "notes": "Agent traffic monitored — cascade indicators detected before physical impact" }, { "id": "DSGAI20", @@ -4299,92 +4348,69 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CWE/CVE", - "control_id": "Acceptance of Extraneous Untrusted Data with Trusted Data", - "control_name": "CWE-349", + "control_id": "CWE-1021", + "control_name": "Improper Restriction of Rendered UI Layers or Frames", "entries": [ { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge" + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Authentication Bypass by Capture-replay", - "control_name": "CWE-294", + "control_id": "CWE-116", + "control_name": "Improper Encoding or Escaping of Output", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Replay attacks on A2A channels without nonce-based replay protection" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Cleartext Storage of Sensitive Information", - "control_name": "CWE-312", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Cleartext Transmission of Sensitive Information", - "control_name": "CWE-319", - "entries": [ + "notes": null + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "A2A messages containing sensitive context transmitted without encryption" + "scope": "Build", + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-1021", - "control_name": "CWE-1021", + "control_id": "CWE-1341", + "control_name": "Multiple Releases of Same Resource or Handle", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Memory TTL not enforced — entries persist beyond intended lifetime" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-116", - "control_name": "CWE-116", + "control_id": "CWE-1357", + "control_name": "Reliance on Insufficiently Trustworthy Component", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", @@ -4392,36 +4418,36 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Agent dependency on third-party MCP servers without security assessment" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-1357", - "control_name": "CWE-1357", + "control_id": "CWE-183", + "control_name": "Permissive List of Allowed Inputs", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "System accepts human-like agent output without disclosure requirements" } ] }, { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "entries": [ { "id": "LLM01", @@ -4441,6 +4467,33 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": null }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool parameters generated by LLM not validated against safe ranges before execution" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Content entering agent memory not validated before write" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -4482,7 +4535,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "entries": [ { "id": "LLM02", @@ -4502,6 +4555,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": null }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -4561,7 +4623,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "entries": [ { "id": "LLM02", @@ -4604,7 +4666,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-213", - "control_name": "CWE-213", + "control_name": "Exposure of Sensitive Information Due to Incompatible Policies", "entries": [ { "id": "DSGAI07", @@ -4620,7 +4682,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-215", - "control_name": "CWE-215", + "control_name": "Insertion of Sensitive Information Into Debugging Code", "entries": [ { "id": "LLM08", @@ -4633,10 +4695,26 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-250", + "control_name": "Execution with Unnecessary Privileges", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-269", - "control_name": "CWE-269", + "control_name": "Improper Privilege Management", "entries": [ { "id": "LLM03", @@ -4661,7 +4739,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-272", - "control_name": "CWE-272", + "control_name": "Least Privilege Violation", "entries": [ { "id": "LLM03", @@ -4683,10 +4761,26 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-276", + "control_name": "Incorrect Default Permissions", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "entries": [ { "id": "LLM03", @@ -4697,6 +4791,33 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": null }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -4756,7 +4877,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-285", - "control_name": "CWE-285", + "control_name": "Improper Authorisation", "entries": [ { "id": "DSGAI15", @@ -4778,10 +4899,42 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-287", + "control_name": "Improper Authentication", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "A2A channels without mutual authentication — agents accept messages from any sender" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-294", + "control_name": "Authentication Bypass by Capture-replay", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Replay attacks on A2A channels without nonce-based replay protection" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "entries": [ { "id": "LLM08", @@ -4792,6 +4945,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": null }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -4821,10 +4983,26 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-319", + "control_name": "Cleartext Transmission of Sensitive Information", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "A2A messages containing sensitive context transmitted without encryption" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "entries": [ { "id": "LLM09", @@ -4858,7 +5036,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-330", - "control_name": "CWE-330", + "control_name": "Use of Insufficiently Random Values", "entries": [ { "id": "LLM09", @@ -4883,7 +5061,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "entries": [ { "id": "LLM04", @@ -4912,6 +5090,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": null }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Memory content not integrity-verified before storage or retrieval" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -4935,7 +5122,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-346", - "control_name": "CWE-346", + "control_name": "Origin Validation Error", "entries": [ { "id": "LLM05", @@ -4946,6 +5133,24 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": null }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent does not verify that A2A messages originate from the claimed sender" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "User cannot determine whether advice originates from AI or human — no origin verification" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -4957,10 +5162,26 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-349", + "control_name": "Acceptance of Extraneous Untrusted Data with Trusted Data", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information to an Unauthorised Actor", "entries": [ { "id": "LLM02", @@ -5021,7 +5242,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-400", - "control_name": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "entries": [ { "id": "LLM06", @@ -5032,6 +5253,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": null }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster" + }, { "id": "DSGAI17", "name": "Data Availability and Resilience Failures", @@ -5043,10 +5273,67 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-434", + "control_name": "Unrestricted Upload of File with Dangerous Type", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Analogy: agent accepts and executes tool payloads without content validation" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-441", + "control_name": "Unintended Proxy or Intermediary", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent acts as a proxy executing attacker instructions against backend systems" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Compromised tool acting as malicious intermediary in agent workflow" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-451", + "control_name": "User Interface Misrepresentation of Critical Information", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-488", - "control_name": "CWE-488", + "control_name": "Exposure of Data Element to Wrong Session", "entries": [ { "id": "DSGAI11", @@ -5062,7 +5349,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-494", - "control_name": "CWE-494", + "control_name": "Download of Code Without Integrity Check", "entries": [ { "id": "LLM04", @@ -5072,14 +5359,57 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": null + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent tool components and MCP servers loaded without signature verification" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-506", + "control_name": "Embedded Malicious Code", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Model weights and tool components containing hidden backdoor functionality" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Rogue behaviour may result from backdoored model or component" } ] }, { "framework": "CWE/CVE", "control_id": "CWE-522", - "control_name": "CWE-522", + "control_name": "Insufficiently Protected Credentials", "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -5094,7 +5424,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-532", - "control_name": "CWE-532", + "control_name": "Insertion of Sensitive Information Into Log File", "entries": [ { "id": "DSGAI14", @@ -5110,7 +5440,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "CWE/CVE", "control_id": "CWE-602", - "control_name": "CWE-602", + "control_name": "Client-side Enforcement of Server-side Security", "entries": [ { "id": "DSGAI06", @@ -5123,10 +5453,42 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "CWE/CVE", + "control_id": "CWE-610", + "control_name": "Externally Controlled Reference to a Resource in Another Sphere", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent retrieves and acts on externally controlled content (RAG, email, tool returns) without adequate validation" + } + ] + }, + { + "framework": "CWE/CVE", + "control_id": "CWE-613", + "control_name": "Insufficient Session Expiration", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Long-lived agent credentials without expiry or rotation — NHI-7" + } + ] + }, { "framework": "CWE/CVE", "control_id": "CWE-668", - "control_name": "CWE-668", + "control_name": "Exposure of Resource to Wrong Sphere", "entries": [ { "id": "DSGAI03", @@ -5150,111 +5512,120 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CWE/CVE", - "control_id": "CWE-74", - "control_name": "CWE-74", + "control_id": "CWE-674", + "control_name": "Uncontrolled Recursion", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null + "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-77", - "control_name": "CWE-77", + "control_id": "CWE-676", + "control_name": "Use of Potentially Dangerous Function", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent uses exec(), eval(), subprocess without validation" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-770", - "control_name": "CWE-770", + "control_id": "CWE-693", + "control_name": "Protection Mechanism Failure", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Safety and goal-verification controls bypassed through injection" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-778", - "control_name": "CWE-778", + "control_id": "CWE-703", + "control_name": "Improper Check or Handling of Exceptional Conditions", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent failures not caught and handled — exception propagates to downstream agents" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-78", - "control_name": "CWE-78", + "control_id": "CWE-730", + "control_name": "OWASP ReDoS", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "Regex-based input processing causing runaway computation propagating through pipeline" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-79", - "control_name": "CWE-79", + "control_id": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Instruction elements in processed content not neutralised before agent reasoning" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", @@ -5264,172 +5635,165 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CWE/CVE", - "control_id": "CWE-798", - "control_name": "CWE-798", + "control_id": "CWE-755", + "control_name": "Improper Handling of Exceptional Conditions", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-799", - "control_name": "CWE-799", + "control_id": "CWE-77", + "control_name": "Command Injection", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM output used directly in command context" } ] }, { "framework": "CWE/CVE", - "control_id": "CWE-89", - "control_name": "CWE-89", + "control_id": "CWE-770", + "control_name": "Allocation of Resources Without Limits or Throttling", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Download of Code Without Integrity Check", - "control_name": "CWE-494", + "control_id": "CWE-778", + "control_name": "Insufficient Logging", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool components and MCP servers loaded without signature verification" + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Embedded Malicious Code", - "control_name": "CWE-506", + "control_id": "CWE-78", + "control_name": "OS Command Injection", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Model weights and tool components containing hidden backdoor functionality" + "scope": "Build", + "notes": null }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rogue behaviour may result from backdoored model or component" + "notes": "LLM-generated code containing shell commands executed without sanitisation" } ] }, { "framework": "CWE/CVE", - "control_id": "Execution with Unnecessary Privileges", - "control_name": "CWE-250", + "control_id": "CWE-79", + "control_name": "Cross-site Scripting (XSS)", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege" + "scope": "Build", + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Exposure of Sensitive Information to an Unauthorised Actor", - "control_name": "CWE-200", + "control_id": "CWE-798", + "control_name": "Use of Hard-coded Credentials", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Externally Controlled Reference to a Resource in Another Sphere", - "control_name": "CWE-610", - "entries": [ + "notes": "Agent credentials hardcoded in prompts or source code" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent retrieves and acts on externally controlled content (RAG, email, tool returns) without adequate validation" + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-799", + "control_name": "Improper Control of Interaction Frequency", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes" + "notes": null }, { "id": "ASI10", @@ -5438,46 +5802,30 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement" + "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Authentication", - "control_name": "CWE-287", + "control_id": "CWE-829", + "control_name": "Inclusion of Functionality from Untrusted Control Sphere", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "A2A channels without mutual authentication — agents accept messages from any sender" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Check or Handling of Exceptional Conditions", - "control_name": "CWE-703", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent failures not caught and handled — exception propagates to downstream agents" + "notes": "MCP servers and plugins from external registries loaded into agent execution context" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Dynamically-Managed Code Resources", - "control_name": "CWE-913", + "control_id": "CWE-862", + "control_name": "Missing Authorisation", "entries": [ { "id": "ASI02", @@ -5486,46 +5834,55 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled" + "notes": "No authorisation check before irreversible tool invocations; human confirmation not required" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Generation of Code", - "control_name": "CWE-94", + "control_id": "CWE-89", + "control_name": "SQL Injection", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Agent generates and executes code without adequate static analysis or sandbox" + "scope": "Build", + "notes": null } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Interaction Frequency", - "control_name": "CWE-799", + "control_id": "CWE-913", + "control_name": "Improper Control of Dynamically-Managed Code Resources", "entries": [ { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations" + "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Enforcement of Message Integrity During Transmission", - "control_name": "CWE-924", + "control_id": "CWE-924", + "control_name": "Improper Enforcement of Message Integrity During Transmission", "entries": [ { "id": "ASI07", @@ -5540,58 +5897,40 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Handling of Exceptional Conditions", - "control_name": "CWE-755", + "control_id": "CWE-94", + "control_name": "Improper Control of Generation of Code", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully" + "notes": "Agent generates and executes code without adequate static analysis or sandbox" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-940", + "control_name": "Improper Verification of Source of a Communication Channel", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool parameters generated by LLM not validated against safe ranges before execution" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Content entering agent memory not validated before write" + "notes": "User cannot verify the agent is operating under its stated configuration" } ] }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Directives in Dynamically Evaluated Code", - "control_name": "CWE-95", + "control_id": "CWE-95", + "control_name": "Improper Neutralisation of Directives in Dynamically Evaluated Code", "entries": [ { "id": "ASI05", @@ -5605,138 +5944,100 @@ window.CROSSWALK_BACKLINKS = [ ] }, { - "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Command", - "control_name": "CWE-77", + "framework": "DORA", + "control_id": "Art. 10", + "control_name": "Detection — injection monitoring", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM output used directly in command context" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in OS Command", - "control_name": "CWE-78", - "entries": [ + "notes": "Deploy detection mechanisms for prompt injection attempts; monitor inference requests for adversarial patterns and alert security operations" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated code containing shell commands executed without sanitisation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Output Used by a Downstream Component", - "control_name": "CWE-74", - "entries": [ + "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Instruction elements in processed content not neutralised before agent reasoning" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Improper Verification of Source of a Communication Channel", - "control_name": "CWE-940", - "entries": [ + "scope": "Build", + "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "User cannot verify the agent is operating under its stated configuration" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Inclusion of Functionality from Untrusted Control Sphere", - "control_name": "CWE-829", - "entries": [ + "notes": "Monitor AI service consumption metrics in real time; alert on token spikes, latency degradation, and cost overruns affecting financial service availability" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "MCP servers and plugins from external registries loaded into agent execution context" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Incorrect Default Permissions", - "control_name": "CWE-276", - "entries": [ + "notes": "Deploy detection mechanisms for AI output quality degradation — hallucinations, factual errors, and misleading content in financial AI outputs" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "Monitor embedding stores for unauthorised modifications, anomalous writes, and bulk access patterns indicative of extraction or poisoning" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Insufficient Session Expiration", - "control_name": "CWE-613", - "entries": [ + "notes": "Monitor model output reaching privileged sinks; alert on generated code, markup, or query syntax that fails the boundary validation policy" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Long-lived agent credentials without expiry or rotation — NHI-7" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Insufficient Verification of Data Authenticity", - "control_name": "CWE-345", - "entries": [ + "notes": "Deploy detection mechanisms for agent goal manipulation; monitor for behavioural deviations, unexpected tool invocations, and goal drift indicators" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Memory content not integrity-verified before storage or retrieval" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Insufficiently Protected Credentials", - "control_name": "CWE-522", - "entries": [ + "scope": "Build", + "notes": "Monitor agent access patterns for unauthorised tool invocations, data access beyond scope, and permission violations; alert on detection" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -5744,31 +6045,17 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Missing Authorisation", - "control_name": "CWE-862", - "entries": [ + "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "No authorisation check before irreversible tool invocations; human confirmation not required" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Multiple Releases of Same Resource or Handle", - "control_name": "CWE-1341", - "entries": [ + "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -5776,359 +6063,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Memory TTL not enforced — entries persist beyond intended lifetime" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Origin Validation Error", - "control_name": "CWE-346", - "entries": [ + "notes": "Deploy detection mechanisms for agent memory manipulation; monitor for anomalous writes, content inconsistencies, and cross-session poisoning patterns" + }, { "id": "ASI07", "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Agent does not verify that A2A messages originate from the claimed sender" - }, - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "User cannot determine whether advice originates from AI or human — no origin verification" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "OWASP ReDoS", - "control_name": "CWE-730", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Regex-based input processing causing runaway computation propagating through pipeline" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Permissive List of Allowed Inputs", - "control_name": "CWE-183", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System accepts human-like agent output without disclosure requirements" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Protection Mechanism Failure", - "control_name": "CWE-693", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Safety and goal-verification controls bypassed through injection" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Reliance on Insufficiently Trustworthy Component", - "control_name": "CWE-1357", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent dependency on third-party MCP servers without security assessment" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Uncontrolled Recursion", - "control_name": "CWE-674", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Uncontrolled Resource Consumption", - "control_name": "CWE-400", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Unintended Proxy or Intermediary", - "control_name": "CWE-441", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent acts as a proxy executing attacker instructions against backend systems" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Compromised tool acting as malicious intermediary in agent workflow" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Unrestricted Upload of File with Dangerous Type", - "control_name": "CWE-434", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Analogy: agent accepts and executes tool payloads without content validation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Use of Hard-coded Credentials", - "control_name": "CWE-798", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials hardcoded in prompts or source code" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "Use of Potentially Dangerous Function", - "control_name": "CWE-676", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent uses exec(), eval(), subprocess without validation" - } - ] - }, - { - "framework": "CWE/CVE", - "control_id": "User Interface Misrepresentation of Critical Information", - "control_name": "CWE-451", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI" - } - ] - }, - { - "framework": "DORA", - "control_id": "Art. 10", - "control_name": "Detection — injection monitoring", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for prompt injection attempts; monitor inference requests for adversarial patterns and alert security operations" - }, - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor AI service consumption metrics in real time; alert on token spikes, latency degradation, and cost overruns affecting financial service availability" - }, - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for AI output quality degradation — hallucinations, factual errors, and misleading content in financial AI outputs" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor embedding stores for unauthorised modifications, anomalous writes, and bulk access patterns indicative of extraction or poisoning" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor model output reaching privileged sinks; alert on generated code, markup, or query syntax that fails the boundary validation policy" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for agent goal manipulation; monitor for behavioural deviations, unexpected tool invocations, and goal drift indicators" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor agent access patterns for unauthorised tool invocations, data access beyond scope, and permission violations; alert on detection" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deploy detection mechanisms for agent memory manipulation; monitor for anomalous writes, content inconsistencies, and cross-session poisoning patterns" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries" + "scope": "Build", + "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries" }, { "id": "ASI08", @@ -8431,441 +8375,18 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act", - "control_id": "A2A communication risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Accurate, robust outputs resilient to misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Output validation and sanitisation are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "AI-generated content must be marked as such — chatbots must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Mandatory AI disclosure prevents users from treating hallucinated content as authoritative human output" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "AI-generated content that could be mistaken as human must be disclosed", - "control_name": "Art. 50 — Transparency", - "entries": [ - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Disinformation risk amplified when users cannot distinguish AI-generated content — Art. 50 applies" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Autonomy-related risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Excessive agency scenarios required in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Availability risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Resource exhaustion and DoS scenarios included in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cascade risks identified and mitigated — blast radius defined", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Chatbots and AI-generated content must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All agent-user interactions require AI disclosure — universal obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Code execution risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Configuration management documented", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 10", + "control_name": "Data and data governance", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompt versions, access controls, and change procedures are quality management artefacts" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Credential exposure must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential lifecycle included in Art. 9 risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Credential exposure risk identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity against adversarial exploitation of context window content", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures covering all data channels including multimodal inputs", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing cross-session data exposure", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Session isolation and tenant separation are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing tool misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against adversarial misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against attacks including inference attacks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft and misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Short-lived credentials, NHI inventory, and access controls are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting AI system integrity", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting all system components", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including context window content", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including telemetry and monitoring data", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance applies to all data influencing AI behaviour — including agent memory", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance covering multi-tenant deployments — session isolation as a data handling requirement", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Session isolation controls are an Art. 10 data governance obligation for multi-user deployments" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data governance covers all input modalities — images, audio, video — not only text", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data poisoning must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs" + }, { "id": "LLM05", "name": "Data and Model Poisoning", @@ -8873,232 +8394,8 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Poisoning attack scenarios required in Art. 9 risk assessment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Data quality controls applied to all data in scope — including RAG corpora", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Quality controls on embedding generation and vector store ingestion required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Deployers ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deployers responsible for ensuring endpoint AI agents operate within Art. 14 human oversight scope" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Deployers must ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Deployers cannot waive Art. 14 human oversight requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Deployers must use AI systems as instructed and ensure appropriate oversight", - "control_name": "Art. 29 — Deployer obligations", - "entries": [ - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documentation of A2A security controls", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "A2A authentication and encryption documented in quality management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures covering output quality", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Post-market monitoring of output handling incidents required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for credential incident response", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for credential management and incident response", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent identity governance procedures documented in quality management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for data ingestion and pipeline integrity", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ingestion validation procedures and CVE patching documented in quality management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented procedures for LLM gateway security", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Security testing procedures and query log retention documented in quality management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented quality management system including data handling procedures", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data lifecycle procedures — classification, retention, deletion — documented in quality management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Documented quality management system including post-market monitoring", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents" + "notes": "Data quality controls preventing poisoning are a compliance requirement" }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Absence of a quality management system is an Art. 17 violation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Effective human oversight over high-risk AI", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Embedding and retrieval risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -9106,625 +8403,80 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Vector store attack scenarios included in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Endpoint AI agent risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Browser and endpoint agent deployments assessed in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Goal hijack scenarios identified and mitigated in risk management system", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent goal hijack included in Art. 9 risk assessment for every agentic deployment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers document all third-party integrations", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool and plugin data exchange documented in GPAI technical documentation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Full data governance documentation for GPAI training data is a binding Art. 53 obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers must document training data governance including third-party sources", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Third-party training data provenance is a GPAI documentation obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers must maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI providers must publish summaries of training data and model capabilities", - "control_name": "Art. 53(1)(b) — GPAI transparency", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Published summaries must not inadvertently expose security-sensitive configuration" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI technical documentation includes model architecture and capability details", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "GPAI training data governance documented — privacy measures included", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Synthetic data generation methodology and re-identification risk assessment documented for GPAI" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Graduated fines based on violation type", - "control_name": "Art. 72 — Fines", - "entries": [ - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Understanding fine exposure is the starting point for compliance prioritisation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI accurate and resilient against adversarial data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Source trust scoring and ingestion validation are Art. 15 robustness requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow human oversight — users must be able to stop and override", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Users must be able to pause and override endpoint AI agents — Art. 14 human oversight requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI infrastructure protected against cybersecurity risks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient and implement cybersecurity measures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Technical robustness against poisoning is a binding Art. 15 requirement" + "notes": "Quality controls on embedding generation and vector store ingestion required" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must remain accurate and available under adverse conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI must remain available under adversarial conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Technical resilience against denial-of-service attacks is an Art. 15 requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI resilient against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI system information must include accuracy metrics and known limitations", - "control_name": "Art. 13 — Transparency", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Hallucination rates and accuracy limitations must be disclosed to deployers and users" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI systems designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI systems must be resilient to adversarial inputs and attempts to alter outputs or performance", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Robustness against prompt injection is a technical compliance requirement — not optional" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "High-risk AI training data subject to governance — relevant, representative, privacy-preserving", - "control_name": "Art. 10 — Data and data governance", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data governance policy covering the full AI data lifecycle is an Art. 10 compliance requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Human oversight mechanisms effective against rogue behaviour", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI — ability to pause and stop", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI actions", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Ingestion integrity risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Data ingestion attack surfaces included in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Labelling vendors are part of the AI value chain — obligations distributed accordingly", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "LLM gateway risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Mandatory risk management system for high-risk AI", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Absence of a documented risk management system is an Art. 9 violation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Meaningful human oversight over high-risk AI system outputs", - "control_name": "Art. 14 — Human oversight", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agents whose goals can be hijacked and execute autonomously are an Art. 14 failure — human confirmation required before goal-changing actions" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Operational continuity procedures documented", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Post-market monitoring and incident response for availability failures required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Organisations deploying AI are responsible for AI used within their operations", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Data governance policy covering the full AI data lifecycle is an Art. 10 compliance requirement" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Output handling risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Insecure output handling included in risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering AI infrastructure components", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Anonymisation effectiveness is an Art. 10 data governance requirement, not a self-certification" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vector store security monitoring in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering availability and resilience", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Session isolation controls are an Art. 10 data governance obligation for multi-user deployments" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering code execution incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Code execution anomaly response in quality management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering context window exploitation incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement" + }, { "id": "DSGAI15", "name": "Over-Broad Context Windows", @@ -9732,207 +8484,130 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Context window security in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering rogue agent detection", - "control_name": "Art. 17 — Quality management", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Behavioural monitoring in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring covering security incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Model extraction detection in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring detecting and responding to session bleed incidents", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Cross-session leakage detection in post-market monitoring programme" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Post-market monitoring for memory integrity", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory anomaly detection in post-market monitoring programme" + "notes": "RAG corpus integrity controls and source verification are Art. 10 requirements" } ] }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring required — but the monitoring infrastructure must itself be secured", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 13", + "control_name": "Transparency", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Providers document obligations flowing to deployers; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Disclosure of potential data disclosure risks is a transparency obligation" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool data exchange obligations explicitly distributed along the value chain" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Providers document obligations; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Hallucination rates and accuracy limitations must be disclosed to deployers and users" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool and MCP server supply chain obligations distributed along value chain" + "notes": "Agents must clearly communicate their AI nature and advisory limitations" } ] }, { "framework": "EU AI Act", - "control_id": "Providers of high-risk AI must implement a risk management system covering all reasonably foreseeable risks", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 14", + "control_name": "Human oversight", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Providers of systemic risk GPAI models must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI", - "entries": [ + "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Quality management includes supply chain controls", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Agents whose goals can be hijacked and execute autonomously are an Art. 14 failure — human confirmation required before goal-changing actions" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Documented supply chain security procedures — component verification, change management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Quality management must cover supply chain controls", - "control_name": "Art. 17 — Quality management", - "entries": [ + "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Documented supply chain security procedures required" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Responsibilities distributed along the AI value chain between providers and deployers", - "control_name": "Art. 25 — Value chain responsibilities", - "entries": [ + "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Providers must document what deployers inherit — deployers must verify" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Rogue agent scenarios identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness" + }, { "id": "ASI10", "name": "Rogue Agents", @@ -9940,136 +8615,78 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Shadow AI usage is a foreseeable risk requiring mitigation in the risk management system", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Supply chain risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope" + "notes": "Users must be able to pause and override endpoint AI agents — Art. 14 human oversight requirement" } ] }, { "framework": "EU AI Act", - "control_id": "Supply chain risks must be identified and mitigated in the risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Third-party component risks are in scope for Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must assess and mitigate risks including disinformation", - "control_name": "Art. 55(1)(a) — Systemic risk GPAI", - "entries": [ + "notes": "Robustness against prompt injection is a technical compliance requirement — not optional" + }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Misinformation risk assessment and mitigation is a binding obligation for systemic risk models" + "notes": "Technical robustness against poisoning is a binding Art. 15 requirement" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Disinformation risk assessment and RAG integrity controls are binding Art. 55 obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", - "entries": [ - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify model-level risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", - "entries": [ + "notes": "Technical resilience against denial-of-service attacks is an Art. 15 requirement" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Poisoning detection is in scope for Art. 55 adversarial testing" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical documentation covers all input modalities processed by the model", - "control_name": "Art. 53(1)(a) — GPAI documentation", - "entries": [ + "notes": "Embedding manipulation resistance is an Art. 15 technical requirement" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Multimodal data governance documented in GPAI technical documentation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + "notes": "Output validation and sanitisation are Art. 15 technical requirements" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -10078,14 +8695,34 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Input filtering, goal-state verification, and injection detection are Art. 15 technical requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial memory manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -10094,14 +8731,16 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Memory integrity monitoring and access controls are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against cascading failures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems" + }, { "id": "ASI08", "name": "Cascading Agent Failures", @@ -10110,237 +8749,139 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers, fail-safe defaults, and cascade containment architecture are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical resilience against rogue agent behaviour", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial code execution", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", - "entries": [ + "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Embedding manipulation resistance is an Art. 15 technical requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Third-party tool data exchange risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All tool integrations assessed in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Tool misuse risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Short-lived credentials, NHI inventory, and access controls are Art. 15 requirements" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training and retrieval data free from errors — source integrity required", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "RAG corpus integrity controls and source verification are Art. 10 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data for high-risk AI must be relevant, representative, free of errors, and complete — must address privacy", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data governance includes human annotation workflows", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Session isolation and tenant separation are Art. 15 technical requirements" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be relevant, representative, and subject to appropriate privacy measures", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate data governance — privacy measures must be effective", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Anonymisation effectiveness is an Art. 10 data governance requirement, not a self-certification" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Data quality controls preventing poisoning are a compliance requirement" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data must be subject to governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Training data privacy measures required — protecting sensitive data used in training", - "control_name": "Art. 10 — Data and data governance", - "entries": [ + "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Users informed of capabilities, limitations, and AI nature", - "control_name": "Art. 13 — Transparency", - "entries": [ + "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agents must clearly communicate their AI nature and advisory limitations" + "notes": "Source trust scoring and ingestion validation are Art. 15 robustness requirements" } ] }, { "framework": "EU AI Act", - "control_id": "Users must receive information about capabilities, limitations, and conditions of use", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 17", + "control_name": "Quality management", "entries": [ { "id": "LLM02", @@ -10349,47 +8890,26 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Disclosure of potential data disclosure risks is a transparency obligation" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Users must receive sufficient information about the AI system — but this does not require disclosing system prompts", - "control_name": "Art. 13 — Transparency", - "entries": [ + "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content" - } - ] - }, - { - "framework": "EU AI Act", - "control_id": "Vector store security risks identified and mitigated", - "control_name": "Art. 9 — Risk management", - "entries": [ + "notes": "Documented supply chain security procedures required" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All vector store deployments assessed in Art. 9 risk management" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-I-C1-M1.1", - "control_name": "Drawing up and maintaining model documentation", - "entries": [ + "notes": "Post-market monitoring and incident response for availability failures required" + }, { "id": "LLM08", "name": "Hidden Context Exposure", @@ -10397,23 +8917,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-I-C1-M1.2", - "control_name": "Providing information to downstream providers and AI Office", - "entries": [ + "notes": "System prompt versions, access controls, and change procedures are quality management artefacts" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Post-market monitoring of output handling incidents required" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment" }, { "id": "ASI04", @@ -10422,50 +8944,52 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Documented supply chain security procedures — component verification, change management" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Code execution anomaly response in quality management system" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-I-C1-M1.3", - "control_name": "Quality, integrity, and security of information", - "entries": [ + "notes": "Memory anomaly detection in post-market monitoring programme" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "A2A authentication and encryption documented in quality management system" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Behavioural monitoring in post-market monitoring programme" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent identity governance procedures documented in quality management system" }, { "id": "DSGAI05", @@ -10474,15 +8998,8 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-II-C1-M1.1", - "control_name": "Copyright policy", - "entries": [ + "notes": "Ingestion validation procedures and CVE patching documented in quality management" + }, { "id": "DSGAI07", "name": "Data Governance and Lifecycle", @@ -10490,80 +9007,86 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data lifecycle procedures — classification, retention, deletion — documented in quality management" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-II-C1-M1.2", - "control_name": "Lawful access to copyright-protected content", - "entries": [ + "notes": "Absence of a quality management system is an Art. 17 violation" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Cross-session leakage detection in post-market monitoring programme" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Security testing procedures and query log retention documented in quality management" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-II-C1-M1.4", - "control_name": "Copyright-infringing output mitigation", - "entries": [ + "notes": "Vector store security monitoring in post-market monitoring programme" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.1", - "control_name": "Creating the safety and security framework", - "entries": [ + "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Context window security in post-market monitoring programme" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Model extraction detection in post-market monitoring programme" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.2", - "control_name": "Implementing the framework", + "framework": "EU AI Act", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "entries": [ { "id": "LLM04", @@ -10572,7 +9095,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Providers must document what deployers inherit — deployers must verify" }, { "id": "ASI04", @@ -10581,16 +9104,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent tool and MCP server supply chain obligations distributed along value chain" }, { "id": "DSGAI03", @@ -10599,98 +9113,66 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Tool data exchange obligations explicitly distributed along the value chain" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.3", - "control_name": "Updating the framework", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C1-M1.4", - "control_name": "Framework notifications to AI Office", + "framework": "EU AI Act", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C10-M10.1", - "control_name": "Implementation documentation", - "entries": [ + "notes": "Deployers cannot waive Art. 14 human oversight requirements" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Deployers responsible for ensuring endpoint AI agents operate within Art. 14 human oversight scope" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C10-M10.2", - "control_name": "Public transparency", + "framework": "EU AI Act", + "control_id": "Art. 50", + "control_name": "Transparency for certain AI systems", "entries": [ { "id": "LLM07", @@ -10699,7 +9181,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Mandatory AI disclosure prevents users from treating hallucinated content as authoritative human output" }, { "id": "ASI09", @@ -10708,206 +9190,193 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All agent-user interactions require AI disclosure — universal obligation" }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Disinformation risk amplified when users cannot distinguish AI-generated content — Art. 50 applies" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C2-M2.1", - "control_name": "Systemic risk identification process", + "framework": "EU AI Act", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Third-party training data provenance is a GPAI documentation obligation" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Tool and plugin data exchange documented in GPAI technical documentation" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Full data governance documentation for GPAI training data is a binding Art. 53 obligation" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Multimodal data governance documented in GPAI technical documentation" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Synthetic data generation methodology and re-identification risk assessment documented for GPAI" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C2-M2.2", - "control_name": "Systemic risk scenarios", + "framework": "EU AI Act", + "control_id": "Art. 53(1)(b)", + "control_name": "GPAI transparency", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, + "notes": "Published summaries must not inadvertently expose security-sensitive configuration" + } + ] + }, + { + "framework": "EU AI Act", + "control_id": "Art. 55(1)(a)", + "control_name": "Systemic risk GPAI", + "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Misinformation risk assessment and mitigation is a binding obligation for systemic risk models" }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Disinformation risk assessment and RAG integrity controls are binding Art. 55 obligations" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.1", - "control_name": "Model-independent information gathering", + "framework": "EU AI Act", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Poisoning detection is in scope for Art. 55 adversarial testing" }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" - }, + "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models" + } + ] + }, + { + "framework": "EU AI Act", + "control_id": "Art. 72", + "control_name": "Fines", + "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Understanding fine exposure is the starting point for compliance prioritisation" } ] }, { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.2", - "control_name": "Model evaluations", + "framework": "EU AI Act", + "control_id": "Art. 9", + "control_name": "Risk management", "entries": [ { "id": "LLM01", @@ -10916,69 +9385,62 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Excessive agency scenarios required in risk management system" }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Third-party component risks are in scope for Art. 9 risk management" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Poisoning attack scenarios required in Art. 9 risk assessment" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Resource exhaustion and DoS scenarios included in risk management system" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Vector store attack scenarios included in risk management system" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.3", - "control_name": "Systemic risk modelling", - "entries": [ + "notes": "Insecure output handling included in risk management system" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -10986,109 +9448,52 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent goal hijack included in Art. 9 risk assessment for every agentic deployment" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.4", - "control_name": "Systemic risk estimation", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C3-M3.5", - "control_name": "Post-market monitoring and external evaluation", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C4-M4.1", - "control_name": "Risk acceptance criteria and tiers", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status" }, { "id": "ASI08", @@ -11097,102 +9502,61 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C4-M4.2", - "control_name": "Market placement decisions", - "entries": [ + "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds" + }, { "id": "ASI10", "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C5-M5.1", - "control_name": "Safety mitigation implementation", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Agent credential lifecycle included in Art. 9 risk management system" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Data ingestion attack surfaces included in Art. 9 risk management" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All tool integrations assessed in Art. 9 risk management" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Absence of a documented risk management system is an Art. 9 violation" }, { "id": "DSGAI12", @@ -11201,63 +9565,70 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "All vector store deployments assessed in Art. 9 risk management" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DRAFT — SME review required" + "notes": "Browser and endpoint agent deployments assessed in Art. 9 risk management" } ] }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C6-M6.1", - "control_name": "Security goal and threat actor definition", + "control_id": "CoP-I-C1-M1.1", + "control_name": "Drawing up and maintaining model documentation", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-I-C1-M1.2", + "control_name": "Providing information to downstream providers and AI Office", + "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11265,8 +9636,8 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11277,8 +9648,8 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C6-M6.2", - "control_name": "Security mitigation implementation", + "control_id": "CoP-I-C1-M1.3", + "control_name": "Quality, integrity, and security of information", "entries": [ { "id": "LLM02", @@ -11299,80 +9670,90 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-II-C1-M1.1", + "control_name": "Copyright policy", + "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-II-C1-M1.2", + "control_name": "Lawful access to copyright-protected content", + "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-II-C1-M1.4", + "control_name": "Copyright-infringing output mitigation", + "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C1-M1.1", + "control_name": "Creating the safety and security framework", + "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11383,12 +9764,12 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.1", - "control_name": "Model description and behaviour documentation", + "control_id": "CoP-III-C1-M1.2", + "control_name": "Implementing the framework", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", @@ -11396,26 +9777,35 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11423,8 +9813,8 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11432,8 +9822,8 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11444,14 +9834,14 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.2", - "control_name": "Risk justification for market placement", + "control_id": "CoP-III-C1-M1.3", + "control_name": "Updating the framework", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" @@ -11460,23 +9850,30 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.3", - "control_name": "Systemic risk documentation", + "control_id": "CoP-III-C1-M1.4", + "control_name": "Framework notifications to AI Office", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - }, + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C10-M10.1", + "control_name": "Implementation documentation", + "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" @@ -11494,21 +9891,21 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C7-M7.5", - "control_name": "Material changes to risk landscape", + "control_id": "CoP-III-C10-M10.2", + "control_name": "Public transparency", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", @@ -11516,10 +9913,10 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" @@ -11528,81 +9925,67 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C8-M8.1", - "control_name": "Clear responsibility definition", + "control_id": "CoP-III-C2-M2.1", + "control_name": "Systemic risk identification process", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C8-M8.2", - "control_name": "Resource allocation", - "entries": [ + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C8-M8.3", - "control_name": "Organizational risk culture", - "entries": [ + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", @@ -11612,48 +9995,30 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C9-M9.1", - "control_name": "Incident tracking and documentation", + "control_id": "CoP-III-C2-M2.2", + "control_name": "Systemic risk scenarios", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DRAFT — SME review required" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11661,8 +10026,8 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11670,8 +10035,8 @@ window.CROSSWALK_BACKLINKS = [ "notes": "DRAFT — SME review required" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -11682,94 +10047,87 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C9-M9.2", - "control_name": "Incident reporting to authorities", + "control_id": "CoP-III-C3-M3.1", + "control_name": "Model-independent information gathering", "entries": [ { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" - } - ] - }, - { - "framework": "EU AI Act Code of Practice", - "control_id": "CoP-III-C9-M9.3", - "control_name": "Corrective actions", - "entries": [ + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AC-3", - "control_name": "Access Enforcement — model endpoint access", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.2", + "control_name": "Model evaluations", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce role-based access control on model inference endpoints; restrict access to training data, fine-tuning data, and model configuration based on clearance and need-to-know" - }, - { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce access control on all AI tool invocations; require authorisation for each tool call based on agent identity, context, and action type" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Restrict access to system prompt configurations to authorised personnel; enforce role-based access control and change management on all prompt modifications" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Enforce role-based access control on vector database operations; restrict who can read, write, and delete embeddings" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "LLM10", @@ -11778,7 +10136,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce least-privilege service accounts on every consumer of model output so unvalidated content cannot reach a high-privilege operation" + "notes": "DRAFT — SME review required" }, { "id": "ASI02", @@ -11786,114 +10144,144 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce role-based access control on all agent resources — tools, data stores, APIs, and inter-agent communication channels; deny by default" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Enforce access control at every tool invocation boundary; validate agent identity and authorisation for each requested action regardless of calling context" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce access control at each tool invocation independently; re-evaluate authorisation at every step in a tool chain regardless of prior approvals" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce authenticated, authorised access to all AI data stores; deny unauthenticated access; log all access decisions" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access control preventing data transfer to unauthorised AI tools; monitor and block shadow AI usage" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.3", + "control_name": "Systemic risk modelling", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce role-based access control on all AI data stores; restrict access based on clearance, need-to-know, and data sensitivity" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce strict access control on AI intellectual property; restrict to minimum necessary personnel with audit trail" - }, + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.4", + "control_name": "Systemic risk estimation", + "entries": [ { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access controls aligned with data ownership; restrict usage based on ownership rights and licence terms" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce purpose-limitation on AI data access; restrict usage to approved purposes documented in data processing agreements" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C3-M3.5", + "control_name": "Post-market monitoring and external evaluation", + "entries": [ + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access controls aligned with consent status; block AI processing on data where consent has been withdrawn" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce access controls that account for inference and aggregation risk; restrict access based on combined sensitivity" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Implement access controls mandated by applicable data laws; enforce data subject rights, purpose limitation, and processing restrictions" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AC-6", - "control_name": "Least Privilege — AI agent permissions", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C4-M4.1", + "control_name": "Risk acceptance criteria and tiers", "entries": [ { "id": "LLM03", @@ -11901,103 +10289,58 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Enforce least privilege for all AI agent tool access, API permissions, and autonomous action scope; restrict to minimum capabilities needed per deployment" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Enforce least privilege for all agent permissions; restrict tool access, data store access, and API scope to minimum necessary per agent role" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Enforce least privilege with explicit privilege ceilings per agent; prevent accumulation of permissions through tool chaining or inter-agent delegation" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Enforce least privilege across tool chains; prevent agents from combining tool invocations that individually are safe but together achieve harmful outcomes" - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Restrict data aggregation scope to minimum necessary; enforce controls preventing combination of datasets that create higher-sensitivity aggregates" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Restrict AI data collection to minimum necessary for stated purpose; enforce at pipeline ingestion points" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AU-12", - "control_name": "Audit Generation — inference audit trail", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C4-M4.2", + "control_name": "Market placement decisions", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Generate audit records for all model inference requests with sufficient detail for compliance and incident investigation" - }, - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Generate audit records for all access to AI intellectual property; enable detection of unauthorised access and exfiltration" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AU-2", - "control_name": "Event Logging — AI inference logging", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C5-M5.1", + "control_name": "Safety mitigation implementation", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log all model inference requests and responses with sufficient detail to detect sensitive data disclosure; include user identity, query content, and response metadata" + "notes": "DRAFT — SME review required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Log inference interactions with sufficient detail to detect system prompt extraction attempts; alert on query patterns indicative of extraction techniques" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "LLM10", @@ -12006,7 +10349,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Log model output crossing into privileged systems, including the payload, the consuming component, and the validation verdict, for incident reconstruction" + "notes": "DRAFT — SME review required" }, { "id": "ASI01", @@ -12015,70 +10358,43 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log all agent actions, goal interpretations, tool invocations, and decision points with sufficient detail to detect goal hijacking in post-incident analysis" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Log all agent access decisions — permitted and denied — with sufficient detail for access control review and incident investigation" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Log all agent memory operations — reads, writes, deletions — with sufficient detail to detect poisoning and support forensic investigation" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Log complete tool chain sequences with full context; enable detection and forensic analysis of harmful tool combination patterns" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log all access to AI training data, model weights, inference inputs and outputs, and configuration; include user/service identity, timestamp, and access type" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log data movement through AI pipelines — ingestion, transformation, training, inference; enable end-to-end data flow traceability" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Log all data transformation events in AI pipelines; enable end-to-end lineage reconstruction from source to model" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Log AI data access and model outputs with sufficient detail to detect data leakage; include output content metadata" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI12", @@ -12087,25 +10403,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Log data usage for ownership compliance; track how data is used across AI systems for licence and rights management" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Log all data operations with purpose context; enable detection of purpose drift and unauthorised usage" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Log consent status and changes; enable audit of consent compliance for all AI data processing activities" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI21", @@ -12114,143 +10421,129 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Maintain comprehensive logs for regulatory compliance evidence; ensure audit trails meet requirements of applicable data laws" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "AU-6", - "control_name": "Audit Review — AI behaviour review", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C6-M6.1", + "control_name": "Security goal and threat actor definition", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Regularly review AI inference logs and output samples for hallucination patterns, factual errors, and misleading content; escalate findings through security channels" + "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Conduct regular audit review of agent decision logs; identify patterns indicative of unexpected capabilities or emergent behaviours requiring security assessment" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "CA-7", - "control_name": "Continuous Monitoring — model drift detection", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include model output quality and drift monitoring in FedRAMP continuous monitoring programme; track accuracy metrics, hallucination rates, and output consistency over time" + "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include monitoring for novel agentic behaviour patterns in FedRAMP continuous monitoring; track for unexpected capabilities, emergent behaviours, and architectural drift" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include synthetic data quality metrics in continuous monitoring; track for privacy degradation and bias drift" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include bias and fairness metrics in continuous monitoring; track output equity over time" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "CA-8", - "control_name": "Penetration Testing — AI adversarial testing", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C6-M6.2", + "control_name": "Security mitigation implementation", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include prompt injection scenarios in penetration testing engagements; cover direct, indirect, and multimodal injection paths" + "notes": "DRAFT — SME review required" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include agent goal hijacking in penetration testing scope; cover injection through all input channels — user prompts, tool outputs, memory stores, and inter-agent communication" + "notes": "DRAFT — SME review required" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include agent code execution sandbox escape in penetration testing scope; test boundary integrity under adversarial conditions" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "CM-3", - "control_name": "Configuration Change Control — model update governance", - "entries": [ + "notes": "DRAFT — SME review required" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Require formal change control for all model updates, fine-tuning runs, and training data changes; maintain audit trail of all modifications" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Document and control changes to AI data pipeline configurations; maintain current data flow diagrams and processing documentation" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Require formal change control for all data source additions, modifications, and removals; maintain audit trail" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI06", @@ -12258,8 +10551,8 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Maintain comprehensive data lineage documentation for all AI pipelines; update on every transformation, combination, or processing change" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "DSGAI11", @@ -12268,16 +10561,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Define and enforce data retention policies for all AI data; implement automated deletion schedules; log policy changes" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Maintain AI governance policies under change control; require approval for policy modifications; audit all changes" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI20", @@ -12286,77 +10579,59 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Maintain documentation of AI data storage locations; require change control for data location modifications" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "CM-7", - "control_name": "Least Functionality — AI capability restrictions", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.1", + "control_name": "Model description and behaviour documentation", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Restrict AI systems to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in configuration" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrict AI services to defined resource budgets; disable unnecessary model capabilities; enforce compute and cost limits in configuration" + "notes": "DRAFT — SME review required" }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Remove interpreter, shell, and dynamic-evaluation paths from components that consume model output; disable any capability the consumer does not require" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Restrict agents to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in agent configuration" + "notes": "DRAFT — SME review required" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrict agent code execution to minimum necessary scope; enforce sandbox boundaries, disable unnecessary language features, and limit filesystem and network access" + "notes": "DRAFT — SME review required" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Restrict permitted tool combinations; define allowed tool chains in configuration and deny undefined sequences" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrict AI tool usage to approved, vetted tools within the FedRAMP boundary; disable or block access to unauthorised AI services" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI15", @@ -12364,137 +10639,49 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Restrict AI data processing to minimum necessary scope; disable collection of non-essential data fields" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "IA-2", - "control_name": "Identification and Authentication — agent NHI", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Assign unique non-human identities to each AI agent; authenticate agent identity at each tool invocation and inter-agent communication boundary" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "IR-4", - "control_name": "Incident Handling — consumption incident response", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.2", + "control_name": "Risk justification for market placement", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Define incident handling procedures for AI consumption anomalies including automatic throttling, service suspension, and cost cap enforcement" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Define incident handling procedures for agent privilege escalation events; include automated containment, privilege revocation, and forensic investigation" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Define incident handling procedures for cascading agent failures; include automated circuit breakers, agent isolation, and multi-agent system shutdown procedures" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Define incident handling procedures for agent dependency failures; include automated fallback activation, graceful degradation, and service restoration" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "PM-9", - "control_name": "Risk Management Strategy — AI autonomy risk", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.3", + "control_name": "Systemic risk documentation", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Include AI autonomy and excessive agency in the organisational risk management strategy; define acceptable autonomy thresholds and escalation procedures" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Include cascading automation risk in the organisational risk management strategy; define acceptable multi-agent coupling thresholds and circuit breaker requirements" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data visibility and transparency requirements in AI risk management strategy; define what data flows must be documented and monitored" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Include data lineage completeness in AI risk management strategy; define minimum lineage requirements per data sensitivity level" - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data aggregation risk in AI risk management strategy; assess combined sensitivity of aggregated datasets" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include data retention risk in AI risk management; define retention periods per data type and regulatory requirement" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Define data ownership policies for AI data; clarify rights and responsibilities for training data, outputs, and derived insights" + "notes": "DRAFT — SME review required" }, { "id": "DSGAI14", @@ -12503,129 +10690,186 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include consent management in AI risk management strategy; define consent requirements per data type and processing activity" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C7-M7.5", + "control_name": "Material changes to risk landscape", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include data minimisation in AI risk management; define minimum necessary data per AI use case" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include AI privacy erosion in risk management; assess inference, aggregation, and memorisation risks for AI systems" + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C8-M8.1", + "control_name": "Clear responsibility definition", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Establish comprehensive AI data governance framework within risk management strategy; define roles, policies, and oversight mechanisms" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include data localisation in AI risk management; define data residency requirements per jurisdiction and data type" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Include regulatory compliance in AI risk management; map applicable data laws to AI processing activities and define compliance requirements" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "RA-3", - "control_name": "Risk Assessment — governance completeness", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C8-M8.2", + "control_name": "Resource allocation", "entries": [ { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Assess AI governance completeness; identify gaps in roles, policies, oversight, and accountability" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + } + ] + }, + { + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C8-M8.3", + "control_name": "Organizational risk culture", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Conduct regulatory compliance gap analysis for AI systems; identify areas of non-compliance and define remediation plans" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "RA-5", - "control_name": "Vulnerability Scanning — AI red-teaming", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C9-M9.1", + "control_name": "Incident tracking and documentation", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include prompt injection vectors in vulnerability scanning programme; conduct regular automated and manual injection testing" + "notes": "DRAFT — SME review required" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include vector databases, embedding pipelines, and retrieval infrastructure in vulnerability scanning; test for injection, access control bypass, and data extraction" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Include agent memory stores, context databases, and shared state infrastructure in vulnerability scanning and security assessment" + "notes": "DRAFT — SME review required" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "DRAFT — SME review required" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include emerging agentic attack surfaces in vulnerability scanning; assess novel architectures for security implications before production deployment" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Include synthetic data re-identification and pattern leakage in vulnerability assessment" + "scope": "Both", + "notes": "DRAFT — SME review required" }, { "id": "DSGAI17", @@ -12634,91 +10878,64 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include bias detection and fairness assessment in vulnerability scanning; test for disparate impact" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "SA-3", - "control_name": "System Development Life Cycle — AI SDLC", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C9-M9.2", + "control_name": "Incident reporting to authorities", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Integrate AI-specific security activities into the SDLC — model security review, adversarial testing, supply chain verification at each lifecycle phase" + "notes": "DRAFT — SME review required" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrate agent-specific security activities into the SDLC — tool integration review, privilege analysis, and adversarial testing at each lifecycle phase" + "notes": "DRAFT — SME review required" } ] }, { - "framework": "FedRAMP", - "control_id": "SA-9", - "control_name": "External Information System Services — third-party AI", + "framework": "EU AI Act Code of Practice", + "control_id": "CoP-III-C9-M9.3", + "control_name": "Corrective actions", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Require third-party AI service providers to meet FedRAMP requirements; establish SLAs covering model security, data handling, and incident notification" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Require third-party agent tool and plugin providers to meet FedRAMP requirements; establish SLAs for security, availability, and incident notification" - }, - { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Require SLAs from agent dependency providers covering availability, performance, security, and incident notification; establish fallback procedures" + "notes": "DRAFT — SME review required" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Require FedRAMP authorisation or equivalent for all third-party AI services; block data transfer to unauthorised AI tools" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Require FedRAMP authorisation for third-party data service providers; establish SLAs covering data security, privacy, and incident notification" + "notes": "DRAFT — SME review required" } ] }, { "framework": "FedRAMP", - "control_id": "SC-28", - "control_name": "Protection of Information at Rest — training data and model weights", + "control_id": "AC-3", + "control_name": "Access Enforcement — model endpoint access", "entries": [ { "id": "LLM02", @@ -12727,7 +10944,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt training data, fine-tuning datasets, and model weights at rest; prevent data memorisation exposure through access controls on data stores" + "notes": "Enforce role-based access control on model inference endpoints; restrict access to training data, fine-tuning data, and model configuration based on clearance and need-to-know" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Enforce access control on all AI tool invocations; require authorisation for each tool call based on agent identity, context, and action type" }, { "id": "LLM08", @@ -12736,7 +10962,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Classify system prompts as sensitive configuration; encrypt at rest, enforce access controls, and apply version control and audit logging to all prompt stores" + "notes": "Restrict access to system prompt configurations to authorised personnel; enforce role-based access control and change management on all prompt modifications" }, { "id": "LLM09", @@ -12745,267 +10971,217 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Foundational", "scope": "Build", - "notes": "Encrypt vector databases and embedding stores at rest; enforce access controls and audit logging on all embedding read and write operations" + "notes": "Enforce role-based access control on vector database operations; restrict who can read, write, and delete embeddings" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt agent memory stores and context databases at rest; enforce access controls and integrity verification on all memory read and write operations" + "notes": "Enforce least-privilege service accounts on every consumer of model output so unvalidated content cannot reach a high-privilege operation" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Encrypt all training data, model weights, and pipeline artefacts at rest; enforce key management per FedRAMP requirements" + "scope": "Build", + "notes": "Enforce role-based access control on all agent resources — tools, data stores, APIs, and inter-agent communication channels; deny by default" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt all AI data at rest — training data, model weights, inference logs, embedding stores — using FIPS 140-validated modules" + "notes": "Enforce access control at every tool invocation boundary; validate agent identity and authorisation for each requested action regardless of calling context" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Encrypt all intellectual property — model weights, proprietary training data, algorithms — at rest with FIPS 140-validated modules" + "scope": "Build", + "notes": "Enforce access control at each tool invocation independently; re-evaluate authorisation at every step in a tool chain regardless of prior approvals" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt all retained AI data; implement crypto-shredding capability for secure deletion" + "notes": "Enforce authenticated, authorised access to all AI data stores; deny unauthenticated access; log all access decisions" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Encrypt AI data at rest; implement privacy-preserving storage techniques to prevent inference and re-identification" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "SC-7", - "control_name": "Boundary Protection — rate limiting and cost controls", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce rate limiting, token quotas, and cost circuit breakers at the AI service boundary; define per-user and per-session consumption limits" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce strict boundary protection on agent code execution environments; isolate from production systems, restrict network access, and enforce resource limits" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforce boundary protection between agents in multi-agent systems; prevent uncontrolled propagation of failures or attacks across agent boundaries" + "notes": "Enforce access control preventing data transfer to unauthorised AI tools; monitor and block shadow AI usage" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce boundary protection on data flows between systems; prevent uncontrolled data aggregation across security boundaries" + "notes": "Enforce role-based access control on all AI data stores; restrict access based on clearance, need-to-know, and data sensitivity" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce data flow controls preventing AI data from crossing jurisdictional boundaries; restrict to approved data centres and regions" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "SI-10", - "control_name": "Information Input Validation — prompt validation", - "entries": [ + "notes": "Enforce strict access control on AI intellectual property; restrict to minimum necessary personnel with audit trail" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Validate all inputs to LLM inference endpoints; enforce structural separation between instruction and data contexts; reject known injection patterns" + "notes": "Enforce access controls aligned with data ownership; restrict usage based on ownership rights and licence terms" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate retrieval sources and grounding data provided to the model; ensure factual grounding sources are authoritative and current" + "notes": "Enforce purpose-limitation on AI data access; restrict usage to approved purposes documented in data processing agreements" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate model output at every consuming boundary; the consumer treats generated content as untrusted input and applies syntactic and schema validation before acting on it" + "notes": "Enforce access controls aligned with consent status; block AI processing on data where consent has been withdrawn" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate all inputs to agent systems including user prompts, tool outputs, memory retrievals, and inter-agent messages; enforce structural separation of instructions and data" + "notes": "Enforce access controls that account for inference and aggregation risk; restrict access based on combined sensitivity" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate quality, completeness, and accuracy of data entering AI pipelines; reject data failing quality thresholds" + "notes": "Implement access controls mandated by applicable data laws; enforce data subject rights, purpose limitation, and processing restrictions" } ] }, { "framework": "FedRAMP", - "control_id": "SI-15", - "control_name": "Information Output Filtering — model response filtering", + "control_id": "AC-6", + "control_name": "Least Privilege — AI agent permissions", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Filter and encode model responses before release to a renderer, interpreter, or downstream service; reject content that fails the boundary content-type policy" - } - ] - }, - { - "framework": "FedRAMP", - "control_id": "SI-3", - "control_name": "Malicious Code Protection — adversarial AI inputs", - "entries": [ + "scope": "Build", + "notes": "Enforce least privilege for all AI agent tool access, API permissions, and autonomous action scope; restrict to minimum capabilities needed per deployment" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Extend malicious code protection to detect and block adversarial inputs including direct and indirect prompt injection payloads" + "scope": "Build", + "notes": "Enforce least privilege for all agent permissions; restrict tool access, data store access, and API scope to minimum necessary per agent role" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious code protection to training data pipelines; detect and block poisoned data, anomalous labels, and backdoor triggers" + "notes": "Enforce least privilege with explicit privilege ceilings per agent; prevent accumulation of permissions through tool chaining or inter-agent delegation" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Deploy output monitoring to detect and block responses containing system prompt content; treat extraction as a security event" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Extend malicious code protection to detect adversarial manipulation of embeddings — poisoned vectors, out-of-distribution injections, and embedding inversion attacks" + "notes": "Enforce least privilege across tool chains; prevent agents from combining tool invocations that individually are safe but together achieve harmful outcomes" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious code protection to detect and block adversarial inputs targeting agent goal manipulation including injection through tool outputs and context stores" + "notes": "Restrict data aggregation scope to minimum necessary; enforce controls preventing combination of datasets that create higher-sensitivity aggregates" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Scan agent-generated code for malicious patterns before execution; detect and block code that attempts filesystem access, network communication, or privilege escalation" - }, + "scope": "Build", + "notes": "Restrict AI data collection to minimum necessary for stated purpose; enforce at pipeline ingestion points" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "AU-12", + "control_name": "Audit Generation — inference audit trail", + "entries": [ { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious content detection to agent memory stores; detect poisoned memories, manipulated context, and adversarial state modifications" + "notes": "Generate audit records for all model inference requests with sufficient detail for compliance and incident investigation" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Extend malicious code protection to training data and model artefacts; detect poisoned data, anomalous patterns, and backdoor indicators" + "notes": "Generate audit records for all access to AI intellectual property; enable detection of unauthorised access and exfiltration" } ] }, { "framework": "FedRAMP", - "control_id": "SI-4", - "control_name": "System Monitoring — output content monitoring", + "control_id": "AU-2", + "control_name": "Event Logging — AI inference logging", "entries": [ { "id": "LLM02", @@ -13014,52 +11190,88 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor model outputs for sensitive data patterns — PII, credentials, classification markings — and alert on detection" + "notes": "Log all model inference requests and responses with sufficient detail to detect sensitive data disclosure; include user identity, query content, and response metadata" }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Monitor AI service consumption metrics — tokens, latency, cost — in real time; alert and auto-mitigate on consumption anomalies" + "scope": "Build", + "notes": "Log inference interactions with sufficient detail to detect system prompt extraction attempts; alert on query patterns indicative of extraction techniques" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor model outputs for factual accuracy, consistency, and hallucination indicators; alert when confidence scores or factual grounding drops below thresholds" + "notes": "Log model output crossing into privileged systems, including the payload, the consuming component, and the validation verdict, for incident reconstruction" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Monitor multi-agent systems for cascade indicators — error propagation, resource exhaustion spreading, and anomalous inter-agent communication patterns" + "notes": "Log all agent actions, goal interpretations, tool invocations, and decision points with sufficient detail to detect goal hijacking in post-incident analysis" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Log all agent access decisions — permitted and denied — with sufficient detail for access control review and incident investigation" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor agent systems for unexpected behaviour — novel tool use patterns, unanticipated goal decomposition, and emergent inter-agent coordination" + "notes": "Log all agent memory operations — reads, writes, deletions — with sufficient detail to detect poisoning and support forensic investigation" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Log complete tool chain sequences with full context; enable detection and forensic analysis of harmful tool combination patterns" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures" + "notes": "Log all access to AI training data, model weights, inference inputs and outputs, and configuration; include user/service identity, timestamp, and access type" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Log data movement through AI pipelines — ingestion, transformation, training, inference; enable end-to-end data flow traceability" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Log all data transformation events in AI pipelines; enable end-to-end lineage reconstruction from source to model" }, { "id": "DSGAI08", @@ -13068,16 +11280,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor model outputs and data access patterns for leakage indicators — PII, credentials, classification markings in outputs; alert on detection" + "notes": "Log AI data access and model outputs with sufficient detail to detect data leakage; include output content metadata" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Monitor synthetic data outputs for quality, privacy preservation, and absence of sensitive pattern leakage" + "scope": "Both", + "notes": "Log data usage for ownership compliance; track how data is used across AI systems for licence and rights management" }, { "id": "DSGAI13", @@ -13086,129 +11298,152 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor AI data usage patterns for misuse indicators; alert on data access inconsistent with approved purposes" + "notes": "Log all data operations with purpose context; enable detection of purpose drift and unauthorised usage" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor for privacy erosion indicators; detect inference capabilities, re-identification risk, and memorisation patterns" + "notes": "Log consent status and changes; enable audit of consent compliance for all AI data processing activities" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor AI outputs for bias indicators; track fairness metrics across demographic groups and use cases" + "notes": "Maintain comprehensive logs for regulatory compliance evidence; ensure audit trails meet requirements of applicable data laws" } ] }, { "framework": "FedRAMP", - "control_id": "SR-2", - "control_name": "Supply Chain Risk Management Plan — AI components", + "control_id": "AU-6", + "control_name": "Audit Review — AI behaviour review", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include all AI components — models, datasets, adapters, libraries, plugins — in the supply chain risk management plan with provenance and risk assessment" + "notes": "Regularly review AI inference logs and output samples for hallucination patterns, factual errors, and misleading content; escalate findings through security channels" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include AI training data sources, fine-tuning datasets, and pre-trained model weights in the supply chain risk management plan; document provenance and risk assessment for each" - }, + "notes": "Conduct regular audit review of agent decision logs; identify patterns indicative of unexpected capabilities or emergent behaviours requiring security assessment" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "CA-7", + "control_name": "Continuous Monitoring — model drift detection", + "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include all agent components — tools, plugins, MCP servers, model weights, and agent frameworks — in the supply chain risk management plan" + "notes": "Include model output quality and drift monitoring in FedRAMP continuous monitoring programme; track accuracy metrics, hallucination rates, and output consistency over time" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include all agent external dependencies — model APIs, tool endpoints, data sources — in supply chain risk management with availability and integrity requirements" + "notes": "Include monitoring for novel agentic behaviour patterns in FedRAMP continuous monitoring; track for unexpected capabilities, emergent behaviours, and architectural drift" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Include AI training data, model weights, and pipeline artefacts in supply chain risk management with provenance documentation" + "scope": "Build", + "notes": "Include synthetic data quality metrics in continuous monitoring; track for privacy degradation and bias drift" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Include third-party data providers in supply chain risk management; assess data handling practices and security posture" + "notes": "Include bias and fairness metrics in continuous monitoring; track output equity over time" } ] }, { "framework": "FedRAMP", - "control_id": "SR-3", - "control_name": "Supply Chain Controls — model provenance verification", + "control_id": "CA-8", + "control_name": "Penetration Testing — AI adversarial testing", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Implement integrity verification for all AI supply chain components using cryptographic signatures, checksums, and attestation before deployment" + "notes": "Include prompt injection scenarios in penetration testing engagements; cover direct, indirect, and multimodal injection paths" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Implement supply chain controls for AI model components — verify integrity, provenance, and authenticity of all training data and model weights before use" + "notes": "Include agent goal hijacking in penetration testing scope; cover injection through all input channels — user prompts, tool outputs, memory stores, and inter-agent communication" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify integrity and provenance of all agent supply chain components using cryptographic signatures, checksums, and attestation before deployment" + "notes": "Include agent code execution sandbox escape in penetration testing scope; test boundary integrity under adversarial conditions" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "CM-3", + "control_name": "Configuration Change Control — model update governance", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Require formal change control for all model updates, fine-tuning runs, and training data changes; maintain audit trail of all modifications" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify integrity and provenance of all AI artefacts using cryptographic signatures and checksums before use in any pipeline" + "notes": "Document and control changes to AI data pipeline configurations; maintain current data flow diagrams and processing documentation" }, { "id": "DSGAI05", @@ -13217,100 +11452,104 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Implement provenance tracking for all AI training data; document source, collection method, processing history, and licensing for each dataset" + "notes": "Require formal change control for all data source additions, modifications, and removals; maintain audit trail" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Maintain comprehensive data lineage documentation for all AI pipelines; update on every transformation, combination, or processing change" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify provenance and integrity of data from third-party sources; implement validation before ingestion into AI pipelines" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "Security management", - "control_name": "62443-2-1", - "entries": [ + "notes": "Define and enforce data retention policies for all AI data; implement automated deletion schedules; log policy changes" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT synthetic data governance policy — when synthetic data removes OT classification obligation" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "Security management system", - "control_name": "62443-2-1", - "entries": [ + "notes": "Maintain AI governance policies under change control; require approval for policy modifications; audit all changes" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT security management system updated to cover GenAI deployments — policy, roles, assessment" + "notes": "Maintain documentation of AI data storage locations; require change control for data location modifications" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.2", - "control_name": "Identification and authentication", + "framework": "FedRAMP", + "control_id": "CM-7", + "control_name": "Least Functionality — AI capability restrictions", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Restrict AI systems to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in configuration" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM access to OT data systems requires authenticated, authorised identity" + "notes": "Restrict AI services to defined resource budgets; disable unnecessary model capabilities; enforce compute and cost limits in configuration" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM actions in OT context authenticated as a distinct identity — traceable in OT audit log" + "notes": "Remove interpreter, shell, and dynamic-evaluation paths from components that consume model output; disable any capability the consumer does not require" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "All agent access to OT systems using distinct, traceable identity — not shared service accounts" + "scope": "Build", + "notes": "Restrict agents to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in agent configuration" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Access to GenAI systems in OT scope authenticated — each user with unique, traceable identity" + "notes": "Restrict agent code execution to minimum necessary scope; enforce sandbox boundaries, disable unnecessary language features, and limit filesystem and network access" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "All agent credentials unique and traceable — no shared service accounts for OT-accessing agents" + "scope": "Build", + "notes": "Restrict permitted tool combinations; define allowed tool chains in configuration and deny undefined sequences" }, { "id": "DSGAI03", @@ -13319,102 +11558,100 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Approved AI tools only on OT workstations — unapproved services blocked at network layer" + "notes": "Restrict AI tool usage to approved, vetted tools within the FedRAMP boundary; disable or block access to unauthorised AI services" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Access controls on all GenAI-derived OT data assets — same authentication requirements as source data" - }, + "scope": "Build", + "notes": "Restrict AI data processing to minimum necessary scope; disable collection of non-essential data fields" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "IA-2", + "control_name": "Identification and Authentication — agent NHI", + "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Per-operator session isolation — each operator's context inaccessible to all other sessions" - }, + "notes": "Assign unique non-human identities to each AI agent; authenticate agent identity at each tool invocation and inter-agent communication boundary" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "IR-4", + "control_name": "Incident Handling — consumption incident response", + "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "RBAC on all Zone 3 vector stores — no unauthenticated access in any OT environment" + "notes": "Define incident handling procedures for AI consumption anomalies including automatic throttling, service suspension, and cost cap enforcement" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Access controls on OT GenAI telemetry stores — need-to-know enforced" + "notes": "Define incident handling procedures for agent privilege escalation events; include automated containment, privilege revocation, and forensic investigation" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Approved extensions only on Zone 3 workstations — unapproved AI extensions blocked at device management" + "notes": "Define incident handling procedures for cascading agent failures; include automated circuit breakers, agent isolation, and multi-agent system shutdown procedures" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Authentication on all OT GenAI model inference APIs — unauthenticated systematic querying blocked" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.3", - "control_name": "Use of authenticators", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "All inter-agent messages authenticated — no ambient trust between agents in OT context" + "notes": "Define incident handling procedures for agent dependency failures; include automated fallback activation, graceful degradation, and service restoration" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.6", - "control_name": "Authenticator feedback", + "framework": "FedRAMP", + "control_id": "PM-9", + "control_name": "Risk Management Strategy — AI autonomy risk", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "LLM interactions logged with user identity — injection attempts attributable to specific sessions" + "scope": "Build", + "notes": "Include AI autonomy and excessive agency in the organisational risk management strategy; define acceptable autonomy thresholds and escalation procedures" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures" + "notes": "Include cascading automation risk in the organisational risk management strategy; define acceptable multi-agent coupling thresholds and circuit breaker requirements" }, { "id": "DSGAI02", @@ -13423,109 +11660,129 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credential lifecycle managed — issuance, rotation, revocation documented per agent" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 1.9", - "control_name": "Remote session termination", - "entries": [ + "notes": "Include data visibility and transparency requirements in AI risk management strategy; define what data flows must be documented and monitored" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Include data lineage completeness in AI risk management strategy; define minimum lineage requirements per data sensitivity level" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include data aggregation risk in AI risk management strategy; assess combined sensitivity of aggregated datasets" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include data retention risk in AI risk management; define retention periods per data type and regulatory requirement" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ability to terminate LLM sessions immediately on detection of suspicious behaviour" + "notes": "Define data ownership policies for AI data; clarify rights and responsibilities for training data, outputs, and derived insights" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include consent management in AI risk management strategy; define consent requirements per data type and processing activity" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Include data minimisation in AI risk management; define minimum necessary data per AI use case" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include AI privacy erosion in risk management; assess inference, aggregation, and memorisation risks for AI systems" }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM sessions with OT access can be locked and terminated immediately by operators" + "notes": "Establish comprehensive AI data governance framework within risk management strategy; define roles, policies, and oversight mechanisms" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Operator-accessible agent kill switch — halt all agent activity immediately without affecting process control" + "notes": "Include data localisation in AI risk management; define data residency requirements per jurisdiction and data type" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent sessions terminated and credentials revoked immediately on compromise detection" + "notes": "Include regulatory compliance in AI risk management; map applicable data laws to AI processing activities and define compliance requirements" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.1", - "control_name": "Use control enforcement", + "framework": "FedRAMP", + "control_id": "RA-3", + "control_name": "Risk Assessment — governance completeness", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enforcement of permitted use of LLM within OT context — out-of-scope requests rejected at the gateway layer" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "All LLM actions in OT context subject to explicit use controls — no autonomous action without human confirmation" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent actions in OT context subject to explicit use controls — goal-changing actions require human confirmation" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Allowlisted tool operations for each agent role — agent cannot invoke tools outside its defined function" + "notes": "Assess AI governance completeness; identify gaps in roles, policies, oversight, and accountability" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "NL gateway query allowlisting — only pre-approved query patterns permitted to OT data systems" + "notes": "Conduct regulatory compliance gap analysis for AI systems; identify areas of non-compliance and define remediation plans" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.2", - "control_name": "Least privilege", + "framework": "FedRAMP", + "control_id": "RA-5", + "control_name": "Vulnerability Scanning — AI red-teaming", "entries": [ { "id": "LLM01", @@ -13534,120 +11791,84 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLMs granted minimum necessary access to OT data — cannot read or write to control systems without explicit scoping" + "notes": "Include prompt injection vectors in vulnerability scanning programme; conduct regular automated and manual injection testing" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLMs granted minimum necessary permissions to OT systems — read-only by default, no autonomous write" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Agents granted minimum tool access — each tool scoped to specific OT function, read-only by default" + "scope": "Build", + "notes": "Include vector databases, embedding pipelines, and retrieval infrastructure in vulnerability scanning; test for injection, access control bypass, and data extraction" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Per-tool minimum permission — setpoint adjustment tool restricted to specific tags and safe ranges" + "notes": "Include agent memory stores, context databases, and shared state infrastructure in vulnerability scanning and security assessment" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials scoped to minimum OT data access required for defined task" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent cannot exceed defined permission scope even if internal goals are compromised" + "notes": "Include emerging agentic attack surfaces in vulnerability scanning; assess novel architectures for security implications before production deployment" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "NL gateway executes under requesting operator's permissions — never shared high-privilege OT service account" + "scope": "Build", + "notes": "Include synthetic data re-identification and pattern leakage in vulnerability assessment" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT context assembly restricted to minimum data required for the specific query — not broad process datasets" + "notes": "Include bias detection and fairness assessment in vulnerability scanning; test for disparate impact" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.3", - "control_name": "Use control", + "framework": "FedRAMP", + "control_id": "SA-3", + "control_name": "System Development Life Cycle — AI SDLC", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM advisory outputs clearly distinguished from authoritative procedural documentation" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM output restricted to authorised actions — no raw output directly to control interfaces" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent code execution restricted to specific, defined operations — no shell access, no network programming" + "notes": "Integrate AI-specific security activities into the SDLC — model security review, adversarial testing, supply chain verification at each lifecycle phase" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM advisory outputs clearly distinguished from authoritative documentation — source always visible" + "notes": "Integrate agent-specific security activities into the SDLC — tool integration review, privilege analysis, and adversarial testing at each lifecycle phase" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 2.6", - "control_name": "Use control", + "framework": "FedRAMP", + "control_id": "SA-9", + "control_name": "External Information System Services — third-party AI", "entries": [ { "id": "LLM04", @@ -13656,7 +11877,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Restrictions on software installation — only approved, verified LLM components permitted in OT zones" + "notes": "Require third-party AI service providers to meet FedRAMP requirements; establish SLAs covering model security, data handling, and incident notification" }, { "id": "ASI04", @@ -13665,41 +11886,50 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools" + "notes": "Require third-party agent tool and plugin providers to meet FedRAMP requirements; establish SLAs for security, availability, and incident notification" }, { "id": "ASI10", "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent cannot load additional tools or expand its own capability scope" + "notes": "Require SLAs from agent dependency providers covering availability, performance, security, and incident notification; establish fallback procedures" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked" + "notes": "Require FedRAMP authorisation or equivalent for all third-party AI services; block data transfer to unauthorised AI tools" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Require FedRAMP authorisation for third-party data service providers; establish SLAs covering data security, privacy, and incident notification" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.1", - "control_name": "Software and information integrity", + "framework": "FedRAMP", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest — training data and model weights", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs for safety-relevant guidance cross-validated against authoritative sources" + "notes": "Encrypt training data, fine-tuning datasets, and model weights at rest; prevent data memorisation exposure through access controls on data stores" }, { "id": "LLM08", @@ -13707,103 +11937,130 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "System prompt integrity protected — unauthorised modification detected" + "scope": "Build", + "notes": "Classify system prompts as sensitive configuration; encrypt at rest, enforce access controls, and apply version control and audit logging to all prompt stores" }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Communication integrity enforcement on all LLM-to-OT data paths" + "scope": "Build", + "notes": "Encrypt vector databases and embedding stores at rest; enforce access controls and audit logging on all embedding read and write operations" }, { "id": "ASI06", "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory baseline established and maintained — deviations from baseline detectable" + "notes": "Encrypt agent memory stores and context databases at rest; enforce access controls and integrity verification on all memory read and write operations" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Encrypt all training data, model weights, and pipeline artefacts at rest; enforce key management per FedRAMP requirements" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "A2A message schema validation — reject malformed or unexpected message structures" + "notes": "Encrypt all AI data at rest — training data, model weights, inference logs, embedding stores — using FIPS 140-validated modules" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent recommendations for safety-relevant decisions cross-validated against independent reference" + "notes": "Encrypt all intellectual property — model weights, proprietary training data, algorithms — at rest with FIPS 140-validated modules" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Encrypt all retained AI data; implement crypto-shredding capability for secure deletion" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Encrypt AI data at rest; implement privacy-preserving storage techniques to prevent inference and re-identification" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.2", - "control_name": "Software and information integrity", + "framework": "FedRAMP", + "control_id": "SC-7", + "control_name": "Boundary Protection — rate limiting and cost controls", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrity verification of all LLM components before deployment in OT environment" + "notes": "Enforce rate limiting, token quotas, and cost circuit breakers at the AI service boundary; define per-user and per-session consumption limits" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Integrity verification of all agent tools and MCP components before OT deployment" + "notes": "Enforce strict boundary protection on agent code execution environments; isolate from production systems, restrict network access, and enforce resource limits" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All OT tool integrations assessed — security requirements in vendor contracts per 62443-2-4" + "notes": "Enforce boundary protection between agents in multi-agent systems; prevent uncontrolled propagation of failures or attacks across agent boundaries" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Browser AI extensions assessed as third-party software — 62443-2-4 requirements before Zone 3 deployment" + "notes": "Enforce boundary protection on data flows between systems; prevent uncontrolled data aggregation across security boundaries" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Labelling vendors with OT data access assessed under 62443-2-4 — same requirements as OT software vendors" + "notes": "Enforce data flow controls preventing AI data from crossing jurisdictional boundaries; restrict to approved data centres and regions" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.3", - "control_name": "Software and information integrity", + "framework": "FedRAMP", + "control_id": "SI-10", + "control_name": "Information Input Validation — prompt validation", "entries": [ { "id": "LLM01", @@ -13812,26 +12069,51 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All inputs to LLMs connected to OT systems validated for integrity — crafted inputs rejected" + "notes": "Validate all inputs to LLM inference endpoints; enforce structural separation between instruction and data contexts; reject known injection patterns" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "LLM model integrity verified before each OT deployment — poisoning detection as integrity control" + "notes": "Validate retrieval sources and grounding data provided to the model; ensure factual grounding sources are authoritative and current" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store ingestion validated — only authorised OT documentation enters the corpus" + "notes": "Validate model output at every consuming boundary; the consumer treats generated content as untrusted input and applies syntactic and schema validation before acting on it" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate all inputs to agent systems including user prompts, tool outputs, memory retrievals, and inter-agent messages; enforce structural separation of instructions and data" }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate quality, completeness, and accuracy of data entering AI pipelines; reject data failing quality thresholds" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SI-15", + "control_name": "Information Output Filtering — model response filtering", + "entries": [ { "id": "LLM10", "name": "Improper Output Handling", @@ -13839,43 +12121,77 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM output validated before rendering or passing to OT systems" + "notes": "Filter and encode model responses before release to a renderer, interpreter, or downstream service; reject content that fails the boundary content-type policy" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SI-3", + "control_name": "Malicious Code Protection — adversarial AI inputs", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Extend malicious code protection to detect and block adversarial inputs including direct and indirect prompt injection payloads" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All inputs to OT agents validated for integrity — no unvalidated external content directly into agent context" + "notes": "Extend malicious code protection to training data pipelines; detect and block poisoned data, anomalous labels, and backdoor triggers" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Deploy output monitoring to detect and block responses containing system prompt content; treat extraction as a security event" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "Extend malicious code protection to detect adversarial manipulation of embeddings — poisoned vectors, out-of-distribution injections, and embedding inversion attacks" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool descriptor integrity verified — poisoned MCP tool descriptors rejected at loading" + "notes": "Extend malicious code protection to detect and block adversarial inputs targeting agent goal manipulation including injection through tool outputs and context stores" }, { "id": "ASI05", "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "All agent-generated code validated before execution — allowlisted operations only" + "notes": "Scan agent-generated code for malicious patterns before execution; detect and block code that attempts filesystem access, network communication, or privilege escalation" }, { "id": "ASI06", "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory content validated for integrity — unauthorised modifications detected" + "notes": "Extend malicious content detection to agent memory stores; detect poisoned memories, manipulated context, and adversarial state modifications" }, { "id": "DSGAI04", @@ -13884,25 +12200,77 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Training data integrity controls — source allowlisting, anomaly detection, provenance tracking" + "notes": "Extend malicious code protection to training data and model artefacts; detect poisoned data, anomalous patterns, and backdoor indicators" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SI-4", + "control_name": "System Monitoring — output content monitoring", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor model outputs for sensitive data patterns — PII, credentials, classification markings — and alert on detection" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Multi-stage validation at all GenAI ingestion boundaries — path traversal prevention mandatory in Zone 3" + "notes": "Monitor AI service consumption metrics — tokens, latency, cost — in real time; alert and auto-mitigate on consumption anomalies" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor model outputs for factual accuracy, consistency, and hallucination indicators; alert when confidence scores or factual grounding drops below thresholds" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor multi-agent systems for cascade indicators — error propagation, resource exhaustion spreading, and anomalous inter-agent communication patterns" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor agent systems for unexpected behaviour — novel tool use patterns, unanticipated goal decomposition, and emergent inter-agent coordination" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Multimodal extraction pipelines validated — no uncontrolled OT data entering unclassified processing" + "notes": "Monitor model outputs and data access patterns for leakage indicators — PII, credentials, classification markings in outputs; alert on detection" }, { "id": "DSGAI10", @@ -13910,87 +12278,130 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "DSGAI-2026", "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Synthetic data generation pipeline validated — source OT data integrity maintained" + "scope": "Build", + "notes": "Monitor synthetic data outputs for quality, privacy preservation, and absence of sensitive pattern leakage" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "NL gateway input validation — injection addressed as a known vulnerability class in Zone 3" + "notes": "Monitor AI data usage patterns for misuse indicators; alert on data access inconsistent with approved purposes" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Confidence score suppression as OT integrity control — limits information available for model inversion" + "notes": "Monitor for privacy erosion indicators; detect inference capabilities, re-identification risk, and memorisation patterns" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT RAG corpus integrity controls — source allowlisting, hash verification, ingestion gates" + "notes": "Monitor AI outputs for bias indicators; track fairness metrics across demographic groups and use cases" } ] }, { - "framework": "ISA/IEC 62443", - "control_id": "SR 3.7", - "control_name": "Software and information integrity (monitoring)", + "framework": "FedRAMP", + "control_id": "SR-2", + "control_name": "Supply Chain Risk Management Plan — AI components", "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Include all AI components — models, datasets, adapters, libraries, plugins — in the supply chain risk management plan with provenance and risk assessment" + }, { "id": "LLM05", "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Continuous monitoring of LLM outputs for anomalous recommendations — statistical deviation detection" + "notes": "Include AI training data sources, fine-tuning datasets, and pre-trained model weights in the supply chain risk management plan; document provenance and risk assessment for each" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store content integrity monitored — alert on anomalous retrieval patterns" + "notes": "Include all agent components — tools, plugins, MCP servers, model weights, and agent frameworks — in the supply chain risk management plan" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked" + "notes": "Include all agent external dependencies — model APIs, tool endpoints, data sources — in supply chain risk management with availability and integrity requirements" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Include AI training data, model weights, and pipeline artefacts in supply chain risk management with provenance documentation" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Include third-party data providers in supply chain risk management; assess data handling practices and security posture" + } + ] + }, + { + "framework": "FedRAMP", + "control_id": "SR-3", + "control_name": "Supply Chain Controls — model provenance verification", + "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications" + "notes": "Implement integrity verification for all AI supply chain components using cryptographic signatures, checksums, and attestation before deployment" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Continuous behavioural monitoring of all OT agents — deviation from established baseline detected" + "notes": "Implement supply chain controls for AI model components — verify integrity, provenance, and authenticity of all training data and model weights before use" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify integrity and provenance of all agent supply chain components using cryptographic signatures, checksums, and attestation before deployment" }, { "id": "DSGAI04", @@ -13999,7 +12410,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Continuous monitoring of OT GenAI model outputs — systematic anomalies indicating poisoning detected" + "notes": "Verify integrity and provenance of all AI artefacts using cryptographic signatures and checksums before use in any pipeline" }, { "id": "DSGAI05", @@ -14008,32 +12419,55 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Runtime monitoring of ingestion pipelines — anomalous payloads detected and rejected" + "notes": "Implement provenance tracking for all AI training data; document source, collection method, processing history, and licensing for each dataset" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Vector store integrity monitoring — anomalous access patterns indicating bulk extraction detected" - }, + "notes": "Verify provenance and integrity of data from third-party sources; implement validation before ingestion into AI pipelines" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "Security management", + "control_name": "62443-2-1", + "entries": [ { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "OT synthetic data governance policy — when synthetic data removes OT classification obligation" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "Security management system", + "control_name": "62443-2-1", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Continuous OT RAG corpus monitoring — unauthorised modifications detected before reaching operators" + "notes": "OT security management system updated to cover GenAI deployments — policy, roles, assessment" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 4.1", - "control_name": "Data confidentiality in transit", + "control_id": "SR 1.2", + "control_name": "Identification and authentication", "entries": [ { "id": "LLM02", @@ -14042,16 +12476,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All OT data accessed by LLMs encrypted in transit — no cleartext historian queries over OT network" + "notes": "All LLM access to OT data systems requires authenticated, authorised identity" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt content treated as sensitive OT configuration data — encrypted in transit" + "notes": "LLM actions in OT context authenticated as a distinct identity — traceable in OT audit log" }, { "id": "ASI03", @@ -14060,16 +12494,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials never transmitted or stored in cleartext within OT network" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A communication encrypted — no cleartext agent messages on OT network segments" + "notes": "All agent access to OT systems using distinct, traceable identity — not shared service accounts" }, { "id": "DSGAI01", @@ -14078,7 +12503,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All OT data flowing through GenAI systems encrypted — historian exports, embedding stores, prompt caches" + "notes": "Access to GenAI systems in OT scope authenticated — each user with unique, traceable identity" }, { "id": "DSGAI02", @@ -14087,34 +12512,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials never transmitted or stored in cleartext within OT network" + "notes": "All agent credentials unique and traceable — no shared service accounts for OT-accessing agents" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT-derived GenAI assets (embeddings, caches) classified and protected — not treated as general IT data" + "notes": "Approved AI tools only on OT workstations — unapproved services blocked at network layer" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Extracted OT content from multimodal inputs classified and protected — OCR output of P&ID is as sensitive as the P&ID" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Synthetic OT datasets not automatically excluded from protection — assessed before classification change" + "notes": "Access controls on all GenAI-derived OT data assets — same authentication requirements as source data" }, { "id": "DSGAI11", @@ -14123,7 +12539,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Per-operator session data encrypted — KV cache isolation prevents cross-session OT data exposure" + "notes": "Per-operator session isolation — each operator's context inaccessible to all other sessions" }, { "id": "DSGAI13", @@ -14132,7 +12548,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Zone 3 vector store content encrypted — equipment documentation and procedure embeddings as sensitive OT data" + "notes": "RBAC on all Zone 3 vector stores — no unauthenticated access in any OT environment" }, { "id": "DSGAI14", @@ -14141,34 +12557,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI telemetry stores classified and protected — process data in logs requires same protection as live data" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT context window classification tracking — highest classification drives response handling" + "notes": "Access controls on OT GenAI telemetry stores — need-to-know enforced" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Inference attack resistance as OT data protection measure — differential privacy for OT training data" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "OT data minimisation in labelling tasks — annotators see minimum content needed, not full process records" + "notes": "Approved extensions only on Zone 3 workstations — unapproved AI extensions blocked at device management" }, { "id": "DSGAI20", @@ -14177,175 +12575,125 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI model APIs rate-limited — systematic extraction requires high query volumes, rate limiting raises cost" + "notes": "Authentication on all OT GenAI model inference APIs — unauthenticated systematic querying blocked" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 4.2", - "control_name": "Data confidentiality at rest", + "control_id": "SR 1.3", + "control_name": "Use of authenticators", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT data used in LLM context or stored by LLM components encrypted at rest" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 4.3", - "control_name": "Data confidentiality", - "entries": [ - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Embeddings of sensitive OT documentation encrypted — inversion attack protection" + "notes": "All inter-agent messages authenticated — no ambient trust between agents in OT context" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 4.4", - "control_name": "Communication integrity", + "control_id": "SR 1.6", + "control_name": "Authenticator feedback", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels" + "notes": "LLM interactions logged with user identity — injection attempts attributable to specific sessions" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ" + "notes": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging" + "notes": "Agent credential lifecycle managed — issuance, rotation, revocation documented per agent" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 5.1", - "control_name": "Information flow restriction", + "control_id": "SR 1.9", + "control_name": "Remote session termination", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs containing OT data restricted to authorised users — no unrestricted external output" + "notes": "Ability to terminate LLM sessions immediately on detection of suspicious behaviour" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt content cannot flow to unauthorised external destinations" + "notes": "LLM sessions with OT access can be locked and terminated immediately by operators" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent-to-agent information flows restricted — cascade paths limited by design" - }, - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Network controls block OT data flows to unapproved AI endpoints — DLP at OT DMZ boundary" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Cross-session data flows restricted — Zone 3 GenAI enforces strict operator session boundaries" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context assembly limits in Zone 3 — cross-trust-domain aggregation restricted" + "notes": "Operator-accessible agent kill switch — halt all agent activity immediately without affecting process control" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI availability events do not propagate to process control — architectural separation" + "notes": "Agent sessions terminated and credentials revoked immediately on compromise detection" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 5.3", - "control_name": "Information flow restriction", + "control_id": "SR 2.1", + "control_name": "Use control enforcement", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 6.1", - "control_name": "Timely response to events", - "entries": [ + "notes": "Enforcement of permitted use of LLM within OT context — out-of-scope requests rejected at the gateway layer" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Detection and response to poisoning indicators — LLM output anomalies treated as security events" + "notes": "All LLM actions in OT context subject to explicit use controls — no autonomous action without human confirmation" }, { "id": "ASI01", @@ -14354,52 +12702,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Goal hijack indicators treated as security events — agent suspended, human notified, actions reversed where feasible" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Memory poisoning indicators treated as security events — agent suspended, memory audited, human notified" + "notes": "Agent actions in OT context subject to explicit use controls — goal-changing actions require human confirmation" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent indicators treated as security events — immediate suspension, investigation, OT impact assessment" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Sensitive OT data disclosure treated as security event — agent suspended, disclosure scope assessed" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential exposure treated as security event — immediate rotation, lateral movement assessment" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Poisoning events treated as Critical security incidents — model suspended, process control fallback activated" + "notes": "Allowlisted tool operations for each agent role — agent cannot invoke tools outside its defined function" }, { "id": "DSGAI12", @@ -14408,249 +12720,240 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "NL gateway misuse treated as Critical security event — query log forensics, data exposure scope" - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT RAG poisoning treated as Critical security event — source quarantine, index rebuild, process control assessment" + "notes": "NL gateway query allowlisting — only pre-approved query patterns permitted to OT data systems" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 6.2", - "control_name": "Timely response to events", + "control_id": "SR 2.2", + "control_name": "Least privilege", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Procedures for detecting and responding to LLM misinformation incidents" + "notes": "LLMs granted minimum necessary access to OT data — cannot read or write to control systems without explicit scoping" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Procedures for detecting operator over-trust patterns — aggregate analysis of agent-influenced decisions" - } - ] - }, - { - "framework": "ISA/IEC 62443", - "control_id": "SR 6.6", - "control_name": "Timely response to events", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Network monitoring detects and responds to LLM-related resource exhaustion before OT impact" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate" + "notes": "LLMs granted minimum necessary permissions to OT systems — read-only by default, no autonomous write" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade indicators detected and responded to before physical process impact" + "notes": "Agents granted minimum tool access — each tool scoped to specific OT function, read-only by default" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Shadow AI discovery triggers incident response — data impact assessment, vendor notification" + "notes": "Per-tool minimum permission — setpoint adjustment tool restricted to specific tags and safe ranges" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ingestion integrity failure treated as security event — pipeline suspended, forensic capture" + "notes": "Agent credentials scoped to minimum OT data access required for defined task" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Tool data exchange anomalies detected — unusual data volumes in tool calls alerted" + "notes": "Rogue agent cannot exceed defined permission scope even if internal goals are compromised" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Non-compliance incidents trigger defined response — regulatory notification procedures documented" + "notes": "NL gateway executes under requesting operator's permissions — never shared high-privilege OT service account" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Multimodal OT data leakage treated as security event" - }, + "notes": "OT context assembly restricted to minimum data required for the specific query — not broad process datasets" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "SR 2.3", + "control_name": "Use control", + "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Browser AI anomalies on Zone 3 workstations treated as security events" + "notes": "LLM advisory outputs clearly distinguished from authoritative procedural documentation" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI pipeline failures treated as security events — process control fallback activated" + "notes": "LLM output restricted to authorised actions — no raw output directly to control interfaces" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Inference attack campaigns detected — systematic query patterns indicative of AML.T0024.000 alerted" + "notes": "Agent code execution restricted to specific, defined operations — no shell access, no network programming" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model extraction patterns detected — unusual query diversity alerted as potential AML.T0016" + "notes": "LLM advisory outputs clearly distinguished from authoritative documentation — source always visible" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 7.6", - "control_name": "Denial of service protection", + "control_id": "SR 2.6", + "control_name": "Use control", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM components protected against resource exhaustion attacks affecting OT availability" + "notes": "Restrictions on software installation — only approved, verified LLM components permitted in OT zones" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius" + "notes": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Poisoned model availability impact contained — fallback procedure prevents physical process disruption" - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Circuit breakers preventing OT GenAI service degradation from affecting process control" + "notes": "Rogue agent cannot load additional tools or expand its own capability scope" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Poisoned advisory output blast radius contained — process control fallback if advisory system compromised" + "notes": "Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "SR 7.7", - "control_name": "Control system backup", + "control_id": "SR 3.1", + "control_name": "Software and information integrity", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM resource exhaustion cannot affect backup and recovery of OT control systems" + "notes": "LLM outputs for safety-relevant guidance cross-validated against authoritative sources" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent system failures cannot affect backup and recovery of OT process control" + "notes": "System prompt integrity protected — unauthorised modification detected" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT GenAI failures cannot affect backup and recovery of process control — independence verified" + "notes": "Communication integrity enforcement on all LLM-to-OT data paths" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Agent memory baseline established and maintained — deviations from baseline detectable" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A message schema validation — reject malformed or unexpected message structures" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent recommendations for safety-relevant decisions cross-validated against independent reference" } ] }, { "framework": "ISA/IEC 62443", - "control_id": "Supplier security requirements", - "control_name": "62443-2-4", + "control_id": "SR 3.2", + "control_name": "Software and information integrity", "entries": [ { "id": "LLM04", @@ -14659,7 +12962,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all LLM vendors with access to OT environments" + "notes": "Integrity verification of all LLM components before deployment in OT environment" }, { "id": "ASI04", @@ -14668,25 +12971,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all agent tool and MCP server vendors with OT access" + "notes": "Integrity verification of all agent tools and MCP components before OT deployment" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "GenAI vendors handling OT-derived assets subject to 62443-2-4 programme" + "notes": "All OT tool integrations assessed — security requirements in vendor contracts per 62443-2-4" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "GenAI vendors assessed under OT supplier security programme — same requirements as OT software vendors" + "notes": "Browser AI extensions assessed as third-party software — 62443-2-4 requirements before Zone 3 deployment" }, { "id": "DSGAI19", @@ -14695,255 +12998,263 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "All labelling vendors with OT data access assessed before engagement" + "notes": "Labelling vendors with OT data access assessed under 62443-2-4 — same requirements as OT software vendors" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.1", - "control_name": "Policies for information security", + "framework": "ISA/IEC 62443", + "control_id": "SR 3.3", + "control_name": "Software and information integrity", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "AI acceptable use policy as a formal ISMS policy document" + "notes": "All inputs to LLMs connected to OT systems validated for integrity — crafted inputs rejected" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Governance policies covering regulatory obligations for GenAI" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.10", - "control_name": "Acceptable use of assets", - "entries": [ + "notes": "LLM model integrity verified before each OT deployment — poisoning detection as integrity control" + }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Policy defining acceptable LLM autonomous actions — approved tool use cases documented" + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store ingestion validated — only authorised OT documentation enters the corpus" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Policy explicitly covering acceptable use of AI tools — approved list and prohibited use cases" + "notes": "All LLM output validated before rendering or passing to OT systems" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Policy governing permitted browser AI extensions and endpoint agent permissions" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.12", - "control_name": "Classification of information", - "entries": [ + "notes": "All inputs to OT agents validated for integrity — no unvalidated external content directly into agent context" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All data in LLM scope classified — training data, RAG sources, outputs, embeddings" + "notes": "Tool descriptor integrity verified — poisoned MCP tool descriptors rejected at loading" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "System prompts classified as sensitive configuration — subject to data governance policy" + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "All agent-generated code validated before execution — allowlisted operations only" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agent advisory output classified — users cannot mistake model recommendations for authoritative system content" + "notes": "Agent memory content validated for integrity — unauthorised modifications detected" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All data in GenAI scope classified — training data, RAG corpora, outputs, embeddings" + "notes": "Training data integrity controls — source allowlisting, anomaly detection, provenance tracking" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Classification extended to GenAI-derived assets — embeddings inherit source classification" + "notes": "Multi-stage validation at all GenAI ingestion boundaries — path traversal prevention mandatory in Zone 3" }, { "id": "DSGAI09", "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Classification of multimodal inputs must propagate to all derived extracted content" + "notes": "Multimodal extraction pipelines validated — no uncontrolled OT data entering unclassified processing" }, { "id": "DSGAI10", "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Synthetic datasets classified based on re-identification risk, not assumed to be non-personal" + "tier": "Foundational", + "scope": "Both", + "notes": "Synthetic data generation pipeline validated — source OT data integrity maintained" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Telemetry data classified — full prompt captures classified at same level as content they contain" + "scope": "Both", + "notes": "NL gateway input validation — injection addressed as a known vulnerability class in Zone 3" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "All content injected into context window classified — highest classification drives handling requirement" + "scope": "Both", + "notes": "Confidence score suppression as OT integrity control — limits information available for model inversion" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Model weights, architectures, and fine-tuning configurations classified as intellectual property" + "notes": "OT RAG corpus integrity controls — source allowlisting, hash verification, ingestion gates" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.13", - "control_name": "Labelling of information", + "framework": "ISA/IEC 62443", + "control_id": "SR 3.7", + "control_name": "Software and information integrity (monitoring)", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Classification labels propagated to derived assets — embeddings, caches, summaries" + "notes": "Continuous monitoring of LLM outputs for anomalous recommendations — statistical deviation detection" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Classification labels propagate through the full GenAI data lifecycle" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.14", - "control_name": "Transfer of information", - "entries": [ + "notes": "Vector store content integrity monitored — alert on anomalous retrieval patterns" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Information transfer policies and agreements for A2A communication — authentication requirements, acceptable content" + "notes": "Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Continuous behavioural monitoring of all OT agents — deviation from established baseline detected" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Continuous monitoring of OT GenAI model outputs — systematic anomalies indicating poisoning detected" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Controls on context transfer between sessions — prohibition on cross-session data leakage" + "scope": "Both", + "notes": "Runtime monitoring of ingestion pipelines — anomalous payloads detected and rejected" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Controls on content transfer into context windows — documented data flow for each RAG pipeline" + "scope": "Both", + "notes": "Vector store integrity monitoring — anomalous access patterns indicating bulk extraction detected" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Continuous OT RAG corpus monitoring — unauthorised modifications detected before reaching operators" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.15", - "control_name": "Identity management", + "framework": "ISA/IEC 62443", + "control_id": "SR 4.1", + "control_name": "Data confidentiality in transit", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "LLM tool access governed through identity management — tool permissions scoped per deployment" + "scope": "Both", + "notes": "All OT data accessed by LLMs encrypted in transit — no cleartext historian queries over OT network" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool access governed through identity management — tool permissions scoped per agent identity" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.16", - "control_name": "Identity management", - "entries": [ + "notes": "System prompt content treated as sensitive OT configuration data — encrypted in transit" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -14951,24 +13262,26 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process" + "notes": "Agent credentials never transmitted or stored in cleartext within OT network" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "All agent identities inventoried and lifecycle-managed as non-human identities" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.17", - "control_name": "Authentication information", - "entries": [ + "notes": "All A2A communication encrypted — no cleartext agent messages on OT network segments" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "All OT data flowing through GenAI systems encrypted — historian exports, embedding stores, prompt caches" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -14976,93 +13289,79 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Secure management of agent credentials — no hardcoding, rotation enforced" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.19", - "control_name": "Supplier relationships", - "entries": [ + "notes": "Agent credentials never transmitted or stored in cleartext within OT network" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all LLM model and data vendors — provenance, integrity, disclosure obligations" + "notes": "OT-derived GenAI assets (embeddings, caches) classified and protected — not treated as general IT data" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all agent tool and MCP server providers — provenance, integrity, disclosure obligations" + "notes": "Extracted OT content from multimodal inputs classified and protected — OCR output of P&ID is as sensitive as the P&ID" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", - "notes": "Security requirements applied to all third-party training data and model sources" + "notes": "Synthetic OT datasets not automatically excluded from protection — assessed before classification change" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Security due diligence on all tool and plugin providers receiving agent context" + "notes": "Per-operator session data encrypted — KV cache isolation prevents cross-session OT data exposure" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Security requirements for any third-party access to proprietary model capabilities" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.20", - "control_name": "Supplier agreements", - "entries": [ + "notes": "Zone 3 vector store content encrypted — equipment documentation and procedure embeddings as sensitive OT data" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Contractual security requirements for LLM component suppliers — integrity guarantees, vulnerability notification" + "notes": "OT GenAI telemetry stores classified and protected — process data in logs requires same protection as live data" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA" + "notes": "OT context window classification tracking — highest classification drives response handling" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Contractual requirements covering data minimisation, retention, and training use for tool providers" + "notes": "Inference attack resistance as OT data protection measure — differential privacy for OT training data" }, { "id": "DSGAI19", @@ -15071,125 +13370,143 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Contractual data handling requirements for labelling vendors and HITL service providers" + "notes": "OT data minimisation in labelling tasks — annotators see minimum content needed, not full process records" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "OT GenAI model APIs rate-limited — systematic extraction requires high query volumes, rate limiting raises cost" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.21", - "control_name": "Supply chain security", + "framework": "ISA/IEC 62443", + "control_id": "SR 4.2", + "control_name": "Data confidentiality at rest", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope" - }, + "notes": "OT data used in LLM context or stored by LLM components encrypted at rest" + } + ] + }, + { + "framework": "ISA/IEC 62443", + "control_id": "SR 4.3", + "control_name": "Data confidentiality", + "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope" + "notes": "Embeddings of sensitive OT documentation encrypted — inversion attack protection" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.23", - "control_name": "Security for cloud services", + "framework": "ISA/IEC 62443", + "control_id": "SR 4.4", + "control_name": "Communication integrity", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Due diligence and security requirements for any cloud-based AI service including shadow AI SaaS" + "notes": "GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Cloud-based tool and plugin providers assessed against A.5.23 security requirements" + "notes": "OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.24", - "control_name": "Incident management", + "framework": "ISA/IEC 62443", + "control_id": "SR 5.1", + "control_name": "Information flow restriction", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Incident response procedures for LLM availability failures and cost overruns" + "notes": "LLM outputs containing OT data restricted to authorised users — no unrestricted external output" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Cascade events treated as security incidents — defined response, kill switch activation, operations notification" + "notes": "System prompt content cannot flow to unauthorised external destinations" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Rogue agent containment as ISMS incident — kill switch, recommendation audit, process state validation, forensic capture" + "notes": "Agent-to-agent information flows restricted — cascade paths limited by design" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Incident management procedures covering AI pipeline availability failures" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.30", - "control_name": "ICT readiness for business continuity", - "entries": [ + "notes": "Network controls block OT data flows to unapproved AI endpoints — DLP at OT DMZ boundary" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM availability requirements in BCP — RTO/RPO defined, rate limiting as resilience control" + "notes": "Cross-session data flows restricted — Zone 3 GenAI enforces strict operator session boundaries" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent cluster failures covered in BCP — RTO/RPO defined, failover tested, circuit breakers as resilience controls" + "notes": "Context assembly limits in Zone 3 — cross-trust-domain aggregation restricted" }, { "id": "DSGAI17", @@ -15198,73 +13515,118 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI pipeline availability requirements included in BCP — RTO/RPO defined for vector stores and RAG components" + "notes": "OT GenAI availability events do not propagate to process control — architectural separation" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.31", - "control_name": "Compliance with legal requirements", + "framework": "ISA/IEC 62443", + "control_id": "SR 5.3", + "control_name": "Information flow restriction", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Identifying and complying with all legal, regulatory, and contractual requirements applicable to GenAI" + "notes": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.34", - "control_name": "Privacy and PII protection", + "framework": "ISA/IEC 62443", + "control_id": "SR 6.1", + "control_name": "Timely response to events", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Detection and response to poisoning indicators — LLM output anomalies treated as security events" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Goal hijack indicators treated as security events — agent suspended, human notified, actions reversed where feasible" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory poisoning indicators treated as security events — agent suspended, memory audited, human notified" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Rogue agent indicators treated as security events — immediate suspension, investigation, OT impact assessment" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Privacy requirements for GenAI-processed personal data — lawful basis, minimisation, rights support" + "notes": "Sensitive OT data disclosure treated as security event — agent suspended, disclosure scope assessed" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Anonymisation must meet the standard required by applicable privacy law — not just technical anonymisation" + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credential exposure treated as security event — immediate rotation, lateral movement assessment" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Privacy requirements extended to cover inference attack resistance — not just direct disclosure" + "notes": "Poisoning events treated as Critical security incidents — model suspended, process control fallback activated" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Data minimisation and privacy controls for all HITL labelling workflows" + "notes": "NL gateway misuse treated as Critical security event — query log forensics, data exposure scope" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "OT RAG poisoning treated as Critical security event — source quarantine, index rebuild, process control assessment" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.36", - "control_name": "Compliance with policies", + "framework": "ISA/IEC 62443", + "control_id": "SR 6.2", + "control_name": "Timely response to events", "entries": [ { "id": "LLM07", @@ -15273,7 +13635,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Policy on AI-generated content accuracy — disclosure requirements, human verification thresholds" + "notes": "Procedures for detecting and responding to LLM misinformation incidents" }, { "id": "ASI09", @@ -15282,254 +13644,326 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Policy on agentic AI advisory use — domains requiring verification, approval flow independence from agent interface" - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Internal policies for GenAI compliance — reviewed and enforced" + "notes": "Procedures for detecting operator over-trust patterns — aggregate analysis of agent-influenced decisions" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.7", - "control_name": "Threat intelligence", + "framework": "ISA/IEC 62443", + "control_id": "SR 6.6", + "control_name": "Timely response to events", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Network monitoring detects and responds to LLM-related resource exhaustion before OT impact" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Active intelligence on prompt injection techniques — new attack patterns inform detection controls" + "notes": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Intelligence on active data poisoning campaigns targeting your sector and model type" + "notes": "Cascade indicators detected and responded to before physical process impact" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Intelligence on disinformation campaigns and active manipulation of RAG sources" + "notes": "Shadow AI discovery triggers incident response — data impact assessment, vendor notification" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Active intelligence on prompt injection and goal hijack techniques — new attack methods inform detection controls" + "notes": "Ingestion integrity failure treated as security event — pipeline suspended, forensic capture" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Active intelligence on disinformation campaigns and RAG poisoning techniques targeting your sector" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.5.9", - "control_name": "Inventory of assets", - "entries": [ + "notes": "Tool data exchange anomalies detected — unusual data volumes in tool calls alerted" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All GenAI data assets inventoried — training data, embeddings, caches, agent memory, logs" + "notes": "Non-compliance incidents trigger defined response — regulatory notification procedures documented" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Multimodal OT data leakage treated as security event" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser AI anomalies on Zone 3 workstations treated as security events" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "OT GenAI pipeline failures treated as security events — process control fallback activated" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Inference attack campaigns detected — systematic query patterns indicative of AML.T0024.000 alerted" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Model extraction patterns detected — unusual query diversity alerted as potential AML.T0016" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.6.3", - "control_name": "Information security awareness training", + "framework": "ISA/IEC 62443", + "control_id": "SR 7.6", + "control_name": "Denial of service protection", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "User training on LLM output limitations — verification requirements and critical evaluation" + "notes": "LLM components protected against resource exhaustion attacks affecting OT availability" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All users of agentic decision-support tools trained on AI limitations — verification requirements, how to identify manipulation" + "notes": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Security training for all labellers — internal and third-party — covering data handling requirements" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.1", - "control_name": "Endpoint device management", - "entries": [ + "notes": "Poisoned model availability impact contained — fallback procedure prevents physical process disruption" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Circuit breakers preventing OT GenAI service degradation from affecting process control" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Endpoint AI agents managed under device management policy — approved versions, permissions scoped" + "notes": "Poisoned advisory output blast radius contained — process control fallback if advisory system compromised" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.10", - "control_name": "Information deletion", + "framework": "ISA/IEC 62443", + "control_id": "SR 7.7", + "control_name": "Control system backup", "entries": [ { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM resource exhaustion cannot affect backup and recovery of OT control systems" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent system failures cannot affect backup and recovery of OT process control" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Deletion and erasure obligations enforced across all derived assets — embeddings, caches, backups" + "notes": "OT GenAI failures cannot affect backup and recovery of process control — independence verified" } ] }, { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.11", - "control_name": "Data masking", + "framework": "ISA/IEC 62443", + "control_id": "Supplier security requirements", + "control_name": "62443-2-4", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Output redaction for PII and sensitive patterns before responses reach users" + "notes": "Security requirements applied to all LLM vendors with access to OT environments" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Differential privacy in embedding generation for sensitive corpora" + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Security requirements applied to all agent tool and MCP server vendors with OT access" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Masking or redaction of sensitive data in LLM outputs, RAG results, and prompts" + "notes": "GenAI vendors handling OT-derived assets subject to 62443-2-4 programme" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Masking and redaction applied to extracted text from OCR and audio transcription — same as source" + "notes": "GenAI vendors assessed under OT supplier security programme — same requirements as OT software vendors" }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Technical anonymisation and pseudonymisation controls applied to synthetic data generation" - }, + "tier": "Foundational", + "scope": "Both", + "notes": "All labelling vendors with OT data access assessed before engagement" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.1", + "control_name": "Policies for information security", + "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Redaction of any cross-session content that reaches an output channel" + "scope": "Both", + "notes": "AI acceptable use policy as a formal ISMS policy document" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Masking of sensitive content in logs and traces before storage" - }, + "scope": "Both", + "notes": "Governance policies covering regulatory obligations for GenAI" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.10", + "control_name": "Acceptable use of assets", + "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Build", - "notes": "Sensitive content redacted or masked before injection into shared context windows" + "notes": "Policy defining acceptable LLM autonomous actions — approved tool use cases documented" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Differential privacy and output masking reducing information available for reconstruction attacks" + "notes": "Policy explicitly covering acceptable use of AI tools — approved list and prohibited use cases" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Anonymisation and redaction applied to labelling tasks before exposure to annotators" + "notes": "Policy governing permitted browser AI extensions and endpoint agent permissions" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.12", - "control_name": "Data leakage prevention", + "control_id": "A.5.12", + "control_name": "Classification of information", "entries": [ { "id": "LLM02", @@ -15538,16 +13972,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DLP on all LLM output channels — API, chat interface, logs" + "notes": "All data in LLM scope classified — training data, RAG sources, outputs, embeddings" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "System prompts classified as sensitive configuration — subject to data governance policy" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "DLP on memory write paths — credential patterns, sensitive content detected before memory write" + "notes": "Agent advisory output classified — users cannot mistake model recommendations for authoritative system content" }, { "id": "DSGAI01", @@ -15556,16 +13999,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "DLP controls on all GenAI output channels — model API, chat interfaces, logs" + "notes": "All data in GenAI scope classified — training data, RAG corpora, outputs, embeddings" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "DLP controls detecting and blocking sensitive data transfer to unapproved AI endpoints" + "notes": "Classification extended to GenAI-derived assets — embeddings inherit source classification" }, { "id": "DSGAI09", @@ -15574,16 +14017,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "DLP applied to all modality-extracted content — text, OCR output, transcripts" + "notes": "Classification of multimodal inputs must propagate to all derived extracted content" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DLP controls on vector store query results — sensitive content in retrieved passages detected" + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Synthetic datasets classified based on re-identification risk, not assumed to be non-personal" }, { "id": "DSGAI14", @@ -15592,25 +14035,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "DLP applied to telemetry streams — sensitive content redacted before storage" + "notes": "Telemetry data classified — full prompt captures classified at same level as content they contain" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "DLP controls on endpoint AI agent data access and exfiltration paths" - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Output monitoring for responses that reconstruct training data or sensitive source content" + "scope": "Build", + "notes": "All content injected into context window classified — highest classification drives handling requirement" }, { "id": "DSGAI20", @@ -15619,64 +14053,73 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitoring for systematic querying patterns indicative of model extraction attacks" + "notes": "Model weights, architectures, and fine-tuning configurations classified as intellectual property" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.13", - "control_name": "Backup", + "control_id": "A.5.13", + "control_name": "Labelling of information", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Backup and recovery for LLM service infrastructure — failover capability tested" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent state and configuration backed up — recovery to known-good state after cascade incident" + "notes": "Classification labels propagated to derived assets — embeddings, caches, summaries" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora" + "notes": "Classification labels propagate through the full GenAI data lifecycle" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.14", - "control_name": "Redundancy", + "control_id": "A.5.14", + "control_name": "Transfer of information", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Information transfer policies and agreements for A2A communication — authentication requirements, acceptable content" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Redundancy and failover for production RAG and vector store infrastructure" + "scope": "Build", + "notes": "Controls on context transfer between sessions — prohibition on cross-session data leakage" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Controls on content transfer into context windows — documented data flow for each RAG pipeline" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.15", - "control_name": "Logging", + "control_id": "A.5.15", + "control_name": "Identity management", "entries": [ { "id": "LLM03", @@ -15685,16 +14128,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Build", - "notes": "All LLM tool invocations logged with full context — every tool call auditable" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Access to system prompts logged — unauthorised access attempts detectable" + "notes": "LLM tool access governed through identity management — tool permissions scoped per deployment" }, { "id": "ASI02", @@ -15703,8 +14137,15 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All tool invocations logged with full context — tool identity, parameters, agent identity, timestamp" - }, + "notes": "Agent tool access governed through identity management — tool permissions scoped per agent identity" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.16", + "control_name": "Identity management", + "entries": [ { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -15712,26 +14153,24 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All credential operations logged — issuance, use, expiry, anomalous patterns detectable" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" + "notes": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" - }, + "notes": "All agent identities inventoried and lifecycle-managed as non-human identities" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.17", + "control_name": "Authentication information", + "entries": [ { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -15739,174 +14178,177 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All agent credential use logged with full context — issuance, invocation, expiry" + "notes": "Secure management of agent credentials — no hardcoding, rotation enforced" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.19", + "control_name": "Supplier relationships", + "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Security requirements applied to all LLM model and data vendors — provenance, integrity, disclosure obligations" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Logging of cross-session access anomalies for detection and forensics" + "scope": "Both", + "notes": "Security requirements applied to all agent tool and MCP server providers — provenance, integrity, disclosure obligations" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Security requirements applied to all third-party training data and model sources" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit logging on all vector store read, write, and admin operations" + "notes": "Security due diligence on all tool and plugin providers receiving agent context" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Logging controls applied to AI telemetry — least-logging defaults, no full payload capture by default" + "tier": "Hardening", + "scope": "Both", + "notes": "Security requirements for any third-party access to proprietary model capabilities" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.16", - "control_name": "Monitoring activities", + "control_id": "A.5.20", + "control_name": "Supplier agreements", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Runtime monitoring for prompt injection indicators in LLM inputs and outputs" + "notes": "Contractual security requirements for LLM component suppliers — integrity guarantees, vulnerability notification" }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Real-time monitoring of LLM resource consumption — cost anomaly detection and alerting" + "notes": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Production monitoring for output accuracy — hallucination rate tracking, anomaly detection on model drift" + "notes": "Contractual requirements covering data minimisation, retention, and training use for tool providers" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Anomaly detection on vector store query patterns — bulk extraction and poisoning indicators" - }, + "tier": "Foundational", + "scope": "Both", + "notes": "Contractual data handling requirements for labelling vendors and HITL service providers" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.21", + "control_name": "Supply chain security", + "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Runtime monitoring for output handling incidents — injection attempts in LLM output channels" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Runtime monitoring for injection indicators across all agent input channels — new 2022 control" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", "scope": "Both", - "notes": "Code execution environments monitored — anomalous system calls, network attempts detected" + "notes": "Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Memory store access and content monitored — anomalous write patterns, statistical integrity checks" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade indicators monitored — correlated failure patterns across agent cluster detected before physical impact" - }, + "notes": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.23", + "control_name": "Security for cloud services", + "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Aggregate over-trust patterns monitored — systematic operator acceptance without verification detected" + "notes": "Due diligence and security requirements for any cloud-based AI service including shadow AI SaaS" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Behavioural baseline monitoring — deviation detection is the primary rogue agent control, new 2022 control directly applicable" + "notes": "Cloud-based tool and plugin providers assessed against A.5.23 security requirements" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.2", - "control_name": "Privileged access rights", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "LLM tool access managed as privileged access — minimum scope, reviewed regularly" - }, + "control_id": "A.5.24", + "control_name": "Incident management", + "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent tool access managed as privileged access — per-tool permission manifests, minimum scope, regular review" + "notes": "Incident response procedures for LLM availability failures and cost overruns" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials managed as privileged access — JIT issuance, minimum scope, regular review, automatic expiry" + "notes": "Cascade events treated as security incidents — defined response, kill switch activation, operations notification" }, { "id": "ASI10", @@ -15915,102 +14357,91 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Scope constraints enforced — rogue agent cannot exceed permission envelope regardless of internal goal state" + "notes": "Rogue agent containment as ISMS incident — kill switch, recommendation audit, process state validation, forensic capture" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials managed as privileged access — short-lived, scoped, reviewed" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.20", - "control_name": "Networks security", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "A2A communication channels network-isolated — dedicated VLAN, traffic volume caps, protocol filtering" + "notes": "Incident management procedures covering AI pipeline availability failures" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.24", - "control_name": "Use of cryptography", + "control_id": "A.5.30", + "control_name": "ICT readiness for business continuity", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Encryption of all vector store data at rest and in transit" + "scope": "Both", + "notes": "LLM availability requirements in BCP — RTO/RPO defined, rate limiting as resilience control" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials encrypted at rest and in transit — secret manager, no cleartext storage" + "notes": "Agent cluster failures covered in BCP — RTO/RPO defined, failover tested, circuit breakers as resilience controls" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge base" - }, + "notes": "AI pipeline availability requirements included in BCP — RTO/RPO defined for vector stores and RAG components" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.31", + "control_name": "Compliance with legal requirements", + "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "A2A messages encrypted and integrity-verified — mutual TLS, nonce-based replay protection" - }, + "notes": "Identifying and complying with all legal, regulatory, and contractual requirements applicable to GenAI" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.5.34", + "control_name": "Privacy and PII protection", + "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Encryption of multimodal uploads and all derived content at rest and in transit" + "notes": "Privacy requirements for GenAI-processed personal data — lawful basis, minimisation, rights support" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Encryption of all vector store data at rest and in transit" + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Anonymisation must meet the standard required by applicable privacy law — not just technical anonymisation" }, { "id": "DSGAI18", @@ -16019,58 +14450,67 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Cryptographic protection of embedding vectors preventing inversion attacks" + "notes": "Privacy requirements extended to cover inference attack resistance — not just direct disclosure" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Data minimisation and privacy controls for all HITL labelling workflows" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.26", - "control_name": "Application security requirements", + "control_id": "A.5.36", + "control_name": "Compliance with policies", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Security requirements for all interfaces consuming LLM output — specified before development" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", "scope": "Both", - "notes": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations" + "notes": "Policy on AI-generated content accuracy — disclosure requirements, human verification thresholds" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Input validation requirements specified for all GenAI data ingestion interfaces" + "scope": "Both", + "notes": "Policy on agentic AI advisory use — domains requiring verification, approval flow independence from agent interface" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory" + "scope": "Both", + "notes": "Internal policies for GenAI compliance — reviewed and enforced" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.27", - "control_name": "Secure system architecture", + "control_id": "A.5.7", + "control_name": "Threat intelligence", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Active intelligence on prompt injection techniques — new attack patterns inform detection controls" + }, { "id": "LLM05", "name": "Data and Model Poisoning", @@ -16078,16 +14518,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking" + "notes": "Intelligence on active data poisoning campaigns targeting your sector and model type" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Intelligence on disinformation campaigns and active manipulation of RAG sources" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Training pipeline designed with integrity controls and supply chain verification" + "notes": "Active intelligence on prompt injection and goal hijack techniques — new attack methods inform detection controls" }, { "id": "DSGAI21", @@ -16096,172 +14545,193 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "RAG pipeline designed with source trust verification and integrity controls" + "notes": "Active intelligence on disinformation campaigns and RAG poisoning techniques targeting your sector" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.28", - "control_name": "Secure coding", + "control_id": "A.5.9", + "control_name": "Inventory of assets", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure coding requirements for all LLM integration code — input validation, sanitisation, context separation" - }, + "notes": "All GenAI data assets inventoried — training data, embeddings, caches, agent memory, logs" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.6.3", + "control_name": "Information security awareness training", + "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Output encoding, sanitisation, and schema validation as secure coding requirements" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", "scope": "Both", - "notes": "Secure coding requirements for all agentic integration code — input validation, goal-state verification, context separation" + "notes": "User training on LLM output limitations — verification requirements and critical evaluation" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool parameter validation as secure coding requirement — LLM-generated parameters treated as untrusted" + "notes": "All users of agentic decision-support tools trained on AI limitations — verification requirements, how to identify manipulation" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", "scope": "Both", - "notes": "Sandbox, static analysis, and allowlist as secure coding requirements — no code execution without these controls" - }, + "notes": "Security training for all labellers — internal and third-party — covering data handling requirements" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.1", + "control_name": "Endpoint device management", + "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Secure coding practices applied to data ingestion, parsing, and snapshot import code" - }, + "scope": "Both", + "notes": "Endpoint AI agents managed under device management policy — approved versions, permissions scoped" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.10", + "control_name": "Information deletion", + "entries": [ { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Parameterised queries, allowlisted operations, and row-level policy enforcement in LLM gateway code" + "scope": "Both", + "notes": "Deletion and erasure obligations enforced across all derived assets — embeddings, caches, backups" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.29", - "control_name": "Security testing", + "control_id": "A.8.11", + "control_name": "Data masking", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Adversarial testing programme covering prompt injection scenarios before each release" + "notes": "Output redaction for PII and sensitive patterns before responses reach users" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", - "scope": "Both", - "notes": "Adversarial testing covering poisoning detection before each production model promotion" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", "scope": "Build", - "notes": "Output injection scenarios in security testing — XSS, SQL injection, command injection via LLM output" + "notes": "Differential privacy in embedding generation for sensitive corpora" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Adversarial testing programme covering goal hijack — direct, indirect, multi-turn injection before each release" + "notes": "Masking or redaction of sensitive data in LLM outputs, RAG results, and prompts" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment" + "notes": "Masking and redaction applied to extracted text from OCR and audio transcription — same as source" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", - "scope": "Both", - "notes": "Adversarial testing of model outputs for poisoning indicators before deployment" + "scope": "Build", + "notes": "Technical anonymisation and pseudonymisation controls applied to synthetic data generation" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Security testing of all data ingestion interfaces including schema and semantic validation" + "notes": "Redaction of any cross-session content that reaches an output channel" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "SQL injection and privilege escalation testing on all LLM-to-database interfaces" + "notes": "Masking of sensitive content in logs and traces before storage" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Sensitive content redacted or masked before injection into shared context windows" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Integrity testing of RAG corpora — anomaly detection, source validation, content verification" + "notes": "Differential privacy and output masking reducing information available for reconstruction attacks" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Anonymisation and redaction applied to labelling tasks before exposure to annotators" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.3", - "control_name": "Information access restriction", + "control_id": "A.8.12", + "control_name": "Data leakage prevention", "entries": [ { "id": "LLM02", @@ -16270,25 +14740,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Access controls on system prompt storage — version controlled, access logged" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "RBAC on all vector store collections — no unauthenticated access to any collection" + "notes": "DLP on all LLM output channels — API, chat interface, logs" }, { "id": "ASI06", @@ -16297,7 +14749,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Access controls on all agent memory stores — only agent and designated administrators can write" + "notes": "DLP on memory write paths — credential patterns, sensitive content detected before memory write" }, { "id": "DSGAI01", @@ -16306,204 +14758,145 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Access controls on RAG data sources limiting retrieval to authorised user scope" + "notes": "DLP controls on all GenAI output channels — model API, chat interfaces, logs" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent access restricted to minimum scope required per task" + "notes": "DLP controls detecting and blocking sensitive data transfer to unapproved AI endpoints" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Tools receive only the minimum context required for their function — not full conversation history" + "notes": "DLP applied to all modality-extracted content — text, OCR output, transcripts" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Strict session and tenant isolation — one user's context cannot be accessed by another" + "scope": "Both", + "notes": "DLP controls on vector store query results — sensitive content in retrieved passages detected" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "LLM-generated queries execute under least-privilege credentials matching the requesting user's access" + "notes": "DLP applied to telemetry streams — sensitive content redacted before storage" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "RBAC enforced on all vector store collections — collection-level and namespace-level access control" + "notes": "DLP controls on endpoint AI agent data access and exfiltration paths" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Context window content restricted to minimum required — no cross-trust-domain aggregation without access control" + "tier": "Hardening", + "scope": "Both", + "notes": "Output monitoring for responses that reconstruct training data or sensitive source content" }, { "id": "DSGAI20", "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "API rate limiting, query restrictions, and anomaly detection limiting systematic model extraction" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.33", - "control_name": "Test information", - "entries": [ - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Appropriate protection of test and synthetic data used in AI development" - } - ] - }, - { - "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.7", - "control_name": "Protection against malware", - "entries": [ - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Endpoint AI agents subject to malware protection — extension integrity verification" + "notes": "Monitoring for systematic querying patterns indicative of model extraction attacks" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.8", - "control_name": "Management of technical vulnerabilities", + "control_id": "A.8.13", + "control_name": "Backup", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scanning and patching LLM component vulnerabilities — model weights and inference runtime libraries" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Training pipeline dependency scanning — vulnerabilities in training infrastructure components" + "notes": "Backup and recovery for LLM service infrastructure — failover capability tested" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent component CVEs in vulnerability management — ML libraries, inference runtime, MCP server dependencies" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Scanning and patching model components and training pipeline dependencies" + "notes": "Agent state and configuration backed up — recovery to known-good state after cascade incident" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Vulnerability management extended to cover data integrity vulnerabilities in RAG pipelines" + "notes": "Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora" } ] }, { "framework": "ISO/IEC 27001:2022", - "control_id": "A.8.9", - "control_name": "Configuration management", + "control_id": "A.8.14", + "control_name": "Redundancy", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Model versions, adapters, and datasets managed with integrity and change controls" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Snapshot import and restore functionality hardened and version controlled" + "scope": "Both", + "notes": "Redundancy and failover for production RAG and vector store infrastructure" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.10.1", - "control_name": "Third-party AI system acquisition", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.15", + "control_name": "Logging", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Security requirements applied to all LLM component vendors — model providers, dataset suppliers, inference runtime vendors" + "scope": "Build", + "notes": "All LLM tool invocations logged with full context — every tool call auditable" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector database providers assessed as third-party AI system components" + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Access to system prompts logged — unauthorised access attempts detectable" }, { "id": "ASI02", @@ -16512,7 +14905,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts" + "notes": "All tool invocations logged with full context — tool identity, parameters, agent identity, timestamp" }, { "id": "ASI03", @@ -16521,75 +14914,86 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Third-party services accessed via agent credentials assessed — security obligations in access arrangements" + "notes": "All credential operations logged — issuance, use, expiry, anomalous patterns detectable" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts" + "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "A2A communication infrastructure providers assessed — security obligations in arrangements" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.10.2", - "control_name": "Customer relationships", - "entries": [ + "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM deployment obligations to downstream customers — what security properties are guaranteed" + "notes": "All agent credential use logged with full context — issuance, invocation, expiry" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Logging of cross-session access anomalies for detection and forensics" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed" + "notes": "Audit logging on all vector store read, write, and admin operations" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Logging controls applied to AI telemetry — least-logging defaults, no full payload capture by default" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.5.2", - "control_name": "Impact assessment", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.16", + "control_name": "Monitoring activities", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Impact assessment covers data disclosure risk — what data is in LLM scope, what is the disclosure impact per stakeholder" + "notes": "Runtime monitoring for prompt injection indicators in LLM inputs and outputs" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Impact assessment covers excessive agency risk — what actions can the LLM take autonomously, what is the worst-case impact" + "notes": "Real-time monitoring of LLM resource consumption — cost anomaly detection and alerting" }, { "id": "LLM07", @@ -16598,7 +15002,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI impact assessment covers misinformation risk — which domains are affected, what is the consequence of incorrect output per stakeholder" + "notes": "Production monitoring for output accuracy — hallucination rate tracking, anomaly detection on model drift" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Anomaly detection on vector store query patterns — bulk extraction and poisoning indicators" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Runtime monitoring for output handling incidents — injection attempts in LLM output channels" }, { "id": "ASI01", @@ -16607,25 +15029,34 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Impact assessment covers goal hijack risk — what autonomous actions are possible if goal is redirected, who is affected" + "notes": "Runtime monitoring for injection indicators across all agent input channels — new 2022 control" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Tool misuse impact assessed — what harm is possible if each tool is misused autonomously" + "notes": "Code execution environments monitored — anomalous system calls, network attempts detected" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Impact of code execution capability formally assessed — RCE impact on persons and systems documented" + "notes": "Memory store access and content monitored — anomalous write patterns, statistical integrity checks" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Cascade indicators monitored — correlated failure patterns across agent cluster detected before physical impact" }, { "id": "ASI09", @@ -16634,14 +15065,23 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Trust exploitation impact assessed — which persons are affected by AI decisions influenced by manipulated trust" + "notes": "Aggregate over-trust patterns monitored — systematic operator acceptance without verification detected" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Behavioural baseline monitoring — deviation detection is the primary rogue agent control, new 2022 control directly applicable" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.1.2", - "control_name": "Responsible AI system management", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.2", + "control_name": "Privileged access rights", "entries": [ { "id": "LLM03", @@ -16649,26 +15089,26 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "LLM tool access managed responsibly — minimum permissions, human oversight requirements documented as AIMS responsibilities" + "scope": "Build", + "notes": "LLM tool access managed as privileged access — minimum scope, reviewed regularly" }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission" + "notes": "Agent tool access managed as privileged access — per-tool permission manifests, minimum scope, regular review" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements" + "notes": "Agent credentials managed as privileged access — JIT issuance, minimum scope, regular review, automatic expiry" }, { "id": "ASI10", @@ -16677,165 +15117,265 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation" + "notes": "Scope constraints enforced — rogue agent cannot exceed permission envelope regardless of internal goal state" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials managed as privileged access — short-lived, scoped, reviewed" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.2.3", - "control_name": "AI system security", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.20", + "control_name": "Networks security", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "AI systems designed with security controls — input validation, context separation, injection detection as AIMS design requirements" - }, + "notes": "A2A communication channels network-isolated — dedicated VLAN, traffic volume caps, protocol filtering" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.24", + "control_name": "Use of cryptography", + "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Output scanning and redaction as AIMS security controls — DLP enforced at the system boundary" + "scope": "Build", + "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Encryption of all vector store data at rest and in transit" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool permission enforcement as AIMS security control — scope enforced at orchestration layer" + "notes": "Agent credentials encrypted at rest and in transit — secret manager, no cleartext storage" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline integrity controls — input validation, source allowlisting as AIMS security design requirements" + "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge base" }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Rate limiting and resource controls as AIMS security design requirements — enforced at deployment" + "notes": "A2A messages encrypted and integrity-verified — mutual TLS, nonce-based replay protection" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Encryption of multimodal uploads and all derived content at rest and in transit" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompt encryption and access controls as AIMS security design requirements" + "notes": "Encryption of all vector store data at rest and in transit" }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Cryptographic protection of embedding vectors preventing inversion attacks" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.26", + "control_name": "Application security requirements", + "entries": [ { "id": "LLM10", "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Output encoding and schema validation as AIMS security design requirements — LLM output treated as untrusted input to downstream systems" + "scope": "Build", + "notes": "Security requirements for all interfaces consuming LLM output — specified before development" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Goal-state verification and input validation as AIMS security design requirements — structural controls enforced at orchestration layer" + "notes": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Per-tool permission manifests and parameter validation as AIMS security controls" + "scope": "Build", + "notes": "Input validation requirements specified for all GenAI data ingestion interfaces" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege" - }, + "scope": "Build", + "notes": "Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.27", + "control_name": "Secure system architecture", + "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Component integrity verification as AIMS security design requirement — cryptographic signatures before loading" + "notes": "Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox, static analysis, and allowlist as AIMS security design requirements for code execution capability" + "notes": "Training pipeline designed with integrity controls and supply chain verification" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory store access controls and integrity monitoring as AIMS security design requirements" + "notes": "RAG pipeline designed with source trust verification and integrity controls" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.28", + "control_name": "Secure coding", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secure coding requirements for all LLM integration code — input validation, sanitisation, context separation" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", + "scope": "Build", + "notes": "Output encoding, sanitisation, and schema validation as secure coding requirements" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "A2A authentication, encryption, and schema validation as AIMS security design requirements" + "notes": "Secure coding requirements for all agentic integration code — input validation, goal-state verification, context separation" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Circuit breakers and blast radius limits as AIMS security design requirements" + "notes": "Tool parameter validation as secure coding requirement — LLM-generated parameters treated as untrusted" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Scope constraints enforced at infrastructure layer — rogue agent cannot exceed permission envelope" + "notes": "Sandbox, static analysis, and allowlist as secure coding requirements — no code execution without these controls" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Secure coding practices applied to data ingestion, parsing, and snapshot import code" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Parameterised queries, allowlisted operations, and row-level policy enforcement in LLM gateway code" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.2.6", - "control_name": "Testing of AI systems", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.29", + "control_name": "Security testing", "entries": [ { "id": "LLM01", @@ -16844,7 +15384,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "AI systems tested before deployment — adversarial testing for prompt injection as AIMS testing requirement" + "notes": "Adversarial testing programme covering prompt injection scenarios before each release" }, { "id": "LLM05", @@ -16853,16 +15393,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Poisoning detection in AIMS testing — backdoor trigger testing, biased output detection before each production promotion" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector store attacks in AIMS testing — RBAC bypass, embedding inversion, bulk extraction tested" + "notes": "Adversarial testing covering poisoning detection before each production model promotion" }, { "id": "LLM10", @@ -16870,8 +15401,8 @@ window.CROSSWALK_BACKLINKS = [ "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Output injection scenarios in AIMS testing — XSS, SQL injection, command injection via LLM output tested before deployment" + "scope": "Build", + "notes": "Output injection scenarios in security testing — XSS, SQL injection, command injection via LLM output" }, { "id": "ASI01", @@ -16880,7 +15411,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Goal hijack scenarios in AIMS testing — direct, indirect, multi-turn injection tested before each production release" + "notes": "Adversarial testing programme covering goal hijack — direct, indirect, multi-turn injection before each release" }, { "id": "ASI05", @@ -16889,50 +15420,77 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment" + "notes": "Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversarial testing of model outputs for poisoning indicators before deployment" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Security testing of all data ingestion interfaces including schema and semantic validation" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "SQL injection and privilege escalation testing on all LLM-to-database interfaces" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment" + "notes": "Integrity testing of RAG corpora — anomaly detection, source validation, content verification" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.6.2.8", - "control_name": "Monitoring of AI systems", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.3", + "control_name": "Information access restriction", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI systems monitored in operation — runtime injection detection as AIMS monitoring control" + "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access" }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Resource consumption monitored in operation — cost anomaly detection as AIMS monitoring control" + "scope": "Build", + "notes": "Access controls on system prompt storage — version controlled, access logged" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Production monitoring for accuracy degradation — hallucination rates tracked as AIMS operational monitoring" + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "RBAC on all vector store collections — no unauthenticated access to any collection" }, { "id": "ASI06", @@ -16941,102 +15499,127 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring" + "notes": "Access controls on all agent memory stores — only agent and designated administrators can write" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring" + "notes": "Access controls on RAG data sources limiting retrieval to authorised user scope" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.7.2", - "control_name": "Data quality", - "entries": [ + "notes": "Agent access restricted to minimum scope required per task" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use" + "notes": "Tools receive only the minimum context required for their function — not full conversation history" }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Third-party training datasets assessed for quality — provenance, completeness, representativeness, security" + "scope": "Build", + "notes": "Strict session and tenant isolation — one user's context cannot be accessed by another" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Training data quality requirements include integrity — anomaly detection, source allowlisting, provenance tracking as data quality controls" + "tier": "Foundational", + "scope": "Build", + "notes": "LLM-generated queries execute under least-privilege credentials matching the requesting user's access" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store content quality requirements — RBAC, encryption, source validation as data quality controls" + "notes": "RBAC enforced on all vector store collections — collection-level and namespace-level access control" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Training data from third-party sources assessed — same data quality criteria as internal data" + "scope": "Build", + "notes": "Context window content restricted to minimum required — no cross-trust-domain aggregation without access control" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls" + "notes": "API rate limiting, query restrictions, and anomaly detection limiting systematic model extraction" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.7.3", - "control_name": "Data provenance and characteristics", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.33", + "control_name": "Test information", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Appropriate protection of test and synthetic data used in AI development" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.7", + "control_name": "Protection against malware", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Endpoint AI agents subject to malware protection — extension integrity verification" + } + ] + }, + { + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.8", + "control_name": "Management of technical vulnerabilities", + "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms" + "notes": "Scanning and patching LLM component vulnerabilities — model weights and inference runtime libraries" }, { "id": "LLM05", @@ -17045,117 +15628,122 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Training data provenance documented — full chain from source to training dataset, modification history tracked" + "notes": "Training pipeline dependency scanning — vulnerabilities in training infrastructure components" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts classified as sensitive operational data — provenance, access controls, handling requirements documented" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Embedding provenance documented — source document, classification, access controls tracked" + "notes": "Agent component CVEs in vulnerability management — ML libraries, inference runtime, MCP server dependencies" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented" + "notes": "Scanning and patching model components and training pipeline dependencies" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory provenance tracked — source, write access controls, TTL, modification history in AIMS" + "notes": "Vulnerability management extended to cover data integrity vulnerabilities in RAG pipelines" } ] }, { - "framework": "ISO/IEC 42001:2023", - "control_id": "A.8.1", - "control_name": "Information for interested parties", + "framework": "ISO/IEC 27001:2022", + "control_id": "A.8.9", + "control_name": "Configuration management", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Transparency about AI system limitations — users informed of advisory status, accuracy limitations, verification requirements" + "notes": "Model versions, adapters, and datasets managed with integrity and change controls" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential" - }, + "scope": "Build", + "notes": "Snapshot import and restore functionality hardened and version controlled" + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "10", + "control_name": "Improvement", + "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment" + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "A.9.1", - "control_name": "Use of AI systems", + "control_id": "4", + "control_name": "Context", "entries": [ { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Guidance on appropriate AI system use — domains requiring human verification documented as AIMS use guidance" + "notes": "Foundational" }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Guidance on AI system use — downstream consumers informed that LLM output must be validated before use" - }, + "notes": "Foundational" + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "4.2", + "control_name": "Context — interested parties", + "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content" + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.5", + "control_id": "5", "control_name": "Policy", "entries": [ { @@ -17175,12 +15763,21 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Leadership commitment to AI transparency — AI disclosure and advisory labelling requirements in AI policy" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "entries": [ { @@ -17227,12 +15824,57 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Cascade blast radius in AI risk register — maximum affected systems formally documented and accepted" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Hardening" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.7", + "control_id": "7", "control_name": "Support", "entries": [ { @@ -17252,12 +15894,21 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Resources for AI systems include NHIs — agent identities inventoried and managed as AIMS resources" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.8", + "control_id": "8", "control_name": "Operation", "entries": [ { @@ -17277,12 +15928,57 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "A2A communication documented as AIMS operational control — authentication requirements, encryption standards" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "entries": [ { @@ -17311,14 +16007,77 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Rogue agent detection rates and containment times in AIMS management review" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context", - "control_name": "Cl.4", + "control_id": "A.10.1", + "control_name": "Third-party AI system acquisition", "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Security requirements applied to all LLM component vendors — model providers, dataset suppliers, inference runtime vendors" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector database providers assessed as third-party AI system components" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Third-party services accessed via agent credentials assessed — security obligations in access arrangements" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A communication infrastructure providers assessed — security obligations in arrangements" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -17326,73 +16085,59 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" + "notes": "Hardening" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Context — interested parties", - "control_name": "Cl.4.2", - "entries": [ + "notes": "Hardening" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — access control", - "control_name": "A.7.2", - "entries": [ + "notes": "Hardening" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.10.2", + "control_name": "Customer relationships", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "LLM deployment obligations to downstream customers — what security properties are guaranteed" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed" }, { "id": "DSGAI06", @@ -17402,10 +16147,17 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Hardening" - }, + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "A.2.2", + "control_name": "Policies — acceptable use", + "entries": [ { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -17413,71 +16165,55 @@ window.CROSSWALK_BACKLINKS = [ "notes": "Foundational" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Hardening" + "notes": "Foundational" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": "Foundational" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — governance", - "control_name": "A.7.2", - "entries": [ + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": "Foundational" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — minimisation", - "control_name": "A.7.2", + "control_id": "A.3.3", + "control_name": "Internal organisation — roles", "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": "Foundational" }, { @@ -17493,157 +16229,72 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — model artefacts", - "control_name": "A.7.3", + "control_id": "A.5.2", + "control_name": "Impact assessment", "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", - "entries": [ + "notes": "Impact assessment covers data disclosure risk — what data is in LLM scope, what is the disclosure impact per stakeholder" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "Impact assessment covers excessive agency risk — what actions can the LLM take autonomously, what is the worst-case impact" }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Hardening" + "scope": "Both", + "notes": "AI impact assessment covers misinformation risk — which domains are affected, what is the consequence of incorrect output per stakeholder" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": "Hardening" + "notes": "Impact assessment covers goal hijack risk — what autonomous actions are possible if goal is redirected, who is affected" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — privacy-preserving", - "control_name": "A.7.2", - "entries": [ - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — provenance", - "control_name": "A.7.2", - "entries": [ + "notes": "Tool misuse impact assessed — what harm is possible if each tool is misused autonomously" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data — quality", - "control_name": "A.7.3", - "entries": [ + "notes": "Impact of code execution capability formally assessed — RCE impact on persons and systems documented" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — acquisition", - "control_name": "A.7.2", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — preparation", - "control_name": "A.7.3", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", - "entries": [ + "notes": "Trust exploitation impact assessed — which persons are affected by AI decisions influenced by manipulated trust" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -17702,98 +16353,45 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Improvement", - "control_name": "Cl.10", + "control_id": "A.6.1.2", + "control_name": "Responsible AI system management", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Information for interested parties", - "control_name": "A.8.1", - "entries": [ + "notes": "LLM tool access managed responsibly — minimum permissions, human oversight requirements documented as AIMS responsibilities" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Internal organisation — roles", - "control_name": "A.3.3", - "entries": [ + "notes": "LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Foundational" + "notes": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Leadership", - "control_name": "Cl.5", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — decommissioning", - "control_name": "A.6.2.8", - "entries": [ - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", - "entries": [ + "notes": "Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -17846,15 +16444,159 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", - "entries": [ + "notes": "Foundational" + } + ] + }, + { + "framework": "ISO/IEC 42001:2023", + "control_id": "A.6.2.3", + "control_name": "AI system security", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "AI systems designed with security controls — input validation, context separation, injection detection as AIMS design requirements" + }, + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output scanning and redaction as AIMS security controls — DLP enforced at the system boundary" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool permission enforcement as AIMS security control — scope enforced at orchestration layer" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training pipeline integrity controls — input validation, source allowlisting as AIMS security design requirements" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Rate limiting and resource controls as AIMS security design requirements — enforced at deployment" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt encryption and access controls as AIMS security design requirements" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output encoding and schema validation as AIMS security design requirements — LLM output treated as untrusted input to downstream systems" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Goal-state verification and input validation as AIMS security design requirements — structural controls enforced at orchestration layer" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Per-tool permission manifests and parameter validation as AIMS security controls" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Component integrity verification as AIMS security design requirement — cryptographic signatures before loading" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Sandbox, static analysis, and allowlist as AIMS security design requirements for code execution capability" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory store access controls and integrity monitoring as AIMS security design requirements" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A authentication, encryption, and schema validation as AIMS security design requirements" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Circuit breakers and blast radius limits as AIMS security design requirements" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Scope constraints enforced at infrastructure layer — rogue agent cannot exceed permission envelope" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -17922,9 +16664,72 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Testing of AI systems", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "AI systems tested before deployment — adversarial testing for prompt injection as AIMS testing requirement" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Poisoning detection in AIMS testing — backdoor trigger testing, biased output detection before each production promotion" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store attacks in AIMS testing — RBAC bypass, embedding inversion, bulk extraction tested" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output injection scenarios in AIMS testing — XSS, SQL injection, command injection via LLM output tested before deployment" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Goal hijack scenarios in AIMS testing — direct, indirect, multi-turn injection tested before each production release" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -17992,44 +16797,62 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "A.6.2.8", + "control_name": "Monitoring of AI systems", "entries": [ { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "AI systems monitored in operation — runtime injection detection as AIMS monitoring control" }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "Resource consumption monitored in operation — cost anomaly detection as AIMS monitoring control" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Production monitoring for accuracy degradation — hallucination rates tracked as AIMS operational monitoring" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Foundational" + "scope": "Both", + "notes": "Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control" }, { "id": "DSGAI17", @@ -18044,25 +16867,99 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Performance evaluation", - "control_name": "Cl.9", + "control_id": "A.7.2", + "control_name": "Data quality", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use" + }, + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Third-party training datasets assessed for quality — provenance, completeness, representativeness, security" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data quality requirements include integrity — anomaly detection, source allowlisting, provenance tracking as data quality controls" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store content quality requirements — RBAC, encryption, source validation as data quality controls" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Training data from third-party sources assessed — same data quality criteria as internal data" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Foundational" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", + "notes": "Foundational" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", - "entries": [ + }, { "id": "DSGAI07", "name": "Data Governance and Lifecycle", @@ -18070,14 +16967,14 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Hardening" + "notes": "Foundational" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": "Hardening" }, @@ -18091,42 +16988,26 @@ window.CROSSWALK_BACKLINKS = [ "notes": "Hardening" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" + "tier": "Foundational", + "scope": "Build", + "notes": "Foundational" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": "Foundational" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -18143,37 +17024,23 @@ window.CROSSWALK_BACKLINKS = [ "notes": "Foundational" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Policies — acceptable use", - "control_name": "A.2.2", - "entries": [ + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Foundational" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Support", - "control_name": "Cl.7", - "entries": [ + "notes": "Hardening" + }, { "id": "DSGAI19", "name": "Human-in-Loop and Labeler Overexposure", @@ -18182,17 +17049,107 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Foundational" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" } ] }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party", - "control_name": "A.10.1", + "control_id": "A.7.3", + "control_name": "Data provenance and characteristics", "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data provenance documented — full chain from source to training dataset, modification history tracked" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompts classified as sensitive operational data — provenance, access controls, handling requirements documented" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Embedding provenance documented — source document, classification, access controls tracked" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory provenance tracked — source, write access controls, TTL, modification history in AIMS" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Hardening" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Hardening" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -18200,43 +17157,38 @@ window.CROSSWALK_BACKLINKS = [ "notes": "Hardening" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Hardening" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — AI supply chain", - "control_name": "A.10.1", - "entries": [ + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — customer data", - "control_name": "A.10.2", - "entries": [ + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": "Hardening" } @@ -18244,25 +17196,45 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party relationships", - "control_name": "A.10.1", + "control_id": "A.8.1", + "control_name": "Information for interested parties", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Transparency about AI system limitations — users informed of advisory status, accuracy limitations, verification requirements" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": "Hardening" - } - ] - }, - { - "framework": "ISO/IEC 42001:2023", - "control_id": "Transparency", - "control_name": "A.8.1", - "entries": [ + }, { "id": "DSGAI21", "name": "Disinformation via Data Poisoning", @@ -18276,9 +17248,36 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "entries": [ + { + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Guidance on appropriate AI system use — domains requiring human verification documented as AIMS use guidance" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Guidance on AI system use — downstream consumers informed that LLM output must be validated before use" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -24242,265 +23241,54 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial red-team testing against goal hijacking vectors including injection through every data source, tool output, and context channel", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validates goal integrity controls under realistic attack conditions" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing of cascade failure paths — test error propagation, hallucination amplification, and runaway automation scenarios", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validates cascade prevention controls under attack conditions" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting code execution — sandbox escapes, resource limit bypasses, self-modification, and host system access through generated code", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validates execution boundary controls under attack conditions" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting emerging agentic patterns — self-evolution, prompt self-modification, autonomous tool acquisition, and dynamic agent creation", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PS.1.1-PS", + "control_name": "Protect all forms of code and data from unauthorised access — training and retrieval corpora", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validates controls against novel attack surfaces" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit privilege boundaries for each agent identity — maximum permitted privilege level, credential scope, and escalation constraints", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Establishes privilege boundaries as mandatory requirements" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit requirements for maximum automation depth, step limits, cost budgets, and mandatory human checkpoints for each agent workflow", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ + "notes": "Classify and access-control training datasets, fine-tuning corpora, and retrieval indexes; restrict who and what can read each store, and log every access" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Establishes automation boundaries as mandatory requirements" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements constraining permitted tool invocation sequences and cross-tool data flows for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ + "notes": "Protect training data repositories, fine-tuning datasets, and ML pipeline code from unauthorised read, write, and modification" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": "Establishes chaining constraints as mandatory requirements" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements specifying the maximum permitted tool access, API scope, data source access, and resource boundaries for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", - "entries": [ + "notes": "Classify system prompts as sensitive configuration artefacts; apply access controls, version control, and audit logging to all prompt stores" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Build", - "notes": "Establishes access control as a mandatory deployment requirement" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for cascade failure incidents including automatic circuit breaker activation, workflow suspension, cost cap enforcement, and rollback", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid response to cascading automation failures" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for dependency failures — graceful degradation, fallback providers, workflow suspension, and stakeholder notification", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures operational continuity during dependency outages" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Design circuit breakers, step limits, cost budgets, and human approval gates as explicit security requirements for all agentic automation workflows", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures cascade prevention is a design-phase requirement" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring and triage procedures for privilege escalation incidents — detect agents operating beyond their assigned privilege level", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ + "notes": "Classify embedding stores and vector databases as sensitive AI artefacts; apply access controls, encryption at rest/in transit, and audit logging" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid detection of privilege escalation in production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for anomalous tool invocation sequences; define triage procedures for suspected lateral chaining incidents", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", "scope": "Build", - "notes": "Enables detection of chaining attacks in production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for emergent agent behaviours — detect agents acquiring new capabilities, modifying their own definitions, or spawning sub-agents outside approved patterns", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables detection of emerging risks in production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Establish procedures to identify goal hijacking incidents in production including goal deviation monitoring, triage, and confirmation workflows", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid detection and response to goal manipulation in live systems" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Implement secure coding for agent code execution — sandbox isolation, input validation for code generation, output filtering, and prevention of self-modification", - "control_name": "PW.5.1-PS – Secure coding practices", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prevents code execution vulnerabilities in agent implementation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Implement secure credential handling — agents must not inherit user credentials, store tokens in context, or pass credentials between agents without explicit authorisation", - "control_name": "PW.5.1-PS – Secure coding practices", - "entries": [ + "notes": "Prevents tampering with access control configuration" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -24508,95 +23296,8 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prevents credential leakage through agent code paths" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Maintain a secure, versioned registry of all agent components with provenance records; enable auditability and rollback", - "control_name": "PS.3.1-PS – Archive and protect software releases", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures traceability and recovery capability for supply chain incidents" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Maintain versioned, integrity-verified snapshots of agent memory and context stores; enable rollback to pre-poisoning states", - "control_name": "PS.3.1-PS – Archive and protect software releases", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ensures recovery capability for memory poisoning incidents" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Monitor all agent dependencies for availability, behavioural consistency, and security posture changes; establish triage procedures for dependency degradation events", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid detection of dependency failures" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Monitor for newly disclosed vulnerabilities in third-party agent components; establish a triage process for AI-specific supply chain disclosures", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Enables rapid response to supply chain compromises" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect agent configuration files, tool manifests, permission policies, and orchestration definitions from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Prevents tampering with access control configuration" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect agent execution environments, sandbox configurations, and runtime constraints from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ + "notes": "Prevents tampering with privilege boundaries" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -24605,14 +23306,7 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Prevents weakening of execution boundaries through configuration tampering" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect agent memory stores, context databases, and shared state repositories from unauthorised read, write, and modification; enforce access controls per agent identity", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -24621,65 +23315,6 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Prevents direct tampering with agent memory and context" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Protect credential stores, identity configurations, and privilege mapping files from unauthorised access and modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prevents tampering with privilege boundaries" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "PS.1.1-PS", - "control_name": "Protect all forms of code and data from unauthorised access — training and retrieval corpora", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Classify and access-control training datasets, fine-tuning corpora, and retrieval indexes; restrict who and what can read each store, and log every access" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Protect training data repositories, fine-tuning datasets, and ML pipeline code from unauthorised read, write, and modification" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Classify system prompts as sensitive configuration artefacts; apply access controls, version control, and audit logging to all prompt stores" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Classify embedding stores and vector databases as sensitive AI artefacts; apply access controls, encryption at rest/in transit, and audit logging" }, { "id": "DSGAI01", @@ -24787,6 +23422,24 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": "Verify that the model artifact serving output has not been tampered with; maintain signed model checksums and verify before deployment" }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Detects tampering in agent supply chain artefacts" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Detects dependency degradation and tampering" + }, { "id": "DSGAI05", "name": "Data Integrity and Validation Failures", @@ -24830,6 +23483,24 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Maintain versioned, integrity-verified training data snapshots and model checkpoints in a secure model registry; enable rollback" }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures traceability and recovery capability for supply chain incidents" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures recovery capability for memory poisoning incidents" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -24900,6 +23571,42 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": "Define explicit security requirements limiting the capabilities, tool access, and autonomous action scope permitted for each AI deployment" }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Establishes access control as a mandatory deployment requirement" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Establishes privilege boundaries as mandatory requirements" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Establishes chaining constraints as mandatory requirements" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Establishes automation boundaries as mandatory requirements" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -25042,6 +23749,51 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Design AI systems to surface confidence indicators, source citations, and uncertainty signals in output; include as explicit security and quality requirements" }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures goal integrity is a design-phase requirement for all agentic systems" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Ensures access boundaries are designed before implementation" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures code execution boundaries are designed before implementation" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Ensures chaining risks are addressed at design time" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Ensures cascade prevention is a design-phase requirement" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -25148,6 +23900,24 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": "Vet vector database platforms and embedding model providers for security posture before adoption; review access control capabilities" }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents introduction of compromised components into agent pipelines" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents adoption of unreliable dependencies" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -25218,6 +23988,24 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": "Implement secure coding practices for all code paths that consume LLM output; treat model responses as untrusted input to downstream systems" }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents credential leakage through agent code paths" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Prevents code execution vulnerabilities in agent implementation" + }, { "id": "DSGAI08", "name": "Non-Compliance and Regulatory Violations", @@ -25289,136 +24077,14 @@ window.CROSSWALK_BACKLINKS = [ "notes": "Include output injection and unsafe rendering scenarios in pre-release security reviews; verify that output sanitisation controls are present and effective" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data leakage and memorisation scenarios in pre-release security reviews; verify that outputs cannot reveal training data or sensitive context" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Review synthetic data for bias inheritance, privacy leakage, and statistical fidelity before use in training pipelines; verify privacy guarantees are meaningful" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include data misuse and manipulation scenarios in pre-release reviews; verify that purpose limitation controls are enforced and cannot be bypassed" - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Include bias, fairness, and discrimination testing in pre-release model behaviour reviews; assess model outputs across protected attributes and demographic groups" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "PW.8.2-PS", - "control_name": "Test for security vulnerabilities — adversarial / red-team", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Conduct adversarial testing (red-teaming) against prompt injection vectors before each production release; cover direct, indirect, and multimodal injection paths" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial testing targeting excessive agency through indirect injection and permission escalation scenarios" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", "scope": "Both", - "notes": "Conduct adversarial resource consumption testing (sponge examples, token amplification, recursive context injection) before each production release" - }, - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Conduct adversarial and behavioural testing covering hallucination rates, factual accuracy, and misinformation generation potential before each release" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial prompt extraction testing against all known extraction techniques before deployment and after each system prompt change" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial testing of retrieval pipelines including embedding inversion, retrieval poisoning, and semantic search manipulation scenarios" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Include output-based injection testing (XSS, SQLi, CMDi via LLM output) in adversarial test suites" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "Conduct adversarial testing of synthetic data for membership inference, attribute inference, and reconstruction attacks to validate privacy claims" + "notes": "Catches goal manipulation vulnerabilities before production deployment" }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Conduct adversarial testing for discriminatory outputs; test model behaviour across demographic groups, intersectional categories, and edge cases" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent access control enforcement — verify that tool permission manifests, RBAC policies, and tenant isolation boundaries are correctly implemented and cannot be bypassed", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -25427,62 +24093,7 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Build", "notes": "Validates access controls before production deployment" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for chain-based scope violations — verify that multi-step tool sequences cannot achieve outcomes exceeding individual tool permissions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Catches chaining vulnerabilities before production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for emergent capabilities — verify that self-modification, dynamic tool discovery, and autonomous agent spawning do not create unintended security exposures", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Catches emergent pattern risks before production" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for goal deviation — verify that the agent maintains intended objectives under adversarial input conditions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Catches goal manipulation vulnerabilities before production deployment" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for memory-influenced anomalies — verify that persistent memory and shared context do not introduce unintended behaviour changes across sessions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", - "entries": [ + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -25491,220 +24102,131 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Catches memory poisoning effects before they propagate" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "RV.1.1-PS", - "control_name": "Identify and confirm vulnerabilities — AI-specific", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to identify prompt injection incidents in production including monitoring, triage, and confirmation workflows" - }, - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to identify, triage, and confirm disclosure incidents in production, including notification paths for regulated data" - }, - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor for newly disclosed vulnerabilities in third-party AI components; establish a triage process for AI-specific CVEs" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to detect and triage misinformation incidents in production including user feedback channels, automated fact-checking, and output monitoring" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Establish procedures to detect data access anomalies using audit logs; define triage workflows for suspicious access patterns across AI data stores" + "scope": "Build", + "notes": "Catches chaining vulnerabilities before production" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Establish procedures to identify data exposure from shadow AI tool usage; define triage and remediation workflows for unsanctioned data processing" + "notes": "Catches emergent pattern risks before production" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Establish procedures to detect data misuse and manipulation in production including monitoring for purpose-scope violations and data manipulation patterns" + "notes": "Include data leakage and memorisation scenarios in pre-release security reviews; verify that outputs cannot reveal training data or sensitive context" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Monitor for security advisories and quality issues from third-party data providers; establish triage procedures for third-party data incidents" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "RV.2.1-PS", - "control_name": "Assess, prioritise, and remediate — availability remediation", - "entries": [ + "scope": "Build", + "notes": "Review synthetic data for bias inheritance, privacy leakage, and statistical fidelity before use in training pipelines; verify privacy guarantees are meaningful" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Define and test remediation procedures for availability incidents — rate limit tightening, model rollback, cost circuit breaker activation" + "notes": "Include data misuse and manipulation scenarios in pre-release reviews; verify that purpose limitation controls are enforced and cannot be bypassed" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Define procedures to assess and remediate data deletion requests including impact analysis on trained models and retraining requirements" + "notes": "Include bias, fairness, and discrimination testing in pre-release model behaviour reviews; assess model outputs across protected attributes and demographic groups" } ] }, { "framework": "NIST SP 800-218A", - "control_id": "RV.3.1-PS", - "control_name": "Analyse root causes — training data forensics", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities — adversarial / red-team", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "When poisoning is detected, conduct training data analysis to identify the poisoned records, their source, and the blast radius" + "notes": "Conduct adversarial testing (red-teaming) against prompt injection vectors before each production release; cover direct, indirect, and multimodal injection paths" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Build", - "notes": "When an embedding or retrieval security incident occurs, conduct forensic analysis of the vector store, ingestion pipeline, and query patterns" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", - "scope": "Both", - "notes": "When poisoning is detected, conduct forensic analysis to identify corrupted records, trace to source, and determine blast radius across dependent models" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", "scope": "Build", - "notes": "When model failures trace to synthetic training data, conduct root cause analysis of the generation process, source data, and privacy mechanism" + "notes": "Conduct adversarial testing targeting excessive agency through indirect injection and permission escalation scenarios" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "When discriminatory behaviour is identified, conduct root cause analysis tracing bias to specific training data sources, labelling processes, or preprocessing steps" + "notes": "Conduct adversarial resource consumption testing (sponge examples, token amplification, recursive context injection) before each production release" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "When data governance failures contribute to AI incidents, conduct root cause analysis to identify governance gaps and strengthen frameworks" + "notes": "Conduct adversarial and behavioural testing covering hallucination rates, factual accuracy, and misinformation generation potential before each release" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "When regulatory non-compliance is identified, conduct root cause analysis to determine the gap, affected data subjects, and required remediation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model all agent access paths to tools, data stores, and APIs; design least-privilege tool manifests and enforce tenant isolation by design", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ + "scope": "Build", + "notes": "Conduct adversarial prompt extraction testing against all known extraction techniques before deployment and after each system prompt change" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Build", - "notes": "Ensures access boundaries are designed before implementation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model all code execution paths in agent workflows; design sandboxing, resource limits, and execution constraints as explicit security requirements", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ + "notes": "Conduct adversarial testing of retrieval pipelines including embedding inversion, retrieval poisoning, and semantic search manipulation scenarios" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "Ensures code execution boundaries are designed before implementation" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model the agent pipeline for adversarial goal manipulation vectors including direct injection, indirect injection via tool outputs, and context poisoning", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ + "scope": "Build", + "notes": "Include output-based injection testing (XSS, SQLi, CMDi via LLM output) in adversarial test suites" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -25712,95 +24234,26 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Ensures goal integrity is a design-phase requirement for all agentic systems" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Threat model tool interaction graphs — identify composite action sequences that could achieve unauthorised outcomes; design controls for chain-level authorisation", - "control_name": "PW.2.1-PS – Design software to meet security requirements", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Ensures chaining risks are addressed at design time" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Verify integrity of all agent artefacts and third-party components using cryptographic signatures and checksums before deployment", - "control_name": "PS.2.1-PS – Verify software integrity", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Detects tampering in agent supply chain artefacts" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Verify that external dependency responses are consistent with expected behaviour — detect API version changes, model swaps, or degraded output quality that could affect agent correctness", - "control_name": "PS.2.1-PS – Verify software integrity", - "entries": [ + "notes": "Validates goal integrity controls under realistic attack conditions" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Detects dependency degradation and tampering" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Vet all external agent dependencies — LLM APIs, tool endpoints, MCP servers, orchestration platforms — for reliability, security posture, and failure mode characteristics before adoption", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", - "entries": [ + "notes": "Validates execution boundary controls under attack conditions" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Prevents adoption of unreliable dependencies" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "Vet all third-party agent components — tools, plugins, MCP servers, model weights, orchestration libraries — for provenance, integrity, and security posture before use", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Prevents introduction of compromised components into agent pipelines" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "When incidents involve novel agentic patterns, conduct root cause analysis focused on understanding the emergent capability and its security implications", - "control_name": "RV.3.1-PS – Analyse root causes", - "entries": [ + "notes": "Validates cascade prevention controls under attack conditions" + }, { "id": "ASI09", "name": "Human-Agent Trust Exploitation", @@ -25808,30 +24261,32 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Builds organisational knowledge of emerging agentic risks" - } - ] - }, - { - "framework": "NIST SP 800-218A", - "control_id": "When memory poisoning is detected, conduct forensic analysis to identify the poisoned records, their ingestion source, propagation path, and blast radius across agents", - "control_name": "RV.3.1-PS – Analyse root causes", - "entries": [ + "notes": "Validates controls against novel attack surfaces" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "Conduct adversarial testing of synthetic data for membership inference, attribute inference, and reconstruction attacks to validate privacy claims" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enables thorough incident response for memory poisoning events" + "notes": "Conduct adversarial testing for discriminatory outputs; test model behaviour across demographic groups, intersectional categories, and edge cases" } ] }, { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "framework": "NIST SP 800-218A", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities — AI-specific", "entries": [ { "id": "LLM01", @@ -25840,7 +24295,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope" + "notes": "Establish procedures to identify prompt injection incidents in production including monitoring, triage, and confirmation workflows" }, { "id": "LLM02", @@ -25849,16 +24304,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier" + "notes": "Establish procedures to identify, triage, and confirm disclosure incidents in production, including notification paths for regulated data" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction" + "notes": "Monitor for newly disclosed vulnerabilities in third-party AI components; establish a triage process for AI-specific CVEs" }, { "id": "LLM07", @@ -25867,305 +24322,210 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM advisory outputs restricted to defined advisory roles — never authoritative source for safety-critical procedures" + "notes": "Establish procedures to detect and triage misinformation incidents in production including user feedback channels, automated fact-checking, and output monitoring" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt access restricted to authorised personnel — version controlled, access logged" + "notes": "Enables rapid detection and response to goal manipulation in live systems" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Access controls on OT vector stores — RBAC enforced at collection level" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess availability risks for OT systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Enables rapid detection of privilege escalation in production" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM resource consumption impact assessed on shared OT network and compute infrastructure" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess confidentiality of OT data", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Enables rapid response to supply chain compromises" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "OT data classification applied to all data accessible by LLMs" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess impact of unauthorised access and control", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "scope": "Build", + "notes": "Enables detection of chaining attacks in production" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess integrity risks for all OT-connected systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Enables detection of emerging risks in production" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Model poisoning scenarios included in OT risk assessment for each LLM" + "notes": "Enables rapid detection of dependency failures" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store integrity included in OT LLM risk assessment" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess reliability of OT advisory systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ + "notes": "Establish procedures to detect data access anomalies using audit logs; define triage workflows for suspicious access patterns across AI data stores" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM accuracy limitations assessed in OT risk assessment per use case" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks degrading the reliability of OT decision-support", - "control_name": "Section 5.3 — Integrity threats", - "entries": [ + "notes": "Establish procedures to identify data exposure from shadow AI tool usage; define triage and remediation workflows for unsanctioned data processing" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM misinformation as an integrity attack on operator decision-making" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting OT data and system integrity", - "control_name": "Section 5.3 — Integrity threats", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Model poisoning as an integrity attack on the LLM advisory system" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting the integrity of OT decision-support data", - "control_name": "Section 5.3 — Integrity threats", - "entries": [ + "notes": "Establish procedures to detect data misuse and manipulation in production including monitoring for purpose-scope violations and data manipulation patterns" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Vector store poisoning as an integrity attack on LLM knowledge sources" + "notes": "Monitor for security advisories and quality issues from third-party data providers; establish triage procedures for third-party data incidents" } ] }, { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "framework": "NIST SP 800-218A", + "control_id": "RV.2.1-PS", + "control_name": "Assess, prioritise, and remediate — availability remediation", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action" + "notes": "Define and test remediation procedures for availability incidents — rate limit tightening, model rollback, cost circuit breaker activation" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM resource consumption logged — patterns indicating exhaustion attacks detectable" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Availability risks", - "control_name": "§5.6", - "entries": [ + "notes": "Enables rapid response to cascading automation failures" + }, { "id": "ASI10", "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Cascading failure across OT components" + "notes": "Ensures operational continuity during dependency outages" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "OT GenAI pipeline failure as availability risk" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Code injection and execution via data paths", - "control_name": "Section 5.3 — Threats", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary" + "notes": "Define procedures to assess and remediate data deletion requests including impact analysis on trained models and retraining requirements" } ] }, { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Common ICS vulnerabilities", - "control_name": "§5.3", + "framework": "NIST SP 800-218A", + "control_id": "RV.3.1-PS", + "control_name": "Analyse root causes — training data forensics", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Excessive privilege is specifically listed as OT vulnerability class" + "notes": "When poisoning is detected, conduct training data analysis to identify the poisoned records, their source, and the blast radius" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Foundational", - "scope": "Both", - "notes": "Injection via OT data feeds is a documented attack vector" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", - "entries": [ + "scope": "Build", + "notes": "When an embedding or retrieval security incident occurs, conduct forensic analysis of the vector store, ingestion pipeline, and query patterns" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT data confidentiality requirements apply to training data" + "notes": "Enables thorough incident response for memory poisoning events" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT data in retrieval corpora requires access control" + "notes": "Builds organisational knowledge of emerging agentic risks" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT knowledge encoded in models requires protection" + "notes": "When poisoning is detected, conduct forensic analysis to identify corrupted records, trace to source, and determine blast radius across dependent models" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Build", + "notes": "When model failures trace to synthetic training data, conduct root cause analysis of the generation process, source data, and privacy mechanism" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT-trained model weights are sensitive OT intellectual property" + "notes": "When discriminatory behaviour is identified, conduct root cause analysis tracing bias to specific training data sources, labelling processes, or preprocessing steps" }, { "id": "DSGAI18", @@ -26174,30 +24534,23 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Retention of OT data beyond required period is a confidentiality risk" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality risks in OT", - "control_name": "§5.4", - "entries": [ + "notes": "When data governance failures contribute to AI incidents, conduct root cause analysis to identify governance gaps and strengthen frameworks" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "OT data exfiltration via compromised automation" + "notes": "When regulatory non-compliance is identified, conduct root cause analysis to determine the gap, affected data subjects, and required remediation" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Defense-in-depth network architecture with validated data flows", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§5.3", + "control_name": "Threats", "entries": [ { "id": "LLM01", @@ -26206,63 +24559,71 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of service attacks targeting OT availability", - "control_name": "Section 5.6 — DoS threats", - "entries": [ + "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM-induced resource exhaustion as a DoS vector affecting shared OT network infrastructure" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of Service Protection", - "control_name": "SC-5", - "entries": [ + "notes": "LLM autonomous actions as a new path for unauthorised command execution" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Model poisoning as an integrity attack on the LLM advisory system" + }, + { + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM infrastructure protected against resource exhaustion attacks affecting OT availability" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Fail-Safe Procedures", - "control_name": "SI-17", - "entries": [ + "notes": "LLM misinformation as an integrity attack on operator decision-making" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store poisoning as an integrity attack on LLM knowledge sources" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", - "entries": [ + "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Injection via historian and SCADA data feeds" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Excessive privilege is specifically listed as OT vulnerability class" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -26299,6 +24660,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Inadequate human oversight cited as OT vulnerability category" }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Injection via OT data feeds is a documented attack vector" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -26335,6 +24705,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Excessive OT data access is a documented vulnerability" }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Corpus manipulation directly threatens OT operational integrity" + }, { "id": "DSGAI10", "name": "Synthetic Data and Anonymization Pitfalls", @@ -26357,40 +24736,8 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities — data integrity", - "control_name": "§5.3", - "entries": [ - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Corpus manipulation directly threatens OT operational integrity" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Identify threats, vulnerabilities, and impacts for all OT systems", - "control_name": "Section 6.2 — Risk assessment", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prompt injection documented in OT risk assessment for each LLM integration" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information disclosure and OT espionage", - "control_name": "Section 5.4 — Threats", + "control_id": "§5.4", + "control_name": "Threats", "entries": [ { "id": "LLM02", @@ -26400,178 +24747,16 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "LLMs with historian access as a new vector for automated OT intelligence gathering" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Training data validation — adversarial content detected and rejected before training" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Layered controls to maintain system integrity", - "control_name": "Section 7.2 — Defense-in-depth", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Independent validation of LLM outputs against rule-based reference systems" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Functionality", - "control_name": "CM-7", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Privilege", - "control_name": "AC-6", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious code and logic attacks via IT/OT convergence", - "control_name": "Section 5.3 — Threats", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Treat prompt injection as a malicious code analog — detection and response controls required" }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs" + "notes": "System prompts containing OT specifics treated as sensitive configuration data" }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM output scanning for malicious content before OT system ingestion" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Minimal necessary connectivity at IT/OT boundary", - "control_name": "Section 7.1 — Architecture", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM access to OT systems restricted to minimum required — read-only by default" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network architecture preventing DoS propagation", - "control_name": "Section 7.2 — Network segmentation", - "entries": [ - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM infrastructure isolated from OT control network — bandwidth caps at DMZ boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", - "entries": [ { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -26579,7 +24764,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitor all outbound data from OT zone" + "notes": "OT data exfiltration via compromised automation" }, { "id": "DSGAI03", @@ -26588,7 +24773,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor for unexpected exfiltration of OT training data" + "notes": "OT data confidentiality requirements apply to training data" }, { "id": "DSGAI06", @@ -26597,7 +24782,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor outputs for OT data disclosure patterns" + "notes": "OT data must not be disclosed without authorisation" }, { "id": "DSGAI08", @@ -26606,7 +24791,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitor retrieval patterns for unauthorised OT data access" + "notes": "OT data in retrieval corpora requires access control" }, { "id": "DSGAI12", @@ -26615,16 +24800,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Monitor for systematic extraction query patterns" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Monitor OT tool data flows" + "notes": "OT knowledge encoded in models requires protection" }, { "id": "DSGAI14", @@ -26633,7 +24809,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Monitor model storage access patterns" + "notes": "OT-trained model weights are sensitive OT intellectual property" }, { "id": "DSGAI15", @@ -26642,154 +24818,128 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor inference data leaving OT boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT configuration and topology data as espionage target", - "control_name": "Section 5.4 — Information disclosure", - "entries": [ + "notes": "Inference inputs are OT data and require protection" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts containing OT specifics treated as sensitive configuration data" + "notes": "Retention of OT data beyond required period is a confidentiality risk" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT data confidentiality", - "control_name": "§5.4", + "control_id": "§5.5", + "control_name": "Supply chain threats", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT data must not be disclosed without authorisation" + "notes": "LLM model weights and plugins as supply chain risk components" }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Inference inputs are OT data and require protection" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security awareness and training", - "control_name": "Section 8.2 — Training", - "entries": [ + "notes": "Third-party tool components in OT" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Operator training on LLM limitations and verification requirements" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", - "entries": [ + "notes": "Expanded to include agentic AI components" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Governance policy for autonomous OT systems" + "notes": "Third-party OT tool data leakage" }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Compliance programme for OT GenAI deployments" + "notes": "Third-party data in OT context" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Data lineage as OT governance requirement" + "notes": "Model components are supply chain assets in OT" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT supply chain risk management programme", - "control_name": "Section 8.4 — Supply chain programme", + "control_id": "§5.6", + "control_name": "DoS threats", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting OT data at rest and in transit", - "control_name": "Section 7.3 — Data protection", - "entries": [ + "notes": "LLM-induced resource exhaustion as a DoS vector affecting shared OT network infrastructure" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Encryption and access controls on all OT data paths feeding LLM context" + "notes": "Cascading failure across OT components" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "OT GenAI pipeline failure as availability risk" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting sensitive OT data", - "control_name": "Section 7.3 — Data protection", + "control_id": "§6.2", + "control_name": "Risk assessment", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt encryption and access controls as data protection measures" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Audit Information", - "control_name": "AU-9", - "entries": [ + "notes": "Prompt injection documented in OT risk assessment for each LLM integration" + }, { "id": "LLM02", "name": "Sensitive Information Disclosure", @@ -26797,41 +24947,43 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM" + "notes": "OT data classification applied to all data accessible by LLMs" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompt access logs protected — unauthorised access attempts detectable" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", - "entries": [ + "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Model poisoning scenarios included in OT risk assessment for each LLM" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches" + "notes": "LLM resource consumption impact assessed on shared OT network and compute infrastructure" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" + "notes": "LLM accuracy limitations assessed in OT risk assessment per use case" }, { "id": "LLM09", @@ -26840,15 +24992,8 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "OT vector store content encrypted at rest" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", - "entries": [ + "notes": "Vector store integrity included in OT LLM risk assessment" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -27087,25 +25232,79 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Role-Based Training", - "control_name": "AT-3", + "control_id": "§6.3", + "control_name": "Risk response", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools" + "notes": "ML SBOM and component integrity verification as supply chain controls" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool integration approval process" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "SBOM and vendor assessment for agentic stack" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool data scope in OT security assessment" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Data source assessment for OT GenAI" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Model provenance for OT deployments" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Architecture", "entries": [ + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM access to OT systems restricted to minimum required — read-only by default" + }, { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -27146,9 +25345,54 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Network segmentation", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Independent validation of LLM outputs against rule-based reference systems" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM infrastructure isolated from OT control network — bandwidth caps at DMZ boundary" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Input validation mandatory at OT data boundary" + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -27216,115 +25460,71 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls for ICS", - "control_name": "§7.2", + "control_id": "§7.3", + "control_name": "Data protection", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Input validation mandatory at OT data boundary" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Software, Firmware, and Information Integrity", - "control_name": "SI-7", - "entries": [ + "notes": "Encryption and access controls on all OT data paths feeding LLM context" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Model integrity verification before each OT deployment — hash-based integrity check" + "notes": "System prompt encryption and access controls as data protection measures" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Vector store integrity monitoring — alert on anomalous content or unexpected modifications" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supplier Assessments and Reviews", - "control_name": "SR-6", - "entries": [ + "notes": "Monitor all outbound data from OT zone" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Periodic security assessment of LLM vendors with OT-deployed components" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Controls and Plans", - "control_name": "SR-3", - "entries": [ + "notes": "Monitor for unexpected exfiltration of OT training data" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Documented supply chain security plan covering LLM components in OT deployment" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Protection", - "control_name": "SA-12", - "entries": [ + "notes": "Monitor outputs for OT data disclosure patterns" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Tool integration approval process" + "notes": "Monitor retrieval patterns for unauthorised OT data access" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "SBOM and vendor assessment for agentic stack" + "notes": "Monitor for systematic extraction query patterns" }, { "id": "DSGAI13", @@ -27333,101 +25533,85 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool data scope in OT security assessment" + "notes": "Monitor OT tool data flows" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Data source assessment for OT GenAI" + "notes": "Monitor model storage access patterns" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model provenance for OT deployments" + "notes": "Monitor inference data leaving OT boundary" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk treatment", - "control_name": "Section 6.3 — Risk response", + "control_id": "§8.2", + "control_name": "Training", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "ML SBOM and component integrity verification as supply chain controls" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Third-party tool components in OT" + "notes": "Operator training on LLM limitations and verification requirements" }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Expanded to include agentic AI components" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Third-party OT tool data leakage" + "notes": "Governance policy for autonomous OT systems" }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Third-party data in OT context" + "notes": "Compliance programme for OT GenAI deployments" }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model components are supply chain assets in OT" + "notes": "Data lineage as OT governance requirement" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Supply chain programme", "entries": [ + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -27468,24 +25652,8 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party software compromise as OT attack vector", - "control_name": "Section 5.5 — Supply chain threats", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM model weights and plugins as supply chain risk components" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", + "control_id": "AC-3", + "control_name": "Access Enforcement", "entries": [ { "id": "LLM01", @@ -27494,7 +25662,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope" }, { "id": "LLM02", @@ -27503,7 +25671,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier" }, { "id": "LLM03", @@ -27512,34 +25680,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Application" + "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction" }, { "id": "LLM07", @@ -27548,7 +25689,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "LLM advisory outputs restricted to defined advisory roles — never authoritative source for safety-critical procedures" }, { "id": "LLM08", @@ -27557,7 +25698,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Application" + "notes": "System prompt access restricted to authorised personnel — version controlled, access logged" }, { "id": "LLM09", @@ -27566,320 +25707,171 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Application" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Application" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Unauthorised command execution via IT/OT interfaces", - "control_name": "Section 5.3 — Threats", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM autonomous actions as a new path for unauthorised command execution" - } - ] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Validated data flows across zone boundaries", - "control_name": "Section 7.2 — Network segmentation", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems" + "notes": "Access controls on OT vector stores — RBAC enforced at collection level" } ] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Vulnerabilities common to IT/OT", - "control_name": "§5.3", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Injection via historian and SCADA data feeds" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "A2A audit completeness", - "control_name": "LMT — Logging & Monitoring", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Verify all A2A messages are logged with sender identity and content hash" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "A2A authentication enforcement", - "control_name": "ACT — Access Control", - "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Action audit completeness", - "control_name": "LMT — Logging & Monitoring", + "control_id": "AC-6", + "control_name": "Least Privilege", "entries": [ { "id": "LLM03", "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Advisory label persistence", - "control_name": "OHT — Output Handling", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Verify advisory labels persist through all rendering environments" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "AI disclosure enforcement", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor behaviour detection", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor trigger detection", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural baseline establishment and deviation", - "control_name": "AST — Agent-Specific", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection" + "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural change detection post-update", - "control_name": "MBT — Model Behaviour", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "AT-3", + "control_name": "Role-Based Training", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update" + "notes": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Blast radius containment", - "control_name": "AST — Agent-Specific", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Cascade detection alert", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify monitoring raises alert on cascade indicators before physical impact" + "notes": "LLM resource consumption logged — patterns indicating exhaustion attacks detectable" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Circuit breaker trigger and recovery", - "control_name": "AVT — Availability", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "AU-9", + "control_name": "Protection of Audit Information", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path" + "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt access logs protected — unauthorised access attempts detectable" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Citation verifiability", - "control_name": "OHT — Output Handling", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "CM-7", + "control_name": "Least Functionality", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that citations generated by the LLM are real and accurately represent source content; test that outputs requiring citations enforce this" + "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Code injection via crafted prompts", - "control_name": "IHT — Input Handling", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SA-12", + "control_name": "Supply Chain Protection", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands" + "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Component integrity verification", - "control_name": "SCT — Supply Chain", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components" + "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches" }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors" + "notes": "System prompts encrypted at rest — not stored in cleartext configuration files" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "OT vector store content encrypted at rest" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Consumption anomaly detection", - "control_name": "LMT — Logging & Monitoring", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SC-5", + "control_name": "Denial of Service Protection", "entries": [ { "id": "LLM06", @@ -27888,15 +25880,33 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify monitoring detects abnormal consumption patterns — token flooding, API abuse, wallet drainage — before service impact" + "notes": "LLM infrastructure protected against resource exhaustion attacks affecting OT availability" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Crafted inputs designed to produce malicious outputs", - "control_name": "IHT — Input Handling", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-10", + "control_name": "Information Input Validation", "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data validation — adversarial content detected and rejected before training" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -27904,127 +25914,149 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems" + "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential and sensitive content in system prompt", - "control_name": "DPT — Data Protection", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-17", + "control_name": "Fail-Safe Procedures", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique" + "notes": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential leakage paths", - "control_name": "DPT — Data Protection", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads" + "notes": "Treat prompt injection as a malicious code analog — detection and response controls required" + }, + { + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM output scanning for malicious content before OT system ingestion" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential scope enforcement", - "control_name": "ACT — Access Control", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SI-7", + "control_name": "Software, Firmware, and Information Integrity", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries" + "notes": "Model integrity verification before each OT deployment — hash-based integrity check" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store integrity monitoring — alert on anomalous content or unexpected modifications" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Credential usage audit trail", - "control_name": "LMT — Logging & Monitoring", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SR-3", + "control_name": "Supply Chain Controls and Plans", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation" + "notes": "Documented supply chain security plan covering LLM components in OT deployment" } ] }, { - "framework": "OWASP AI Testing Guide", - "control_id": "Data access authorisation enforcement", - "control_name": "ACT — Access Control", + "framework": "NIST SP 800-82 Rev 3", + "control_id": "SR-6", + "control_name": "Supplier Assessments and Reviews", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level" + "notes": "Periodic security assessment of LLM vendors with OT-deployed components" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Dataset provenance verification", - "control_name": "SCT — Supply Chain", + "control_id": "ACT", + "control_name": "Access Control", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level" + }, + { + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Downstream system access controls", - "control_name": "ACT — Access Control", - "entries": [ + "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions" + }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Embedding inversion and data reconstruction", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Verify per-user and per-tenant quotas are enforced and cannot be bypassed through session switching or credential abuse" + }, { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -28032,55 +26064,68 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Test whether embedding vectors can be inverted to reconstruct training data; verify embedding stores do not leak source content through metadata" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Factual accuracy and hallucination rate", - "control_name": "MBT — Model Behaviour", - "entries": [ + "notes": "Verify RAG queries cannot retrieve documents above the authenticated user's permission level" + }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Test model outputs against known-correct facts across the deployment use case domain; measure hallucination rate against benchmark ground truth" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Generated code validation", - "control_name": "OHT — Output Handling", - "entries": [ + "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify each tool enforces its own access controls independently of the agent framework" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Verify static analysis catches dangerous operations before execution" + "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal consistency under adversarial input", - "control_name": "MBT — Model Behaviour", + "control_id": "AST", + "control_name": "Agent-Specific", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection" + "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs" + }, + { + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components" }, { "id": "ASI01", @@ -28089,31 +26134,62 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Goal state verification effectiveness", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Hidden goal persistence detection", - "control_name": "MBT — Model Behaviour", - "entries": [ + "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify that component modification at runtime is detected and triggers agent suspension" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Test sandbox boundary enforcement from within the execution environment" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Attempt to poison memory through every channel that can write to agent memory stores" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Capture and replay a valid A2A message; verify replay is rejected" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters" + }, { "id": "ASI10", "name": "Rogue Agents", @@ -28121,127 +26197,180 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis" + "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection detection audit trail", - "control_name": "LMT — Logging & Monitoring", + "control_id": "AVT", + "control_name": "Availability", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Test rate limiting enforcement, token budget controls, and compute throttling under load; verify graceful degradation" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response" + "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection via all input channels", - "control_name": "IHT — Input Handling", + "control_id": "DPT", + "control_name": "Data Protection", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Irreversibility gate enforcement", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques" + }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Kill switch activation coverage", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Test whether embedding vectors can be inverted to reconstruct training data; verify embedding stores do not leak source content through metadata" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA" + "notes": "Verify memory store content integrity monitoring detects unauthorised modification" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "LLM-generated tool parameters", - "control_name": "OHT — Output Handling", + "control_id": "IHT", + "control_name": "Input Handling", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify tool call parameters generated by the LLM are validated before execution" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Memory content integrity", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, email content, uploaded files, and any other data source the agent processes" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Verify memory store content integrity monitoring detects unauthorised modification" + "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Memory write path injection", - "control_name": "AST — Agent-Specific", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "entries": [ { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Attempt to poison memory through every channel that can write to agent memory stores" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Misinformation incident detection", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "Verify monitoring detects abnormal consumption patterns — token flooding, API abuse, wallet drainage — before service impact" + }, { "id": "LLM07", "name": "Misinformation", @@ -28250,46 +26379,34 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Verify that the monitoring pipeline can detect and flag systematic misinformation patterns — accuracy drift, citation fabrication rate" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Output DLP effectiveness", - "control_name": "OHT — Output Handling", - "entries": [ + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Output injection into downstream systems", - "control_name": "OHT — Output Handling", - "entries": [ + "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Verify all A2A messages are logged with sender identity and content hash" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Over-trust pattern detection", - "control_name": "LMT — Logging & Monitoring", - "entries": [ + "notes": "Verify monitoring raises alert on cascade indicators before physical impact" + }, { "id": "ASI09", "name": "Human-Agent Trust Exploitation", @@ -28298,94 +26415,86 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring can detect aggregate patterns of uncritical operator acceptance" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Per-tool authorisation", - "control_name": "ACT — Access Control", - "entries": [ + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Verify each tool enforces its own access controls independently of the agent framework" + "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Per-user quota enforcement", - "control_name": "ACT — Access Control", + "control_id": "MBT", + "control_name": "Model Behaviour", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection" + }, + { + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify per-user and per-tenant quotas are enforced and cannot be bypassed through session switching or credential abuse" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Permission scope enforcement", - "control_name": "ACT — Access Control", - "entries": [ + "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain" + }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "PII and sensitive data extraction from outputs", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Plugin and tool descriptor integrity", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Test model outputs against known-correct facts across the deployment use case domain; measure hallucination rate against benchmark ground truth" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Poisoned memory influence detection", - "control_name": "MBT — Model Behaviour", - "entries": [ + "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -28394,110 +26503,68 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Verify that behaviour influenced by poisoned memory differs detectably from baseline" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Prompt injection via all agent input channels", - "control_name": "IHT — Input Handling", - "entries": [ + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, email content, uploaded files, and any other data source the agent processes" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Refusal robustness for system prompt disclosure", - "control_name": "MBT — Model Behaviour", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Replay attack prevention", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Capture and replay a valid A2A message; verify replay is rejected" + "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Resource exhaustion and rate limiting", - "control_name": "AVT — Availability", + "control_id": "OHT", + "control_name": "Output Handling", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Test rate limiting enforcement, token budget controls, and compute throttling under load; verify graceful degradation" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Retrieval authorisation enforcement", - "control_name": "ACT — Access Control", - "entries": [ + "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Verify RAG queries cannot retrieve documents above the authenticated user's permission level" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Runtime component monitoring", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Verify that citations generated by the LLM are real and accurately represent source content; test that outputs requiring citations enforce this" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Verify that component modification at runtime is detected and triggers agent suspension" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Sandbox escape attempts", - "control_name": "AST — Agent-Specific", - "entries": [ + "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify tool call parameters generated by the LLM are validated before execution" + }, { "id": "ASI05", "name": "Unexpected Code Execution", @@ -28505,47 +26572,33 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Test sandbox boundary enforcement from within the execution environment" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "System prompt extraction via crafted inputs", - "control_name": "IHT — Input Handling", - "entries": [ + "notes": "Verify static analysis catches dangerous operations before execution" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques" + "notes": "Verify advisory labels persist through all rendering environments" } ] }, { "framework": "OWASP AI Testing Guide", - "control_id": "Tool permission boundary enforcement", - "control_name": "AST — Agent-Specific", + "control_id": "SCT", + "control_name": "Supply Chain", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Training data integrity verification", - "control_name": "DPT — Data Protection", - "entries": [ + "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components" + }, { "id": "LLM05", "name": "Data and Model Poisoning", @@ -28553,15 +26606,8 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples" - } - ] - }, - { - "framework": "OWASP AI Testing Guide", - "control_id": "Vector database security configuration", - "control_name": "SCT — Supply Chain", - "entries": [ + "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline" + }, { "id": "LLM09", "name": "Vector and Embedding Weaknesses", @@ -28570,6 +26616,15 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Verify vector database is correctly configured — authentication, encryption, namespace isolation, API key protection" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors" } ] }, @@ -33952,239 +32007,54 @@ window.CROSSWALK_BACKLINKS = [ "id": "DSGAI15", "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompts not stored in cleartext application configuration or source code" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", - "control_name": "Verify PII is identified and protected", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V9 Communication", - "control_name": "V9.1.1 — TLS for all connections", - "entries": [ - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify all sensitive data encrypted in transit", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials exposed in memory, logs, tool payloads", - "control_name": "NHI-2 Secret Leakage", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "No credentials in agent context, logs, or tool payloads — secret manager only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials not revoked on decommission — dormant tokens exploitable", - "control_name": "NHI-1 Improper Offboarding", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials stored in cleartext — config files, environment variables", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Secret manager for all agent credentials — no cleartext storage anywhere" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent holds more permissions than required — lateral movement amplifier", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Least privilege per agent role — scope enforced, reviewed quarterly" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent tokens without expiry — compromise persists indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Short-lived credentials — task-scoped tokens with automatic expiry" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Agent with excess privilege can call tools in destructive ways even within normal use", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": null + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "Per-tool permission manifests — each tool scoped to minimum required operations" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "API credentials with high quota enabling systematic extraction", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": null + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-user quotas; minimum default quota" + "notes": null } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "API keys or tokens embedded in system prompt", - "control_name": "NHI-2 Secret Leakage", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.1.1", + "control_name": "Verify sensitive data is not cached or exposed in logs", "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + }, { "id": "LLM08", "name": "Hidden Context Exposure", @@ -34192,206 +32062,166 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scan system prompts for credential patterns before deployment" + "notes": "System prompts not stored in cleartext application configuration or source code" } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "Audit log service credentials leaked or compromised", - "control_name": "NHI-2 Secret Leakage", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.3.4", + "control_name": "Verify PII is identified and protected", "entries": [ { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Protect audit log credentials as sensitive NHI" + "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "Cascading agent failure with over-privileged credentials exposes all accessible systems", - "control_name": "NHI-5 Over-Privileged NHI", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V9 Communication", + "control_name": "V9.1.1 — TLS for all connections", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Least privilege per agent — cascade blast radius limited by credential scope" + "notes": null } ] }, { - "framework": "OWASP NHI Top 10", - "control_id": "Code executes in context of over-privileged agent credential — amplifies RCE impact", - "control_name": "NHI-5 Over-Privileged NHI", + "framework": "OWASP ASVS 4.0.3", + "control_id": "V9.1.1", + "control_name": "Verify all sensitive data encrypted in transit", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity" + "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Code execution in production context with prod credentials", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed" + }, + { + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Strict environment isolation for code execution — dedicated sandboxed identity" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Compliance audit credentials leaked — tampering with evidence possible", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Protect audit credential integrity" + "notes": "Timely offboarding of pipeline NHIs" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Compromised MCP server holds or can request excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Compromised third-party tool identity gets full scope of agent credential", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Enforce separate human and machine credentials" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Corpus write access held by service accounts that do not need it", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Agent credentials machine-only — human use detected and blocked" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Separate read and write credentials; write accounts require MFA" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Corpus write credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Strict separation: agent credentials machine-only, human credentials human-only" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Vault all corpus write credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Credentials appearing in model outputs passed to executors", - "control_name": "NHI-2 Secret Leakage", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Credential detection in output pipeline before execution" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in config files include sensitive data source access", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Enforce human identity for all compliance operations" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit config files for embedded credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in model outputs or training data surface in responses", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Enforce human identity for all regulated data operations" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Output scanning for credential patterns" + "notes": "Enforce machine identity per pipeline component; log with component identity" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials in plaintext config files ingested by LLM", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "entries": [ { "id": "LLM02", @@ -34400,47 +32230,35 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit all config and data sources for embedded credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Data feed service accounts with access to sensitive data that should not enter context", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Output filtering: detect and redact credential patterns in all outputs" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Scope data feed credentials to approved data only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Decommissioned pipeline identities remain in lineage records", - "control_name": "NHI-1 Improper Offboarding", - "entries": [ + "notes": "Separate credential stores per third-party component" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Timely offboarding of pipeline NHIs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Downstream service credentials with excessive scope", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Protect audit log credentials as sensitive NHI" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Scan system prompts for credential patterns before deployment" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -34448,120 +32266,80 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Apply least-privilege to all credentials used in downstream processing" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Embedding store service account with cross-tenant read access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Credential detection in output pipeline before execution" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Per-tenant credentials or least-privilege scope restrictions" + "notes": "No credentials in agent context, logs, or tool payloads — secret manager only" }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Scan all agent components for credential access patterns before deployment" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-tenant credentials or row-level security with minimum scope" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "GenAI system service account has access to more data than declared function requires", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Audit and reduce credential scope per system component" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Hijacked agent with excess privilege causes larger blast radius", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Audit config files for embedded credentials" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scope all agent credentials to minimum required — least privilege enforced" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent credentials — or agents using human credentials — destroys attribution", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Output scanning for credential patterns" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Strict separation: agent credentials machine-only, human credentials human-only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent service accounts — no attribution, no MFA", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Scan and scrub credentials from inference logs" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials machine-only — human use detected and blocked" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using LLM service account credentials — no attribution", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Vault all third-party data source credentials" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce separate human and machine credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials — no attribution for compliance evidence", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Vault all model provider credentials" + }, { "id": "DSGAI20", "name": "Model Exfiltration and IP Replication", @@ -34569,143 +32347,121 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce human identity for all regulated data operations" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials for data deletion — no audit trail", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Protect audit credential integrity" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Enforce human identity for all compliance operations" + "notes": "Protect lineage system credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Inference log service account with broad read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Minimum scope: only authorised audit function can read inference logs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injected actions can use pipeline tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Review all third-party credentials; apply minimum scope" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Apply NHI-3 controls to all data pipeline third-party credentials" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived tokens for all data pipeline service accounts" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injected session can use stolen long-lived tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rotate all LLM application tokens; implement short-lived token pattern" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius limited only by credential scope", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Apply least-privilege to all data pipeline credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius proportional to credential scope", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Review all third-party tool credentials; reduce to minimum scope" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Apply least-privilege to all LLM application credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Lineage system credentials leaked — provenance records can be tampered", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Review all third-party credentials; reduce to minimum" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Protect lineage system credentials" + "notes": "Review and scope all model provider credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "LLM outputs containing API keys, tokens, or credentials", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Require authentication for all vector database connections" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Output filtering: detect and redact credential patterns in all outputs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived A2A tokens enable persistent replay attacks", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens" + }, { "id": "ASI07", "name": "Insecure Inter-Agent Communications", @@ -34713,95 +32469,87 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Short-lived A2A tokens with nonce-based replay protection" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived corpus write credentials persist beyond need", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Require mTLS or token auth for all pipeline connections" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Rotate corpus write credentials; implement short-lived write pattern" + "notes": "Require authentication for all vector database connections" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials exposed during cascade remain valid for attacker use post-incident", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials maintain excessive access indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Apply least-privilege to all LLM application credentials" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rotate or replace with short-lived tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived inference API credentials enable sustained extraction campaigns", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Minimum credential scope per tool integration" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Rotate API credentials; implement per-session tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived memory store credentials enable persistent access for attacker", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Read-only credentials for data consumption; separate write credentials with MFA" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Separate credentials per service with independent quotas" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Short-lived credentials for memory store access — rotate on each agent session" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow hijack to persist beyond session", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Per-tenant credentials or least-privilege scope restrictions" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Apply least-privilege to all credentials used in downstream processing" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -34809,191 +32557,107 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow rogue agent to operate indefinitely after detection", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Scope all agent credentials to minimum required — least privilege enforced" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tool credentials enable extended unauthorised access", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Per-tool permission manifests — each tool scoped to minimum required operations" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Short-lived JIT credentials per task (see RECIPES.md)" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Long-lived write credentials create persistent poisoning window", - "control_name": "NHI-7 Long-Lived Credentials", - "entries": [ + "notes": "Least privilege per agent role — scope enforced, reviewed quarterly" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Short-lived write tokens; rotate frequently" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Machine credentials used for ingestion operations — no individual attribution", - "control_name": "NHI-10 Human Use of NHI", - "entries": [ + "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Enforce machine identity per pipeline component; log with component identity" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Malicious components extract credentials from agent memory or config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Least privilege per agent — cascade blast radius limited by credential scope" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Credential isolation — components cannot access other components' credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials in cleartext — trivially extracted", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Secret manager for all memory store credentials — no cleartext anywhere" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials leaked — attacker writes poisoned content directly", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model provider API keys with excessive access to model versions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Apply least-privilege to all data pipeline credentials" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Review and scope all model provider credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model provider credentials in pipeline config", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Separate read and write credentials; write requires MFA" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vault all model provider credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model storage credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Scope pipeline credentials to approved data sources only" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Vault all model storage credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Model storage service account with read access from unexpected paths", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Per-stage credentials with minimum scope" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Minimum scope: only authorised inference service can read model weights" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Over-broad retrieval credentials return data beyond user entitlement", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Minimum scope; no service account has guardrail disable capability" + }, { "id": "DSGAI06", "name": "Tool Plugin and Agent Data Exchange", @@ -35002,110 +32666,61 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Minimum scope for retrieval service accounts" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Over-privileged agent identity makes its recommendations appear more authoritative to users", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to all stages", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Audit and reduce credential scope per system component" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Per-stage credentials with minimum scope" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to sensitive data stores", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Per-tenant credentials or row-level security with minimum scope" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Scope pipeline credentials to approved data sources only" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Production agent credentials accessible in dev/test environments", - "control_name": "NHI-8 Environment Isolation Failure", - "entries": [ + "notes": "Separate read and write credentials; write accounts require MFA" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent detected but not offboarded — credentials remain valid", - "control_name": "NHI-1 Improper Offboarding", - "entries": [ + "notes": "Scope data feed credentials to approved data only" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent with excess privilege causes larger blast radius before detection", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Per-user session store access controls" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same credential used across multiple tool integrations", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Per-user quotas; minimum default quota" + }, { "id": "DSGAI13", "name": "Vector Store Platform Security", @@ -35113,159 +32728,114 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per tool" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple pipeline stages", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope per tool integration" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": "Separate credentials per stage" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple tools — compromise of one exposes all", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope: only authorised inference service can read model weights" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per tool integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same data access credential used across multiple GenAI system functions", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope: only authorised audit function can read inference logs" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per function" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Same embedding store credential used for multiple tenants", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Minimum scope for data access credentials" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Separate credentials per tenant or use row-level security" + "notes": "Per-stage minimum scope credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Same model registry token used across dev/staging/production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per environment" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Service account credentials embedded in inference log entries", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Audit all config and data sources for embedded credentials" + }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Externalise credentials to vault; reference by ID in system prompt" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Secret manager for all agent credentials — no cleartext storage anywhere" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Scan and scrub credentials from inference logs" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Service account with access to retained data beyond declared function", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Credential isolation — components cannot access other components' credentials" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Minimum scope for data access credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Service account with guardrail configuration write access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Secret manager for all memory store credentials — no cleartext anywhere" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Minimum scope; no service account has guardrail disable capability" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Session store access credentials in plaintext", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Vault all training pipeline credentials" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Vault session store credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Session store service account with cross-user read/write access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Vault all corpus write credentials" + }, { "id": "DSGAI11", "name": "Cross-Context Conversation Bleed", @@ -35273,95 +32843,42 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-user session store access controls" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared A2A credentials allow one compromised agent to impersonate others", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Vault session store credentials" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Unique identity per agent — A2A authentication bound to specific agent identity" + "notes": "Vault all model storage credentials" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared agent credential across multiple instances or deployments", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique identity per agent deployment — no credential sharing" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credential across pipeline stages — one failure affects all", - "control_name": "NHI-9 NHI Reuse", - "entries": [ - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Separate credentials per pipeline stage" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credential means RCE in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credential used across services — quota exhaustion in one affects all", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Rotate all LLM application tokens; implement short-lived token pattern" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Separate credentials per integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials allow hijacked agent to impersonate other agents", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Short-lived JIT credentials per task (see RECIPES.md)" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -35369,174 +32886,104 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique identity per agent — no shared service accounts across agent deployments" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials mean cascade in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Single credential covering multiple pipeline stages amplifies cascade", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Short-lived credentials — task-scoped tokens with automatic expiry" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Per-stage minimum scope credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Single credential with access to multiple services — one exhaustion affects all", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Short-lived credentials for memory store access — rotate on each agent session" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "Separate credentials per service with independent quotas" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Single shared credential allows tool misuse to affect multiple services", - "control_name": "NHI-9 NHI Reuse", - "entries": [ + "notes": "Short-lived A2A tokens with nonce-based replay protection" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Supply chain compromise introduces credential exfiltration code", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Scan all agent components for credential access patterns before deployment" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "System prompt stored as plaintext config with embedded credentials", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Externalise credentials to vault; reference by ID in system prompt" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party component credentials exposed in shared config", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Short-lived tokens for all data pipeline service accounts" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Separate credential stores per third-party component" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party credentials embedded in shared config", - "control_name": "NHI-2 Secret Leakage", - "entries": [ + "notes": "Short-lived write tokens; rotate frequently" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vault all third-party data source credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party data pipeline credentials with training data write access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Rotate or replace with short-lived tokens" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Apply NHI-3 controls to all data pipeline third-party credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party data source API keys with excessive scope", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Rotate corpus write credentials; implement short-lived write pattern" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Review all third-party credentials; reduce to minimum" + "notes": "Rotate API credentials; implement per-session tokens" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party dev/staging credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "entries": [ { "id": "LLM04", @@ -35546,14 +32993,25 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for all third-party integrations" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party development credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", - "entries": [ + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Strict environment isolation for code execution — dedicated sandboxed identity" + }, { "id": "DSGAI16", "name": "Endpoint and Browser Overreach", @@ -35562,110 +33020,95 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for third-party credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party plugin tokens with excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Review all third-party credentials; apply minimum scope" + "notes": "Separate credentials per environment" } ] }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive data access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Separate credentials per tool integration" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Review all third-party tool credentials; reduce to minimum scope" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive permissions inherited by agent", - "control_name": "NHI-3 Vulnerable Third-Party NHI", - "entries": [ + "notes": "Separate credentials per integration" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Tool integration credentials with broad data access", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Unique identity per agent — no shared service accounts across agent deployments" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Minimum scope per tool integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Tool/API credentials with more scope than task requires", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ + "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Minimum credential scope per tool integration" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Training pipeline credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", - "entries": [ + "notes": "Unique identity per agent deployment — no credential sharing" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Vault all training pipeline credentials" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated connections between pipeline stages", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ + "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Unique identity per agent — A2A authentication bound to specific agent identity" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -35673,23 +33116,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Require mTLS or token auth for all pipeline connections" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated embedding store access", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ + "notes": "Separate credentials per stage" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Require authentication for all vector database connections" + "notes": "Separate credentials per function" }, { "id": "DSGAI08", @@ -35698,64 +33134,25 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Require authentication for all vector database connections" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Weak agent-to-system authentication — credential reuse or weak secrets", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Weak or missing authentication on A2A channels — agent spoofing enabled", - "control_name": "NHI-4 Insecure Authentication", - "entries": [ + "notes": "Separate credentials per tenant or use row-level security" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived" - } - ] - }, - { - "framework": "OWASP NHI Top 10", - "control_id": "Write access to training data stores enables poisoning", - "control_name": "NHI-5 Over-Privileged NHI", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Read-only credentials for data consumption; separate write credentials with MFA" + "notes": "Separate credentials per tool" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Separate read and write credentials; write requires MFA" + "notes": "Separate credentials per pipeline stage" } ] }, @@ -37325,694 +34722,214 @@ window.CROSSWALK_BACKLINKS = [ ] }, { - "framework": "OWASP SAMM v2.0", - "control_id": "V-ST", - "control_name": "Security Testing", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Adversarial testing programme covering prompt injection — direct, indirect, RAG-specific, jailbreak scenarios" - }, - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Poisoning detection in adversarial testing — backdoor trigger testing before each model promotion" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Prompt extraction testing as penetration testing activity — resistance to known extraction techniques verified" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Vector store attacks in penetration testing — RBAC bypass, CVE-2024-3584 class, embedding inversion tested" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "DAST on all interfaces consuming LLM output as penetration testing activity" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Red team injection across all retrieval and tool paths" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Test persistent memory integrity across session boundaries" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether a compromised sub-agent can escalate through the network" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Automated checks on tool descriptors, endpoints, and permissions" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether agent can be instructed to exfiltrate via each outbound channel" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Advanced", - "scope": "Both", - "notes": "Dedicated red team exercise targeting guardrail bypass" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Adversarial injection tests across all data input channels" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Statistical analysis and adversarial probing for poisoned behaviours" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Dedicated adversarial testing programme targeting all guardrail bypass vectors" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Automated testing for memorisation and over-retrieval of sensitive content" - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether queries can retrieve documents from other tenants or restricted tiers" - }, - { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Attempt to inject manipulated documents; verify detection" - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversarial tests injecting malicious content via each context source" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Test whether session data is accessible or injectable across user boundaries" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Attempt model extraction via systematic querying; verify detection and rate limiting" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Automated tests verifying tool responses are scoped to minimum" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows documented scope — technical controls prevent access outside defined role", - "control_name": "Req 7.2", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Access control matrix, technical enforcement evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows need-to-know — access to cardholder data restricted to what agent function requires", - "control_name": "Req 7.2", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Access control matrix, need-to-know justification" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent accounts are system/application accounts — unique agent identity per deployment, no shared credentials", - "control_name": "Req 8.2", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Account inventory, unique account evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent actions logged — all goal-relevant agent actions logged with user identity, session ID, and action detail", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Audit log configuration, sample log entries" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent credential management — unique credentials, strong authentication where interactive, credential rotation schedule", - "control_name": "Req 8.3", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Credential management policy, rotation records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent credential usage logged — all authentication events for agent accounts in CHD scope logged", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Authentication audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent execution environments protected — WAF or equivalent for agent endpoints with code execution capability", - "control_name": "Req 6.4", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "WAF configuration, protection evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent memory encryption — CHD in persistent memory stores encrypted using strong cryptography", - "control_name": "Req 3.5", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Encryption configuration, key management records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions follow least-privilege — agent can only access CHD systems required for defined function", - "control_name": "Req 7.2", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Access control matrix for agent tools, privilege review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions reviewed periodically — unused tool permissions removed; review schedule documented", - "control_name": "Req 7.3", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Periodic access review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agent-human interaction events logged — session records for agent interactions involving CHD decisions", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Interaction audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agentic component CVEs in vulnerability management — ML libraries, agent frameworks, inference runtime dependencies scanned", - "control_name": "Req 6.3", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Vulnerability scan results, patch records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Agentic component vendors with CHD access managed as TPSPs — written agreements, annual confirmation of PCI compliance", - "control_name": "Req 12.8", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "TPSP list, written agreements, compliance confirmations" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "All tool invocations on CHD systems logged — tool name, parameters, data accessed, user/session identity", - "control_name": "Req 10.2", + "framework": "OWASP SAMM v2.0", + "control_id": "V-ST", + "control_name": "Security Testing", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool invocation audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Baseline availability configuration for agent infrastructure — capacity and resilience requirements in hardening baseline", - "control_name": "Req 2.2", - "entries": [ + "notes": "Adversarial testing programme covering prompt injection — direct, indirect, RAG-specific, jailbreak scenarios" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Poisoning detection in adversarial testing — backdoor trigger testing before each model promotion" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Hardening baseline documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Bespoke agent code reviewed for injection resistance — all agent integration code includes prompt injection as a vulnerability category", - "control_name": "Req 6.2", - "entries": [ + "notes": "Prompt extraction testing as penetration testing activity — resistance to known extraction techniques verified" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Vector store attacks in penetration testing — RBAC bypass, CVE-2024-3584 class, embedding inversion tested" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Secure code review records, findings, remediation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Cascade failure risk analysis — targeted risk analysis documents cascade failure likelihood, impact, treatment", - "control_name": "Req 12.3", - "entries": [ + "notes": "DAST on all interfaces consuming LLM output as penetration testing activity" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk analysis documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "CHD encrypted in transit between agents — all inter-agent communication carrying CHD uses TLS 1.2+", - "control_name": "Req 4.2", - "entries": [ + "notes": "Red team injection across all retrieval and tool paths" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "TLS configuration, protocol verification" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Code execution events logged — all agent-initiated execution with session identity and code summary", - "control_name": "Req 10.2", - "entries": [ + "notes": "Test persistent memory integrity across session boundaries" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Code execution audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Code execution paths in penetration testing — test whether crafted inputs cause execution of out-of-scope code", - "control_name": "Req 11.3", - "entries": [ + "notes": "Test whether a compromised sub-agent can escalate through the network" + }, { "id": "ASI05", "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Pen test report with code execution test cases" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Code generation and execution controls in secure development — agent cannot execute generated code without validation", - "control_name": "Req 6.2", - "entries": [ + "notes": "Automated checks on tool descriptors, endpoints, and permissions" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Secure development policy covering code generation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Critical agent control failures detected promptly — monitoring for cascade precursors with alert thresholds", - "control_name": "Req 10.7", - "entries": [ + "notes": "Test whether agent can be instructed to exfiltrate via each outbound channel" + }, { "id": "ASI08", "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Advanced", "scope": "Both", - "notes": "Monitoring configuration, alert records, detection evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Honest design requirements for agent interactions — AI disclosure requirements in secure development policy", - "control_name": "Req 6.2", - "entries": [ + "notes": "Dedicated red team exercise targeting guardrail bypass" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Secure development policy, design review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Inter-agent authentication — agents authenticate to each other before exchanging CHD", - "control_name": "Req 8.2", - "entries": [ + "notes": "Adversarial injection tests across all data input channels" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Certificate configuration, authentication evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Inter-agent CHD exchanges logged — source, destination, data classification, timestamp", - "control_name": "Req 10.2", - "entries": [ + "notes": "Statistical analysis and adversarial probing for poisoned behaviours" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Inter-agent communication audit log" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Malicious software protection for agent components — integrity verification for model weights and plugin descriptors", - "control_name": "Req 5.2", - "entries": [ + "notes": "Dedicated adversarial testing programme targeting all guardrail bypass vectors" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrity check configuration, verification records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Memory poisoning in penetration test scope — test whether adversarial content in memory affects agent behaviour", - "control_name": "Req 11.3", - "entries": [ + "notes": "Automated testing for memorisation and over-retrieval of sensitive content" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Pen test report" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Model and memory changes managed — updates to agent memory stores treated as system changes requiring security review", - "control_name": "Req 6.5", - "entries": [ + "notes": "Test whether queries can retrieve documents from other tenants or restricted tiers" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Change management records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Network controls prevent cascade propagation — agent network segments isolated to contain blast radius", - "control_name": "Req 1.3", - "entries": [ + "notes": "Attempt to inject manipulated documents; verify detection" + }, { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Network diagram, segmentation evidence" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "PAN in agent memory protected — primary account numbers truncated or masked if stored in agent context or memory stores", - "control_name": "Req 3.4", - "entries": [ + "notes": "Adversarial tests injecting malicious content via each context source" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Memory store review, PAN protection evidence" + "notes": "Test whether session data is accessible or injectable across user boundaries" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Attempt model extraction via systematic querying; verify detection and rate limiting" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Automated tests verifying tool responses are scoped to minimum" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Penetration testing covers goal hijack — agentic AI systems tested for prompt injection before production and annually", - "control_name": "Req 11.3", + "control_id": "Req 1.3", + "control_name": "Req 1.3", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Pen test report with goal hijack test cases" + "notes": "Network diagram, segmentation evidence" } ] }, @@ -38050,6 +34967,76 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 10.2", + "control_name": "Req 10.2", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Audit log configuration, sample log entries" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool invocation audit log" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Authentication audit log" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Code execution audit log" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Inter-agent communication audit log" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Interaction audit log" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Action audit log, out-of-scope alert records" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 10.2.1", @@ -38235,6 +35222,65 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 10.7", + "control_name": "Req 10.7", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Monitoring configuration, alert records, detection evidence" + } + ] + }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 11.3", + "control_name": "Req 11.3", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Pen test report with goal hijack test cases" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Pen test report with code execution test cases" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Pen test report" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Pen test report with rogue agent test cases" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 11.3.1", @@ -38364,6 +35410,49 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 12.3", + "control_name": "Req 12.3", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Risk analysis for agentic AI in PCI scope" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Risk analysis documentation" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Risk analysis documentation" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Risk analysis documentation" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 12.3.1", @@ -38527,6 +35616,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 12.6", + "control_name": "Req 12.6", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Training curriculum, completion records" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 12.6.1", @@ -38566,6 +35671,15 @@ window.CROSSWALK_BACKLINKS = [ "control_id": "Req 12.8", "control_name": "TPSP programme", "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "TPSP list, written agreements, compliance confirmations" + }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -38684,7 +35798,32 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified" + "notes": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified" + } + ] + }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 2.2", + "control_name": "Req 2.2", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening baseline documentation" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Hardening baseline documentation" } ] }, @@ -38763,6 +35902,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 3.4", + "control_name": "Req 3.4", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory store review, PAN protection evidence" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 3.4.1", @@ -38842,6 +35997,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 3.5", + "control_name": "Req 3.5", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Encryption configuration, key management records" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 3.5.1", @@ -38930,6 +36101,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "PCI DSS v4.0", + "control_id": "Req 4.2", + "control_name": "Req 4.2", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "TLS configuration, protocol verification" + } + ] + }, { "framework": "PCI DSS v4.0", "control_id": "Req 4.2.1", @@ -38966,483 +36153,61 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Req 6.2", - "control_name": "Bespoke software security", - "entries": [ - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM integration code specifies accuracy requirements — high-stakes payment outputs require verification before action" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.2.4", - "control_name": "Secure software development", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompt design prevents leakage — no cleartext CDE identifiers, tokens resolved at runtime" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Output handling in LLM integrations addresses all injection vulnerability classes — LLM output treated as untrusted" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.3.3", - "control_name": "Security vulnerabilities", - "entries": [ - { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All LLM software components at latest security patches — ML libraries and inference runtime patched" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores" - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Browser AI extensions patched and version-controlled — vulnerable extensions are Req 6.3 findings in CDE" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.4.1", - "control_name": "Public-facing application protection", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing" - }, - { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-powered public-facing applications protected against DoS — rate limiting and payload limits enforced" - }, - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All interfaces consuming LLM output in PCI scope protected — input validation on all downstream consumers" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation" - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Model extraction pattern detection as application protection — systematic API abuse detected" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.5", - "control_name": "Secure system changes", - "entries": [ - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Changes to GenAI ingestion pipelines tested — schema validation changes require security review" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.5.1", - "control_name": "Secure system changes", + "control_id": "Req 5.2", + "control_name": "Req 5.2", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Model component updates follow change management — security testing before production" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 6.5.6", - "control_name": "Secure system changes", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement" - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "RAG corpus updates tested for unexpected content — integrity verification before production indexing" + "notes": "Integrity check configuration, verification records" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Req 7.2.1", - "control_name": "Restrict access by need to know", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM access to CHD restricted to minimum required — retrieval access controls prevent over-broad PAN access" - }, - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM tool access to CDE systems restricted to minimum required — read-only by default, write access formally approved" - }, - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompt access restricted — only authorised personnel with documented business need" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM07", + "name": "Misinformation", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "RBAC on all vector stores in CDE scope — no unauthenticated access" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "RAG retrieval access controls — users retrieve only CHD they are authorised to access" - }, - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials scoped to minimum CDE access — least privilege, quarterly review" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context minimisation — tools receive minimum CHD-containing context required" - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Strict session isolation — each user's CHD context inaccessible to all other sessions" + "notes": "LLM integration code specifies accuracy requirements — high-stakes payment outputs require verification before action" }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated queries execute under requesting user's CDE permissions — never shared high-privilege account" - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "RBAC on all vector stores in PCI scope — no unauthenticated access in any CDE environment" - }, - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Access controls on CDE telemetry stores — Req 7 need-to-know applies" - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context assembly restricted to minimum CHD required — users cannot access CHD beyond their authorised scope through context injection" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Labelling task data minimised — annotators see minimum CHD required for annotation function" + "notes": "Secure code review records, findings, remediation" }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "API rate limiting as access control — systematic model extraction requires high query volumes" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 7.3.1", - "control_name": "Access control system", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 8.2.1", - "control_name": "Unique IDs for access", - "entries": [ - { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Each agent has a unique service identity — no shared credentials across CDE-facing agents" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Req 9.4.6", - "control_name": "Media disposal", - "entries": [ - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Derived GenAI assets containing CHD disposed of securely — deletion verified per Req 9.4 requirements" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Rogue agent behaviour logged — actions outside defined scope generate audit log entries and alerts", - "control_name": "Req 10.2", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Action audit log, out-of-scope alert records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Rogue agent risk analysis — targeted risk analysis documents scenarios, CHD impact, treatment", - "control_name": "Req 12.3", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Risk analysis documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Rogue agent scenarios in penetration test scope — test whether agents can operate outside authorised scope", - "control_name": "Req 11.3", - "entries": [ - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Pen test report with rogue agent test cases" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Secure baseline configuration for agentic infrastructure — hardening standards applied to agent deployment platforms", - "control_name": "Req 2.2", - "entries": [ - { - "id": "ASI04", - "name": "Agentic Supply Chain", + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Hardening baseline documentation" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Secure development requirements for inter-agent APIs — authentication and encryption requirements in design specifications", - "control_name": "Req 6.2", - "entries": [ + "notes": "Code review records covering parameter validation" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Secure development policy covering code generation" + }, { "id": "ASI07", "name": "Insecure Inter-Agent Communications", @@ -39451,14 +36216,7 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Design documentation, code review records" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Security awareness covers AI deception — staff trained to recognise AI impersonation and social engineering", - "control_name": "Req 12.6", - "entries": [ + }, { "id": "ASI09", "name": "Human-Agent Trust Exploitation", @@ -39466,255 +36224,278 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Training curriculum, completion records" + "notes": "Secure development policy, design review records" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Targeted risk analysis documents goal hijack — likelihood, impact on CHD, treatment controls specified", - "control_name": "Req 12.3", + "control_id": "Req 6.2.4", + "control_name": "Secure software development", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk analysis for agentic AI in PCI scope" - } - ] - }, - { - "framework": "PCI DSS v4.0", - "control_id": "Tool parameter validation in agent code — LLM-generated tool parameters validated before execution", - "control_name": "Req 6.2", - "entries": [ + "notes": "All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt design prevents leakage — no cleartext CDE identifiers, tokens resolved at runtime" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output handling in LLM integrations addresses all injection vulnerability classes — LLM output treated as untrusted" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Code review records covering parameter validation" + "notes": "LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution" } ] }, { "framework": "PCI DSS v4.0", - "control_id": "Trust exploitation risk analysis — targeted risk analysis documents scenarios and treatment", - "control_name": "Req 12.3", + "control_id": "Req 6.3", + "control_name": "Req 6.3", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Risk analysis documentation" + "notes": "Vulnerability scan results, patch records" } ] }, { - "framework": "SOC 2", - "control_id": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.3.3", + "control_name": "Security vulnerabilities", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All LLM software components at latest security patches — ML libraries and inference runtime patched" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access anomaly monitoring on telemetry stores — bulk access patterns detected", - "control_name": "CC7.2 — Monitoring", - "entries": [ + "notes": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser AI extensions patched and version-controlled — vulnerable extensions are Req 6.3 findings in CDE" } ] }, { - "framework": "SOC 2", - "control_id": "Access controls define authorised agent scope — technical enforcement of what agents may and may not do", - "control_name": "CC6.1", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.4", + "control_name": "Req 6.4", "entries": [ { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI05", + "name": "Unexpected Code Execution", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Permission policy, access control configuration" + "notes": "WAF configuration, protection evidence" } ] }, { - "framework": "SOC 2", - "control_id": "Access controls on multimodal content stores — same rigour as equivalent text data stores", - "control_name": "CC6.1 — Logical access", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.4.1", + "control_name": "Public-facing application protection", "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access controls on RAG data sources — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "LLM-powered public-facing applications protected against DoS — rate limiting and payload limits enforced" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access controls on RAG retrieval — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "All interfaces consuming LLM output in PCI scope protected — input validation on all downstream consumers" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Model extraction pattern detection as application protection — systematic API abuse detected" } ] }, { - "framework": "SOC 2", - "control_id": "Access controls on telemetry stores — same rigour as production data stores", - "control_name": "CC6.1 — Logical access", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.5", + "control_name": "Secure system changes", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Change management records" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Changes to GenAI ingestion pipelines tested — schema validation changes require security review" } ] }, { - "framework": "SOC 2", - "control_id": "Access to system prompt storage monitored — anomalous access attempts detected and alerted", - "control_name": "CC7.2 — Monitoring", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.5.1", + "control_name": "Secure system changes", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Model component updates follow change management — security testing before production" } ] }, { - "framework": "SOC 2", - "control_id": "Accuracy of personal data in AI outputs — privacy criteria require that AI-generated information about individuals is accurate", - "control_name": "P7.1", + "framework": "PCI DSS v4.0", + "control_id": "Req 6.5.6", + "control_name": "Secure system changes", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Accuracy review procedures" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "RAG corpus updates tested for unexpected content — integrity verification before production indexing" } ] }, { - "framework": "SOC 2", - "control_id": "Agent credential lifecycle procedures — issuance, rotation, revocation documented", - "control_name": "CC5.2 — Control activities", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.2", + "control_name": "Req 7.2", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credentials managed as logical access assets — provisioning, scope, rotation, revocation per access management policy", - "control_name": "CC6.1", - "entries": [ + "notes": "Access control matrix for agent tools, privilege review records" + }, { "id": "ASI03", "name": "Identity and Privilege Abuse", @@ -39722,111 +36503,69 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Credential lifecycle records, provisioning logs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Access control matrix, need-to-know justification" + }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Access control matrix, technical enforcement evidence" } ] }, { - "framework": "SOC 2", - "control_id": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs", - "control_name": "CC6.3 — Access removal", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.2.1", + "control_name": "Restrict access by need to know", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent credentials treated as confidential information — stored in secrets manager, access-controlled", - "control_name": "C1.1", - "entries": [ + "notes": "LLM access to CHD restricted to minimum required — retrieval access controls prevent over-broad PAN access" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Secrets management configuration, access control evidence" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent memory stores monitored for unexpected modifications — baseline established, deviations trigger alerts", - "control_name": "CC7.2", - "entries": [ + "notes": "LLM tool access to CDE systems restricted to minimum required — read-only by default, write access formally approved" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Memory access log, anomaly alert configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent outputs are accurate and complete — outputs not designed to mislead; factual accuracy controls for high-stakes outputs", - "control_name": "PI1.3", - "entries": [ + "notes": "System prompt access restricted — only authorised personnel with documented business need" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "Output quality controls, factual accuracy testing" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent processing is authorised — actions taken by agent correspond to user's authorised intent, not attacker's injected instruction", - "control_name": "PI1.1", - "entries": [ + "notes": "RBAC on all vector stores in CDE scope — no unauthenticated access" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Action audit log, authorisation records per agent session" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "RAG retrieval access controls — users retrieve only CHD they are authorised to access" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -39834,639 +36573,470 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Agentic supply chain risk included in risk assessment — compromised component scenarios documented with treatment", - "control_name": "CC3.3", - "entries": [ + "notes": "Agent credentials scoped to minimum CDE access — least privilege, quarterly review" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Risk register with supply chain entries" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "AI disclosure policy — users informed when interacting with AI agents; deceptive design patterns prohibited", - "control_name": "CC5.3", - "entries": [ + "notes": "Context minimisation — tools receive minimum CHD-containing context required" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "AI disclosure policy, UI evidence" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Threat detection", - "entries": [ + "notes": "Strict session isolation — each user's CHD context inaccessible to all other sessions" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "LLM-generated queries execute under requesting user's CDE permissions — never shared high-privilege account" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "API rate limiting as access control limiting systematic model extraction", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "RBAC on all vector stores in PCI scope — no unauthenticated access in any CDE environment" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Access controls on CDE telemetry stores — Req 7 need-to-know applies" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Context assembly restricted to minimum CHD required — users cannot access CHD beyond their authorised scope through context injection" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Labelling task data minimised — annotators see minimum CHD required for annotation function" + }, { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "API rate limiting as access control — systematic model extraction requires high query volumes" } ] }, { - "framework": "SOC 2", - "control_id": "Availability commitments defined for multi-agent system — RTO/RPO documented; cascade failure scenarios in availability risk", - "control_name": "A1.1", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.3", + "control_name": "Req 7.3", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Availability SLA, BCP documentation" + "notes": "Periodic access review records" } ] }, { - "framework": "SOC 2", - "control_id": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security", - "control_name": "CC9.1 — Vendor risk", + "framework": "PCI DSS v4.0", + "control_id": "Req 7.3.1", + "control_name": "Access control system", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation" } ] }, { - "framework": "SOC 2", - "control_id": "Capacity and performance monitoring — early warning of cascade failure precursors (latency, error rate, queue depth)", - "control_name": "A1.2", + "framework": "PCI DSS v4.0", + "control_id": "Req 8.2", + "control_name": "Req 8.2", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Monitoring dashboards, alert configuration" + "notes": "Account inventory, unique account evidence" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Certificate configuration, authentication evidence" } ] }, { - "framework": "SOC 2", - "control_id": "Cascade failure incidents detected and responded to — incident response procedures for multi-agent failures", - "control_name": "CC7.3", + "framework": "PCI DSS v4.0", + "control_id": "Req 8.2.1", + "control_name": "Unique IDs for access", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "IR plan covering cascade scenarios, incident records" + "notes": "Each agent has a unique service identity — no shared credentials across CDE-facing agents" } ] }, { - "framework": "SOC 2", - "control_id": "Cascade failure risk in risk assessment — blast radius analysis, dependency mapping documented", - "control_name": "CC3.3", + "framework": "PCI DSS v4.0", + "control_id": "Req 8.3", + "control_name": "Req 8.3", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk register with cascade failure entries" + "notes": "Credential management policy, rotation records" } ] }, { - "framework": "SOC 2", - "control_id": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure", - "control_name": "A1.2 — Environmental protections", + "framework": "PCI DSS v4.0", + "control_id": "Req 9.4.6", + "control_name": "Media disposal", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Derived GenAI assets containing CHD disposed of securely — deletion verified per Req 9.4 requirements" } ] }, { "framework": "SOC 2", - "control_id": "Code execution events monitored — syscall patterns, network calls, and filesystem access from sandboxes logged", - "control_name": "CC7.2", + "control_id": "A1.1", + "control_name": "Availability policies", "entries": [ { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Execution audit log, alert configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Code execution is authorised — agent cannot execute code that was not explicitly requested by authorised user", - "control_name": "PI1.1", - "entries": [ + "notes": "Availability SLA, BCP documentation" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI10", + "name": "Rogue Agents", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Code execution authorisation records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Commitment to compliance with applicable laws and regulations including AI-specific obligations", - "control_name": "CC5.1 — Control environment", - "entries": [ + "notes": "Resource monitoring, quota enforcement records" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure" } ] }, { "framework": "SOC 2", - "control_id": "Component changes managed through change management — model updates, framework upgrades, tool changes require security review", - "control_name": "CC8.1", + "control_id": "A1.2", + "control_name": "Environmental protections", "entries": [ { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Change management records, security review sign-offs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data", - "control_name": "C1.1 — Confidentiality policy", - "entries": [ + "notes": "Rate limiting and resource controls protect LLM service availability — implemented and monitored" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Context minimisation for tool calls — tools receive minimum confidential data required for function", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Monitoring dashboards, alert configuration" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure" } ] }, { "framework": "SOC 2", - "control_id": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level", - "control_name": "CC6.1 — Logical access", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "entries": [ { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Continuous monitoring for rogue agent behaviour — actions outside authorised scope detected and alerted", - "control_name": "CC7.2", - "entries": [ + "notes": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent action audit log, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use", - "control_name": "CC9.2 — Vendor agreements", - "entries": [ + "notes": "Secrets management configuration, access control evidence" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions", - "control_name": "CC9.2 — Vendor agreements", - "entries": [ + "notes": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification", - "control_name": "CC9.2 — Vendor agreements", - "entries": [ + "notes": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data" + }, { - "id": "LLM04", - "name": "Supply Chain", - "source_list": "LLM-Top10-2026", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)" } ] }, { "framework": "SOC 2", - "control_id": "Control activities define acceptable agent actions — agent cannot deviate from authorised goal scope", - "control_name": "CC5.2", + "control_id": "C2.1", + "control_name": "Confidential information protection", "entries": [ { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent permission policy, goal-state verification design documentation" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Control activities define permitted code execution scope — sandbox requirements, approved languages, forbidden operations", - "control_name": "CC5.2", - "entries": [ - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Code execution policy, sandbox configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Control activities define tool permission scope — which tools are permitted, which parameters are valid, which actions require confirmation", - "control_name": "CC5.2", - "entries": [ + "notes": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning" + }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Tool permission policy, permitted action allowlist" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Controls on memory store write access — only authorised processes may write to agent memory stores", - "control_name": "CC5.2", - "entries": [ + "notes": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config" + }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": "Memory access policy, write access controls" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Credential usage monitored — anomalous scope expansion or after-session access detected", - "control_name": "CC7.3", - "entries": [ + "notes": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Credential audit log, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Credentials revoked at session end — no persistent credential caching in agent memory after session terminates", - "control_name": "CC6.3", - "entries": [ + "notes": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning" + }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Session termination logs, credential TTL configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Cross-session access anomalies monitored — unusual retrieval patterns detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Context minimisation for tool calls — tools receive minimum confidential data required for function" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "User session context classified as confidential — technical isolation controls" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Vector store content encrypted at rest — embeddings of confidential data protected" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection" } ] }, { "framework": "SOC 2", - "control_id": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "control_id": "CC2.1", + "control_name": "Communication", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements" } ] }, { "framework": "SOC 2", - "control_id": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment identifies threats and vulnerabilities", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed" + }, { "id": "LLM03", "name": "Excessive Agency", @@ -40474,47 +37044,53 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Execution sandboxes access-controlled — no host filesystem or network access without authorisation", - "control_name": "CC6.1", - "entries": [ + "notes": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius" + }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Sandbox configuration, access control evidence" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors" + }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "LLM06", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Goal hijack risk identified in risk assessment — prompt injection, indirect injection, multi-turn manipulation documented", - "control_name": "CC3.2", - "entries": [ + "notes": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed" + }, + { + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case" + }, + { + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content" + }, { "id": "ASI01", "name": "Agent Goal Hijack", @@ -40523,157 +37099,112 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Risk register with goal hijack entries, treatment status" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Ingestion anomaly detection — unusual payloads detected before pipeline completion", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Re-identification risk in synthetic datasets identified in risk assessment" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Over-broad context risks identified — cross-trust-domain aggregation assessed" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing", - "control_name": "PI1.2 — System inputs complete and accurate", - "entries": [ + "notes": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed" + }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed", - "control_name": "CC5.2 — Select and develop control activities", - "entries": [ + "notes": "Silent RAG degradation identified as availability risk in assessment" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation", - "control_name": "CC5.2 — Select and develop control activities", - "entries": [ + "notes": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed" } ] }, { "framework": "SOC 2", - "control_id": "Integrity checks required before component deployment — cryptographic verification of model weights and tool descriptors", - "control_name": "CC5.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "entries": [ { "id": "ASI04", @@ -40682,94 +37213,66 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Integrity verification configuration, deployment logs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inter-agent authentication required — all agent-to-agent messages authenticated before acting", - "control_name": "CC6.1", - "entries": [ + "notes": "Risk register with supply chain entries" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "mTLS configuration, certificate management records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inter-agent communication policy — which agents may communicate with which, under what conditions, with what data", - "control_name": "CC5.2", - "entries": [ + "notes": "Risk register with memory poisoning entries" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Inter-agent communication policy document" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Inter-agent traffic monitored — unexpected communication patterns, unauthorised agent requests detected", - "control_name": "CC7.2", - "entries": [ + "notes": "Risk register with cascade failure entries" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Inter-agent traffic logs, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Risk register with trust exploitation entries" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Risk register with rogue agent scenarios" } ] }, { "framework": "SOC 2", - "control_id": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC5.1", + "control_name": "Control environment", "entries": [ { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Commitment to compliance with applicable laws and regulations including AI-specific obligations" } ] }, { "framework": "SOC 2", - "control_id": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access", - "control_name": "CC6.1 — Logical access restrictions", + "control_id": "CC5.2", + "control_name": "Select and develop control activities", "entries": [ { "id": "LLM01", @@ -40778,175 +37281,116 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring", - "control_name": "CC9.1 — Vendor risk management", - "entries": [ + "notes": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources", - "control_name": "PI1.2 — System inputs are complete and accurate", - "entries": [ + "notes": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced" + }, { - "id": "LLM07", - "name": "Misinformation", + "id": "LLM08", + "name": "Hidden Context Exposure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM model updates and component changes managed through change management — approval, testing, rollback", - "control_name": "CC8.1 — Change management", - "entries": [ + "notes": "System prompt security procedures — version control, rotation, extraction resistance testing documented" + }, { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery", - "control_name": "PI1.3 — Outputs complete and accurate", - "entries": [ + "notes": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent permission policy, goal-state verification design documentation" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool permission policy, permitted action allowlist" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure", - "control_name": "A1.1 — Availability policy", - "entries": [ + "notes": "Code execution policy, sandbox configuration" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability", - "control_name": "A1.1 — Availability policies", - "entries": [ + "notes": "Memory access policy, write access controls" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access restrictions", - "entries": [ + "notes": "Inter-agent communication policy document" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope", - "control_name": "CC6.3 — Access removal", - "entries": [ + "notes": "Agent credential lifecycle procedures — issuance, rotation, revocation documented" + }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "LLM-generated query results validated — destructive or over-broad queries blocked before execution", - "control_name": "PI1.3 — Outputs complete and accurate", - "entries": [ + "notes": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures" + }, { "id": "DSGAI12", "name": "Unsafe Natural Language Data Gateways", @@ -40954,47 +37398,8 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Logical access controls enforce tool permissions — agent cannot invoke tools outside authorised scope", - "control_name": "CC6.1", - "entries": [ - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool invocation logs, access rejection records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Memory poisoning risk documented in risk assessment — scenarios for RAG, persistent memory, and context window corruption", - "control_name": "CC3.3", - "entries": [ - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Risk register with memory poisoning entries" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Minimum-necessary context injection procedures — documented and enforced", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "Query allowlisting and human confirmation procedures documented" + }, { "id": "DSGAI15", "name": "Over-Broad Context Windows", @@ -41002,111 +37407,94 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Minimum-necessary context injection procedures — documented and enforced" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement" } ] }, { "framework": "SOC 2", - "control_id": "Model extraction pattern monitoring — unusual query diversity and volume detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC5.3", + "control_name": "COSO principle 12 — Policies and procedures", "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Integrity verification configuration, deployment logs" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "AI disclosure policy, UI evidence" } ] }, { "framework": "SOC 2", - "control_id": "Model output anomaly monitoring — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC6.1", + "control_name": "Logical access restrictions", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Model promotions managed through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", - "entries": [ + "notes": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Model promotions through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", - "entries": [ + "notes": "Access controls on RAG data sources — users retrieve only data they are authorised to access" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Monitoring for anomalous tool invocations — destructive parameters, out-of-scope tools, unexpected sequences detected", - "control_name": "CC7.2", - "entries": [ + "notes": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access in any environment" + }, { "id": "ASI02", "name": "Tool Misuse and Exploitation", @@ -41114,111 +37502,71 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool call audit log, anomaly alert records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Tool invocation logs, access rejection records" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Credential lifecycle records, provisioning logs" + }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Sandbox configuration, access control evidence" + }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Output monitoring for reconstruction indicators — systematic query patterns detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "mTLS configuration, certificate management records" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Over-broad context risks identified — cross-trust-domain aggregation assessed", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Permission policy, access control configuration" + }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information accessed by labellers documented — purpose, scope, and safeguards", - "control_name": "P3.1 — Personal information collection", - "entries": [ + "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access" + }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information extracted from multimodal inputs subject to same use restrictions as source data", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Tool access scoped to minimum required — agent tool permissions as privileged access" + }, { "id": "DSGAI09", "name": "Multimodal Cross-Channel Leakage", @@ -41226,47 +37574,35 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Access controls on multimodal content stores — same rigour as equivalent text data stores" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Strict session isolation — each user's context inaccessible to all other sessions" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented", - "control_name": "P3.1 — Personal information collection", - "entries": [ + "notes": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in telemetry used only for authorised purposes — same restrictions as production data", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "RBAC on all vector store collections — no unauthenticated access" + }, { "id": "DSGAI14", "name": "Excessive Telemetry and Monitoring Leakage", @@ -41274,127 +37610,103 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Access controls on telemetry stores — same rigour as production data stores" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations", - "control_name": "P4.1 — Privacy information lifecycle", - "entries": [ + "notes": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "API rate limiting as access control limiting systematic model extraction" } ] }, { "framework": "SOC 2", - "control_id": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases", - "control_name": "P5.1 — Personal information use", + "control_id": "CC6.3", + "control_name": "Access removal", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)", - "control_name": "C1.1 — Confidentiality policy", - "entries": [ + "notes": "Session termination logs, credential TTL configuration" + }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs" } ] }, { "framework": "SOC 2", - "control_id": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "CC7.2", + "control_name": "Anomaly and threat detection", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs", - "control_name": "C1.1 — Confidentiality policy", - "entries": [ + "notes": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact" + }, + { + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases", - "control_name": "PI1.1 — Processing integrity policy", - "entries": [ + "notes": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted" + }, { "id": "LLM07", "name": "Misinformation", @@ -41402,15 +37714,26 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing", - "control_name": "PI1.1 — Processing integrity policies", - "entries": [ + "notes": "Production monitoring for accuracy degradation and hallucination patterns — drift detection" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Access to system prompt storage monitored — anomalous access attempts detected and alerted" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected" + }, { "id": "LLM10", "name": "Improper Output Handling", @@ -41418,47 +37741,35 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted", - "control_name": "PI1.1 — Processing integrity policy", - "entries": [ + "notes": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability", - "control_name": "P1.1 — Privacy management", - "entries": [ + "notes": "Monitoring configuration, alert logs, incident records" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Processing based on compromised memory is not authorised — memory integrity controls support PI1 evidence", - "control_name": "PI1.1", - "entries": [ + "notes": "Tool call audit log, anomaly alert records" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Execution audit log, alert configuration" + }, { "id": "ASI06", "name": "Memory and Context Poisoning", @@ -41466,159 +37777,89 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Integrity verification configuration" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Production monitoring for accuracy degradation and hallucination patterns — drift detection", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Memory access log, anomaly alert configuration" + }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed", - "control_name": "CC3.2 — Risk assessment identifies threats and vulnerabilities", - "entries": [ + "notes": "Inter-agent traffic logs, anomaly alert records" + }, { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Agent action audit log, anomaly alert records" + }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Query allowlisting and human confirmation procedures documented", - "control_name": "CC5.2 — Control activities", - "entries": [ + "notes": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Model output anomaly monitoring — poisoning indicators detected before operational impact" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index", - "control_name": "PI1.2 — System inputs complete and accurate", - "entries": [ + "notes": "Ingestion anomaly detection — unusual payloads detected before pipeline completion" + }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected" + }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Rate limiting and resource controls protect LLM service availability — implemented and monitored", - "control_name": "A1.2 — Environmental protections", - "entries": [ + "notes": "Cross-session access anomalies monitored — unusual retrieval patterns detected" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted" + }, { "id": "DSGAI13", "name": "Vector Store Platform Security", @@ -41626,175 +37867,164 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access in any environment", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Vector store query anomaly monitoring — bulk extraction patterns detected" + }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Re-identification risk in synthetic datasets identified in risk assessment", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Access anomaly monitoring on telemetry stores — bulk access patterns detected" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "Output monitoring for reconstruction indicators — systematic query patterns detected" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements", - "control_name": "CC2.1 — Communication", - "entries": [ + "notes": "Model extraction pattern monitoring — unusual query diversity and volume detected" + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production" } ] }, { "framework": "SOC 2", - "control_id": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC7.3", + "control_name": "Security event evaluation", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Credential audit log, anomaly alert records" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "IR plan covering cascade scenarios, incident records" } ] }, { "framework": "SOC 2", - "control_id": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC8.1", + "control_name": "Change management", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM04", + "name": "Supply Chain", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Rogue agent impact on availability — resource consumption by rogue agents does not degrade service for authorised operations", - "control_name": "A1.1", - "entries": [ + "notes": "LLM model updates and component changes managed through change management — approval, testing, rollback" + }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Resource monitoring, quota enforcement records" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Rogue agent risk in risk assessment — autonomous agent operating outside scope is a documented risk", - "control_name": "CC3.3", - "entries": [ + "notes": "Model promotions managed through change management — integrity verification before production deployment" + }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Change management records, security review sign-offs" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Risk register with rogue agent scenarios" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Runtime monitoring for goal-deviation indicators — AI-specific anomaly detection covering instruction-override patterns", - "control_name": "CC7.2", - "entries": [ + "notes": "Model promotions through change management — integrity verification before production deployment" + }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Monitoring configuration, alert logs, incident records" + "notes": "Vector database CVE patching managed through change management — timely remediation documented" } ] }, { "framework": "SOC 2", - "control_id": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring", - "control_name": "CC7.2 — Anomaly and threat detection", + "control_id": "CC9.1", + "control_name": "Vendor risk management", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring" + }, + { + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors", - "control_name": "CC3.2 — Risk assessment", - "entries": [ + "notes": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements" + }, { "id": "DSGAI03", "name": "Shadow AI and Unsanctioned Data Flows", @@ -41802,110 +38032,168 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees" } ] }, { "framework": "SOC 2", - "control_id": "Silent RAG degradation identified as availability risk in assessment", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Vendor assessments, contractual security obligations" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Vendor assessment records for third-party agents" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use" } ] }, { "framework": "SOC 2", - "control_id": "Strict session isolation — each user's context inaccessible to all other sessions", - "control_name": "CC6.1 — Logical access", + "control_id": "P1.1", + "control_name": "Privacy management", "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability" } ] }, { "framework": "SOC 2", - "control_id": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "P3.1", + "control_name": "Personal information collection", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented" + }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", "severity": "Medium", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Personal information accessed by labellers documented — purpose, scope, and safeguards" } ] }, { "framework": "SOC 2", - "control_id": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data", - "control_name": "P4.2 — Retention of personal information", + "control_id": "P4.1", + "control_name": "Privacy information lifecycle", "entries": [ { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations" } ] }, { "framework": "SOC 2", - "control_id": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed", - "control_name": "C2.1 — Confidential information protection", + "control_id": "P4.2", + "control_name": "Retention of personal information", "entries": [ { "id": "DSGAI10", @@ -41914,47 +38202,33 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Medium", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data" } ] }, { "framework": "SOC 2", - "control_id": "System prompt security procedures — version control, rotation, extraction resistance testing documented", - "control_name": "CC5.2 — Control activities", + "control_id": "P5.1", + "control_name": "Personal information use", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases" + }, { - "id": "LLM08", - "name": "Hidden Context Exposure", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms" + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -41962,247 +38236,215 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases" + }, { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Personal information extracted from multimodal inputs subject to same use restrictions as source data" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Third-party agentic components assessed — agent frameworks, tool vendors, model providers subject to vendor risk management", - "control_name": "CC9.2", - "entries": [ + "notes": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation" + }, { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Vendor assessments, contractual security obligations" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Third-party agents treated as vendor risk — agents from external providers assessed before integration", - "control_name": "CC9.2", - "entries": [ + "notes": "Personal information in telemetry used only for authorised purposes — same restrictions as production data" + }, { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Vendor assessment records for third-party agents" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Tool access scoped to minimum required — agent tool permissions as privileged access", - "control_name": "CC6.1 — Logical access", - "entries": [ + "notes": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation" + }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task" } ] }, { "framework": "SOC 2", - "control_id": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use", - "control_name": "CC9.1 — Vendor risk", + "control_id": "P7.1", + "control_name": "P7.1", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Accuracy review procedures" } ] }, { "framework": "SOC 2", - "control_id": "Tool invocations are complete and accurate — parameter validation ensures tool calls match intended business operation", - "control_name": "PI1.2", + "control_id": "PI1.1", + "control_name": "Processing integrity policy", "entries": [ { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Validation configuration, rejected call logs" - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases" + }, { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed", - "control_name": "CC9.1 — Vendor risk", - "entries": [ + "notes": "Action audit log, authorisation records per agent session" + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Trust exploitation risk in risk assessment — social engineering, impersonation, false urgency scenarios documented", - "control_name": "CC3.3", - "entries": [ + "notes": "Code execution authorisation records" + }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Integrity verification configuration" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Risk register with trust exploitation entries" + "notes": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted" } ] }, { "framework": "SOC 2", - "control_id": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope", - "control_name": "CC3.2 — Risk assessment", + "control_id": "PI1.2", + "control_name": "System inputs are complete and accurate", "entries": [ { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "User session context classified as confidential — technical isolation controls", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources" + }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Validation configuration, rejected call logs" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation", - "control_name": "P5.1 — Personal information use", - "entries": [ + "notes": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing" + }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index" } ] }, { "framework": "SOC 2", - "control_id": "Vector database CVE patching managed through change management — timely remediation documented", - "control_name": "CC8.1 — Change management", + "control_id": "PI1.3", + "control_name": "PI1.3", "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Vector store content encrypted at rest — embeddings of confidential data protected", - "control_name": "C2.1 — Confidential information protection", - "entries": [ + "notes": "Output quality controls, factual accuracy testing" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "SOC 2", - "control_id": "Vector store query anomaly monitoring — bulk extraction patterns detected", - "control_name": "CC7.2 — Anomaly detection", - "entries": [ + "notes": "LLM-generated query results validated — destructive or over-broad queries blocked before execution" + }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery" } ] }, diff --git a/docs/data.js b/docs/data.js index a1a805b..e265859 100644 --- a/docs/data.js +++ b/docs/data.js @@ -95,8 +95,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Providers of high-risk AI must implement a risk management system covering all reasonably foreseeable risks", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system", @@ -105,8 +105,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI systems must be resilient to adversarial inputs and attempts to alter outputs or performance", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Robustness against prompt injection is a technical compliance requirement — not optional", @@ -115,8 +115,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Providers of systemic risk GPAI models must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models", @@ -199,7 +199,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -209,40 +209,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure application development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure application development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Secure development standards covering LLM integration — input validation, context separation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.2 Implement code review", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.2", + "control_name": "Implement code review", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Code review for all LLM integration code — prompt injection patterns reviewed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing programme", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-18", "notes": "Adversarial testing programme covering prompt injection scenarios", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis", "confidence": "unreviewed", "reviewed_by": [] @@ -359,8 +363,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious code and logic attacks via IT/OT convergence", - "control_name": "Section 5.3 — Threats", + "control_id": "§5.3", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary", @@ -369,8 +373,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Identify threats, vulnerabilities, and impacts for all OT systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Prompt injection documented in OT risk assessment for each LLM integration", @@ -379,8 +383,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Defense-in-depth network architecture with validated data flows", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§7.2", + "control_name": "Network segmentation", "tier": "Foundational", "scope": "Both", "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM", @@ -389,40 +393,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", + "control_id": "SI-10", + "control_name": "Information Input Validation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Treat prompt injection as a malicious code analog — detection and response controls required", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope", "confidence": "unreviewed", "reviewed_by": [] @@ -469,37 +466,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed", - "control_name": "CC3.2 — Risk assessment identifies threats and vulnerabilities", + "control_id": "CC3.2", + "control_name": "Risk assessment identifies threats and vulnerabilities", "tier": "Foundational", "scope": "Both", + "notes": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring", - "control_name": "CC7.2 — Anomaly and threat detection", + "control_id": "CC7.2", + "control_name": "Anomaly and threat detection", "tier": "Foundational", "scope": "Both", + "notes": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed", - "control_name": "CC5.2 — Select and develop control activities", + "control_id": "CC5.2", + "control_name": "Select and develop control activities", "tier": "Foundational", "scope": "Both", + "notes": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access", - "control_name": "CC6.1 — Logical access restrictions", + "control_id": "CC6.1", + "control_name": "Logical access restrictions", "tier": "Foundational", "scope": "Both", + "notes": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access", "confidence": "unreviewed", "reviewed_by": [] }, @@ -653,7 +654,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -663,7 +664,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-74", - "control_name": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/74.html", @@ -673,7 +674,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-77", - "control_name": "CWE-77", + "control_name": "Command Injection", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/77.html", @@ -682,8 +683,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection via all input channels", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes", @@ -692,8 +693,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal consistency under adversarial input", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection", @@ -702,8 +703,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Injection detection audit trail", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response", @@ -966,8 +967,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius proportional to credential scope", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Apply least-privilege to all LLM application credentials", @@ -976,8 +977,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injected session can use stolen long-lived tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Rotate all LLM application tokens; implement short-lived token pattern", @@ -1537,8 +1538,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data for high-risk AI must be relevant, representative, free of errors, and complete — must address privacy", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs", @@ -1547,8 +1548,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Users must receive information about capabilities, limitations, and conditions of use", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Disclosure of potential data disclosure risks is a transparency obligation", @@ -1557,8 +1558,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented quality management system including post-market monitoring", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents", @@ -1567,8 +1568,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025", @@ -1661,40 +1662,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish and maintain data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish and maintain data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "Data classification and handling requirements applied to all LLM data assets", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "Embeddings, training data, and RAG caches containing sensitive data encrypted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "notes": "User training on LLM data handling — what data should not be shared with LLMs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated", "confidence": "unreviewed", "reviewed_by": [] @@ -1791,8 +1796,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information disclosure and OT espionage", - "control_name": "Section 5.4 — Threats", + "control_id": "§5.4", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "LLMs with historian access as a new vector for automated OT intelligence gathering", @@ -1801,8 +1806,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess confidentiality of OT data", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "OT data classification applied to all data accessible by LLMs", @@ -1811,8 +1816,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting OT data at rest and in transit", - "control_name": "Section 7.3 — Data protection", + "control_id": "§7.3", + "control_name": "Data protection", "tier": "Foundational", "scope": "Both", "notes": "Encryption and access controls on all OT data paths feeding LLM context", @@ -1821,40 +1826,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Audit Information", - "control_name": "AU-9", + "control_id": "AU-9", + "control_name": "Protection of Audit Information", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM", "confidence": "unreviewed", "reviewed_by": [] @@ -1901,46 +1899,51 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented", - "control_name": "P3.1 — Personal information collection", + "control_id": "P3.1", + "control_name": "Personal information collection", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on RAG data sources — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on RAG data sources — users retrieve only data they are authorised to access", "confidence": "unreviewed", "reviewed_by": [] }, @@ -2095,7 +2098,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -2105,7 +2108,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -2115,7 +2118,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -2124,8 +2127,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "PII and sensitive data extraction from outputs", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Foundational", "scope": "Both", "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques", @@ -2134,8 +2137,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Output DLP effectiveness", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery", @@ -2144,8 +2147,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Data access authorisation enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level", @@ -2365,8 +2368,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "LLM outputs containing API keys, tokens, or credentials", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Output filtering: detect and redact credential patterns in all outputs", @@ -2375,8 +2378,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials in plaintext config files ingested by LLM", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Audit all config and data sources for embedded credentials", @@ -2732,8 +2735,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Autonomy-related risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Excessive agency scenarios required in risk management system", @@ -2742,8 +2745,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI systems designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation", @@ -2752,8 +2755,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Deployers must ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "tier": "Foundational", "scope": "Both", "notes": "Deployers cannot waive Art. 14 human oversight requirements", @@ -2836,7 +2839,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.5", + "control_id": "5", "control_name": "Policy", "tier": "Foundational", "scope": "Both", @@ -2846,30 +2849,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "LLM tool access managed as privileged access — minimum scope, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "6.1 Establish access granting process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "6.1", + "control_name": "Establish access granting process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "notes": "Formal process for granting LLM tool access — documented justification required", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All LLM tool invocations logged — every tool call auditable with parameters", "confidence": "unreviewed", "reviewed_by": [] @@ -2956,8 +2962,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Unauthorised command execution via IT/OT interfaces", - "control_name": "Section 5.3 — Threats", + "control_id": "§5.3", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "LLM autonomous actions as a new path for unauthorised command execution", @@ -2966,8 +2972,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess impact of unauthorised access and control", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface", @@ -2976,8 +2982,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Minimal necessary connectivity at IT/OT boundary", - "control_name": "Section 7.1 — Architecture", + "control_id": "§7.1", + "control_name": "Architecture", "tier": "Foundational", "scope": "Both", "notes": "LLM access to OT systems restricted to minimum required — read-only by default", @@ -2986,40 +2992,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Privilege", - "control_name": "AC-6", + "control_id": "AC-6", + "control_name": "Least Privilege", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action", "confidence": "unreviewed", "reviewed_by": [] @@ -3066,37 +3065,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access restrictions", + "control_id": "CC6.1", + "control_name": "Logical access restrictions", "tier": "Foundational", "scope": "Both", + "notes": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope", - "control_name": "CC6.3 — Access removal", + "control_id": "CC6.3", + "control_name": "Access removal", "tier": "Foundational", "scope": "Both", + "notes": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius", "confidence": "unreviewed", "reviewed_by": [] }, @@ -3250,7 +3253,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-269", - "control_name": "CWE-269", + "control_name": "Improper Privilege Management", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/269.html", @@ -3260,7 +3263,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-272", - "control_name": "CWE-272", + "control_name": "Least Privilege Violation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/272.html", @@ -3270,7 +3273,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -3279,8 +3282,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Permission scope enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions", @@ -3289,8 +3292,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Irreversibility gate enforcement", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs", @@ -3299,8 +3302,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Action audit completeness", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review", @@ -3541,8 +3544,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Tool/API credentials with more scope than task requires", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum credential scope per tool integration", @@ -3551,8 +3554,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tool credentials enable extended unauthorised access", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived JIT credentials per task (see RECIPES.md)", @@ -3561,8 +3564,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple tools — compromise of one exposes all", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per tool integration", @@ -3992,8 +3995,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Supply chain risks must be identified and mitigated in the risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Third-party component risks are in scope for Art. 9 risk management", @@ -4002,8 +4005,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Quality management must cover supply chain controls", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Documented supply chain security procedures required", @@ -4012,8 +4015,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Responsibilities distributed along the AI value chain between providers and deployers", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Providers must document what deployers inherit — deployers must verify", @@ -4022,8 +4025,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must document training data governance including third-party sources", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Third-party training data provenance is a GPAI documentation obligation", @@ -4116,30 +4119,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software asset inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", + "control_id": "2.1", + "control_name": "Establish and maintain software asset inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "notes": "ML SBOM maintained as part of software asset inventory — model versions, libraries, adapters", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management process", - "control_name": "CIS 7 — Continuous Vulnerability Management", + "control_id": "7.1", + "control_name": "Establish vulnerability management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-7", "notes": "Vulnerability management process covers LLM component CVEs and dependency risks", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.6 Use only up-to-date and trusted third-party components", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.6", + "control_name": "Use only up-to-date and trusted third-party components", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Only approved, verified LLM components used in production — unsigned components rejected", "confidence": "unreviewed", "reviewed_by": [] @@ -4206,8 +4212,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party software compromise as OT attack vector", - "control_name": "Section 5.5 — Supply chain threats", + "control_id": "§5.5", + "control_name": "Supply chain threats", "tier": "Foundational", "scope": "Both", "notes": "LLM model weights and plugins as supply chain risk components", @@ -4216,8 +4222,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk treatment", - "control_name": "Section 6.3 — Risk response", + "control_id": "§6.3", + "control_name": "Risk response", "tier": "Foundational", "scope": "Both", "notes": "ML SBOM and component integrity verification as supply chain controls", @@ -4226,8 +4232,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT supply chain risk management programme", - "control_name": "Section 8.4 — Supply chain programme", + "control_id": "§8.4", + "control_name": "Supply chain programme", "tier": "Foundational", "scope": "Both", "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors", @@ -4236,40 +4242,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Protection", - "control_name": "SA-12", + "control_id": "SA-12", + "control_name": "Supply Chain Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply Chain Controls and Plans", - "control_name": "SR-3", + "control_id": "SR-3", + "control_name": "Supply Chain Controls and Plans", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Documented supply chain security plan covering LLM components in OT deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supplier Assessments and Reviews", - "control_name": "SR-6", + "control_id": "SR-6", + "control_name": "Supplier Assessments and Reviews", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Periodic security assessment of LLM vendors with OT-deployed components", "confidence": "unreviewed", "reviewed_by": [] @@ -4316,37 +4315,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring", - "control_name": "CC9.1 — Vendor risk management", + "control_id": "CC9.1", + "control_name": "Vendor risk management", "tier": "Foundational", "scope": "Both", + "notes": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification", - "control_name": "CC9.2 — Vendor agreements", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "tier": "Foundational", "scope": "Both", + "notes": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM model updates and component changes managed through change management — approval, testing, rollback", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Foundational", "scope": "Both", + "notes": "LLM model updates and component changes managed through change management — approval, testing, rollback", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -4500,7 +4503,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-494", - "control_name": "CWE-494", + "control_name": "Download of Code Without Integrity Check", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/494.html", @@ -4510,7 +4513,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -4520,7 +4523,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-1357", - "control_name": "CWE-1357", + "control_name": "Reliance on Insufficiently Trustworthy Component", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/1357.html", @@ -4529,8 +4532,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Component integrity verification", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Foundational", "scope": "Both", "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components", @@ -4539,8 +4542,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor behaviour detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain", @@ -4549,8 +4552,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Plugin and tool descriptor integrity", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components", @@ -4824,8 +4827,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party plugin tokens with excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review all third-party credentials; apply minimum scope", @@ -4834,8 +4837,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party dev/staging credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for all third-party integrations", @@ -4844,8 +4847,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party component credentials exposed in shared config", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Separate credential stores per third-party component", @@ -5188,8 +5191,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data poisoning must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Poisoning attack scenarios required in Art. 9 risk assessment", @@ -5198,8 +5201,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Data quality controls preventing poisoning are a compliance requirement", @@ -5208,8 +5211,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Technical robustness against poisoning is a binding Art. 15 requirement", @@ -5218,8 +5221,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify model-level risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI adversarial testing", "tier": "Hardening", "scope": "Both", "notes": "Poisoning detection is in scope for Art. 55 adversarial testing", @@ -5312,40 +5315,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "7.5 Perform automated vulnerability scanning", - "control_name": "CIS 7 — Continuous Vulnerability Management", + "control_id": "7.5", + "control_name": "Perform automated vulnerability scanning", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.7 Use standard hardening configuration templates", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.7", + "control_name": "Use standard hardening configuration templates", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Hardened training pipeline configurations — immutable infrastructure, locked data sources", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.3 Remediate penetration testing findings", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.3", + "control_name": "Remediate penetration testing findings", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "notes": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.12 Collect service provider logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.12", + "control_name": "Collect service provider logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "Full audit trail of training data provenance and model training runs", "confidence": "unreviewed", "reviewed_by": [] @@ -5412,8 +5419,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting OT data and system integrity", - "control_name": "Section 5.3 — Integrity threats", + "control_id": "§5.3", + "control_name": "Integrity threats", "tier": "Hardening", "scope": "Both", "notes": "Model poisoning as an integrity attack on the LLM advisory system", @@ -5422,8 +5429,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess integrity risks for all OT-connected systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Model poisoning scenarios included in OT risk assessment for each LLM", @@ -5432,8 +5439,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Layered controls to maintain system integrity", - "control_name": "Section 7.2 — Defense-in-depth", + "control_id": "§7.2", + "control_name": "Defense-in-depth", "tier": "Hardening", "scope": "Both", "notes": "Independent validation of LLM outputs against rule-based reference systems", @@ -5442,40 +5449,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Hardening", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Software, Firmware, and Information Integrity", - "control_name": "SI-7", + "control_id": "SI-7", + "control_name": "Software, Firmware, and Information Integrity", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Model integrity verification before each OT deployment — hash-based integrity check", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", + "control_id": "SI-10", + "control_name": "Information Input Validation", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Training data validation — adversarial content detected and rejected before training", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis", "confidence": "unreviewed", "reviewed_by": [] @@ -5522,37 +5522,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Threat detection", + "control_id": "CC7.2", + "control_name": "Threat detection", "tier": "Hardening", "scope": "Both", + "notes": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model promotions managed through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Hardening", "scope": "Both", + "notes": "Model promotions managed through change management — integrity verification before production deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Hardening", "scope": "Both", + "notes": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5697,7 +5701,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -5707,7 +5711,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-346", - "control_name": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/346.html", @@ -5717,7 +5721,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -5726,8 +5730,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Training data integrity verification", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Hardening", "scope": "Both", "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples", @@ -5736,8 +5740,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Backdoor trigger detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Hardening", "scope": "Both", "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present", @@ -5746,8 +5750,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Dataset provenance verification", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Hardening", "scope": "Both", "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline", @@ -5999,8 +6003,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Write access to training data stores enables poisoning", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Read-only credentials for data consumption; separate write credentials with MFA", @@ -6009,8 +6013,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party data pipeline credentials with training data write access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Hardening", "scope": "Both", "notes": "Apply NHI-3 controls to all data pipeline third-party credentials", @@ -6352,8 +6356,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Availability risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Resource exhaustion and DoS scenarios included in risk management system", @@ -6362,8 +6366,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must remain available under adversarial conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Technical resilience against denial-of-service attacks is an Art. 15 requirement", @@ -6372,8 +6376,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Operational continuity procedures documented", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Post-market monitoring and incident response for availability failures required", @@ -6446,7 +6450,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -6456,7 +6460,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "tier": "Foundational", "scope": "Both", @@ -6466,30 +6470,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration includes resource limits — token caps, rate limits, cost budgets", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use of network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.6", + "control_name": "Use of network-based URL filters", "tier": "Foundational", "scope": "Both", + "parent": "CIS-12", "notes": "Rate limiting and traffic controls at the API gateway and network layer", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for consumption anomalies — automated rate limiting, session suspension, alerting", "confidence": "unreviewed", "reviewed_by": [] @@ -6566,8 +6573,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of service attacks targeting OT availability", - "control_name": "Section 5.6 — DoS threats", + "control_id": "§5.6", + "control_name": "DoS threats", "tier": "Foundational", "scope": "Both", "notes": "LLM-induced resource exhaustion as a DoS vector affecting shared OT network infrastructure", @@ -6576,8 +6583,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess availability risks for OT systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "LLM resource consumption impact assessed on shared OT network and compute infrastructure", @@ -6586,8 +6593,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network architecture preventing DoS propagation", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§7.2", + "control_name": "Network segmentation", "tier": "Foundational", "scope": "Both", "notes": "LLM infrastructure isolated from OT control network — bandwidth caps at DMZ boundary", @@ -6596,40 +6603,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Denial of Service Protection", - "control_name": "SC-5", + "control_id": "SC-5", + "control_name": "Denial of Service Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM infrastructure protected against resource exhaustion attacks affecting OT availability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Fail-Safe Procedures", - "control_name": "SI-17", + "control_id": "SI-17", + "control_name": "Fail-Safe Procedures", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Audit Record Generation", - "control_name": "AU-12", + "control_id": "AU-12", + "control_name": "Audit Record Generation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM resource consumption logged — patterns indicating exhaustion attacks detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -6676,37 +6676,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability", - "control_name": "A1.1 — Availability policies", + "control_id": "A1.1", + "control_name": "Availability policies", "tier": "Foundational", "scope": "Both", + "notes": "LLM service availability commitments documented — SLAs, RTO/RPO, resource limits that protect availability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Rate limiting and resource controls protect LLM service availability — implemented and monitored", - "control_name": "A1.2 — Environmental protections", + "control_id": "A1.2", + "control_name": "Environmental protections", "tier": "Foundational", "scope": "Both", + "notes": "Rate limiting and resource controls protect LLM service availability — implemented and monitored", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Real-time monitoring of LLM resource consumption — cost anomalies and unusual volume patterns alerted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Resource exhaustion risks identified in LLM risk assessment — DoS and sponge attack vectors assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -6842,7 +6846,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-400", - "control_name": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/400.html", @@ -6852,7 +6856,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-770", - "control_name": "CWE-770", + "control_name": "Allocation of Resources Without Limits or Throttling", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/770.html", @@ -6862,7 +6866,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-799", - "control_name": "CWE-799", + "control_name": "Improper Control of Interaction Frequency", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/799.html", @@ -6871,8 +6875,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Resource exhaustion and rate limiting", - "control_name": "AVT — Availability", + "control_id": "AVT", + "control_name": "Availability", "tier": "Foundational", "scope": "Both", "notes": "Test rate limiting enforcement, token budget controls, and compute throttling under load; verify graceful degradation", @@ -6881,8 +6885,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Consumption anomaly detection", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring detects abnormal consumption patterns — token flooding, API abuse, wallet drainage — before service impact", @@ -6891,8 +6895,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Per-user quota enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify per-user and per-tenant quotas are enforced and cannot be bypassed through session switching or credential abuse", @@ -7090,8 +7094,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Single credential with access to multiple services — one exhaustion affects all", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per service with independent quotas", @@ -7100,8 +7104,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credential used across services — quota exhaustion in one affects all", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per integration", @@ -7419,8 +7423,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI system information must include accuracy metrics and known limitations", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Hallucination rates and accuracy limitations must be disclosed to deployers and users", @@ -7429,8 +7433,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "AI-generated content must be marked as such — chatbots must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", + "control_id": "Art. 50", + "control_name": "Transparency for certain AI systems", "tier": "Foundational", "scope": "Both", "notes": "Mandatory AI disclosure prevents users from treating hallucinated content as authoritative human output", @@ -7439,8 +7443,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must assess and mitigate risks including disinformation", - "control_name": "Art. 55(1)(a) — Systemic risk GPAI", + "control_id": "Art. 55(1)(a)", + "control_name": "Systemic risk GPAI", "tier": "Foundational", "scope": "Both", "notes": "Misinformation risk assessment and mitigation is a binding obligation for systemic risk models", @@ -7533,30 +7537,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "notes": "User training on LLM output limitations — verification requirements and critical evaluation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for LLM misinformation incidents — correction, notification, root cause", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "RAG data governance — quality and freshness controls on retrieval sources", "confidence": "unreviewed", "reviewed_by": [] @@ -7623,8 +7630,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks degrading the reliability of OT decision-support", - "control_name": "Section 5.3 — Integrity threats", + "control_id": "§5.3", + "control_name": "Integrity threats", "tier": "Foundational", "scope": "Both", "notes": "LLM misinformation as an integrity attack on operator decision-making", @@ -7633,8 +7640,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess reliability of OT advisory systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "LLM accuracy limitations assessed in OT risk assessment per use case", @@ -7643,8 +7650,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security awareness and training", - "control_name": "Section 8.2 — Training", + "control_id": "§8.2", + "control_name": "Training", "tier": "Foundational", "scope": "Both", "notes": "Operator training on LLM limitations and verification requirements", @@ -7653,40 +7660,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM advisory outputs restricted to defined advisory roles — never authoritative source for safety-critical procedures", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Role-Based Training", - "control_name": "AT-3", + "control_id": "AT-3", + "control_name": "Role-Based Training", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools", "confidence": "unreviewed", "reviewed_by": [] @@ -7733,37 +7733,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases", - "control_name": "PI1.1 — Processing integrity policy", + "control_id": "PI1.1", + "control_name": "Processing integrity policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy on LLM output accuracy — acceptable accuracy thresholds, verification requirements for high-stakes use cases", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources", - "control_name": "PI1.2 — System inputs are complete and accurate", + "control_id": "PI1.2", + "control_name": "System inputs are complete and accurate", "tier": "Foundational", "scope": "Both", + "notes": "LLM inputs (RAG sources, training data) quality controls — authoritative, current, verified sources", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Misinformation risk identified in LLM risk assessment — harm potential of incorrect outputs per use case", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Production monitoring for accuracy degradation and hallucination patterns — drift detection", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Production monitoring for accuracy degradation and hallucination patterns — drift detection", "confidence": "unreviewed", "reviewed_by": [] }, @@ -7908,7 +7912,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-1021", - "control_name": "CWE-1021", + "control_name": "Improper Restriction of Rendered UI Layers or Frames", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/1021.html", @@ -7918,7 +7922,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-116", - "control_name": "CWE-116", + "control_name": "Improper Encoding or Escaping of Output", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/116.html", @@ -7927,8 +7931,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Factual accuracy and hallucination rate", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Test model outputs against known-correct facts across the deployment use case domain; measure hallucination rate against benchmark ground truth", @@ -7937,8 +7941,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Citation verifiability", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify that citations generated by the LLM are real and accurately represent source content; test that outputs requiring citations enforce this", @@ -7947,8 +7951,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Misinformation incident detection", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify that the monitoring pipeline can detect and flag systematic misinformation patterns — accuracy drift, citation fabrication rate", @@ -8189,8 +8193,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Audit log service credentials leaked or compromised", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Protect audit log credentials as sensitive NHI", @@ -8199,8 +8203,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using LLM service account credentials — no attribution", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce separate human and machine credentials", @@ -8600,8 +8604,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Users must receive sufficient information about the AI system — but this does not require disclosing system prompts", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Transparency obligation must be met without exposing security-sensitive system prompt content", @@ -8610,8 +8614,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Configuration management documented", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "System prompt versions, access controls, and change procedures are quality management artefacts", @@ -8620,8 +8624,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must publish summaries of training data and model capabilities", - "control_name": "Art. 53(1)(b) — GPAI transparency", + "control_id": "Art. 53(1)(b)", + "control_name": "GPAI transparency", "tier": "Foundational", "scope": "Both", "notes": "Published summaries must not inadvertently expose security-sensitive configuration", @@ -8704,7 +8708,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.7", + "control_id": "7", "control_name": "Support", "tier": "Foundational", "scope": "Both", @@ -8714,30 +8718,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "3.1 Establish data management process", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.1", + "control_name": "Establish data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "System prompts classified as sensitive configuration — data handling policy applied", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration for LLM deployments — system prompts not in cleartext config", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "System prompt access logged — unauthorised access attempts detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -8814,8 +8821,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT configuration and topology data as espionage target", - "control_name": "Section 5.4 — Information disclosure", + "control_id": "§5.4", + "control_name": "Information disclosure", "tier": "Foundational", "scope": "Both", "notes": "System prompts containing OT specifics treated as sensitive configuration data", @@ -8824,8 +8831,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protecting sensitive OT data", - "control_name": "Section 7.3 — Data protection", + "control_id": "§7.3", + "control_name": "Data protection", "tier": "Foundational", "scope": "Both", "notes": "System prompt encryption and access controls as data protection measures", @@ -8834,40 +8841,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "System prompts encrypted at rest — not stored in cleartext configuration files", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "System prompt access restricted to authorised personnel — version controlled, access logged", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Audit Information", - "control_name": "AU-9", + "control_id": "AU-9", + "control_name": "Protection of Audit Information", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "System prompt access logs protected — unauthorised access attempts detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -8914,37 +8914,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "System prompts classified as confidential — encryption at rest, access-controlled, not in cleartext config", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on system prompt storage — only authorised personnel can read or modify, all access logged", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "System prompt security procedures — version control, rotation, extraction resistance testing documented", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "System prompt security procedures — version control, rotation, extraction resistance testing documented", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access to system prompt storage monitored — anomalous access attempts detected and alerted", - "control_name": "CC7.2 — Monitoring", + "control_id": "CC7.2", + "control_name": "Monitoring", "tier": "Foundational", "scope": "Both", + "notes": "Access to system prompt storage monitored — anomalous access attempts detected and alerted", "confidence": "unreviewed", "reviewed_by": [] }, @@ -9079,7 +9083,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -9089,7 +9093,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -9099,7 +9103,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-215", - "control_name": "CWE-215", + "control_name": "Insertion of Sensitive Information Into Debugging Code", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/215.html", @@ -9108,8 +9112,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "System prompt extraction via crafted inputs", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Attempt to extract system prompt contents through direct requests, indirect summarisation, translation, and instruction-override techniques", @@ -9118,8 +9122,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential and sensitive content in system prompt", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Foundational", "scope": "Both", "notes": "Verify that credentials, API keys, or sensitive business logic in the system prompt are not reproducible by any input technique", @@ -9128,8 +9132,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Refusal robustness for system prompt disclosure", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify that the model consistently refuses system prompt disclosure across varied request phrasings and social engineering approaches", @@ -9318,8 +9322,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "API keys or tokens embedded in system prompt", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Scan system prompts for credential patterns before deployment", @@ -9328,8 +9332,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "System prompt stored as plaintext config with embedded credentials", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Externalise credentials to vault; reference by ID in system prompt", @@ -9661,8 +9665,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Embedding and retrieval risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Vector store attack scenarios included in risk management system", @@ -9671,8 +9675,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data quality controls applied to all data in scope — including RAG corpora", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Quality controls on embedding generation and vector store ingestion required", @@ -9681,8 +9685,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Embedding manipulation resistance is an Art. 15 technical requirement", @@ -9775,30 +9779,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "notes": "All vector store content encrypted at rest", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management", - "control_name": "CIS 7 — Vulnerability Management", + "control_id": "7.1", + "control_name": "Establish vulnerability management", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "notes": "Vector database CVEs in vulnerability management process — CVE-2024-3584 and equivalents", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Secure coding requirements for vector store integration — RBAC, encryption, input validation", "confidence": "unreviewed", "reviewed_by": [] @@ -9865,8 +9872,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Attacks targeting the integrity of OT decision-support data", - "control_name": "Section 5.3 — Integrity threats", + "control_id": "§5.3", + "control_name": "Integrity threats", "tier": "Hardening", "scope": "Both", "notes": "Vector store poisoning as an integrity attack on LLM knowledge sources", @@ -9875,8 +9882,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Assess integrity risks for all OT-connected systems", - "control_name": "Section 6.2 — Risk assessment", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Vector store integrity included in OT LLM risk assessment", @@ -9885,40 +9892,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Hardening", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Software, Firmware, and Information Integrity", - "control_name": "SI-7", + "control_id": "SI-7", + "control_name": "Software, Firmware, and Information Integrity", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Vector store integrity monitoring — alert on anomalous content or unexpected modifications", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Protection of Information at Rest", - "control_name": "SC-28", + "control_id": "SC-28", + "control_name": "Protection of Information at Rest", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "OT vector store content encrypted at rest", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Access Enforcement", - "control_name": "AC-3", + "control_id": "AC-3", + "control_name": "Access Enforcement", "tier": "Hardening", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "Access controls on OT vector stores — RBAC enforced at collection level", "confidence": "unreviewed", "reviewed_by": [] @@ -9965,37 +9965,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Embeddings of confidential information protected — encrypted at rest, access-controlled, inversion-resistant", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access in any environment", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Hardening", "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access in any environment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Anomaly detection on vector store query patterns — bulk extraction and unusual retrieval volumes detected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Embeddings of personal data used only for authorised purposes — privacy commitments apply to derived forms", "confidence": "unreviewed", "reviewed_by": [] }, @@ -10130,7 +10134,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/327.html", @@ -10140,7 +10144,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-330", - "control_name": "CWE-330", + "control_name": "Use of Insufficiently Random Values", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/330.html", @@ -10150,7 +10154,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -10159,8 +10163,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Embedding inversion and data reconstruction", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Hardening", "scope": "Both", "notes": "Test whether embedding vectors can be inverted to reconstruct training data; verify embedding stores do not leak source content through metadata", @@ -10169,8 +10173,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Vector database security configuration", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Hardening", "scope": "Both", "notes": "Verify vector database is correctly configured — authentication, encryption, namespace isolation, API key protection", @@ -10179,8 +10183,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Retrieval authorisation enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Hardening", "scope": "Both", "notes": "Verify RAG queries cannot retrieve documents above the authenticated user's permission level", @@ -10399,8 +10403,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Embedding store service account with cross-tenant read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-tenant credentials or least-privilege scope restrictions", @@ -10409,8 +10413,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated embedding store access", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Hardening", "scope": "Both", "notes": "Require authentication for all vector database connections", @@ -10736,8 +10740,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Output handling risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Insecure output handling included in risk management system", @@ -10746,8 +10750,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Accurate, robust outputs resilient to misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Output validation and sanitisation are Art. 15 technical requirements", @@ -10756,8 +10760,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented procedures covering output quality", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Post-market monitoring of output handling incidents required", @@ -10840,7 +10844,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.8", + "control_id": "8", "control_name": "Operation", "tier": "Foundational", "scope": "Both", @@ -10850,30 +10854,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Output encoding and sanitisation as secure development requirements", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Log all LLM outputs — injection attempts in model responses detectable", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing", "tier": "Foundational", "scope": "Both", + "parent": "CIS-18", "notes": "Output injection scenarios in penetration testing — XSS, SQL injection via LLM output", "confidence": "unreviewed", "reviewed_by": [] @@ -10960,8 +10967,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Code injection and execution via data paths", - "control_name": "Section 5.3 — Threats", + "control_id": "§5.3", + "control_name": "Threats", "tier": "Foundational", "scope": "Both", "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary", @@ -10970,8 +10977,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Validated data flows across zone boundaries", - "control_name": "Section 7.2 — Network segmentation", + "control_id": "§7.2", + "control_name": "Network segmentation", "tier": "Foundational", "scope": "Both", "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems", @@ -10980,40 +10987,33 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Title", - "control_name": "Control", - "tier": "Foundational", - "scope": "Both", - "notes": "Application", - "confidence": "unreviewed", - "reviewed_by": [] - }, - { - "framework": "NIST SP 800-82 Rev 3", - "control_id": "Information Input Validation", - "control_name": "SI-10", + "control_id": "SI-10", + "control_name": "Information Input Validation", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Malicious Code Protection", - "control_name": "SI-3", + "control_id": "SI-3", + "control_name": "Malicious Code Protection", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "LLM output scanning for malicious content before OT system ingestion", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Least Functionality", - "control_name": "CM-7", + "control_id": "CM-7", + "control_name": "Least Functionality", "tier": "Foundational", "scope": "Both", + "id_source": "NIST SP 800-53 control cited by the SP 800-82 overlay", "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats", "confidence": "unreviewed", "reviewed_by": [] @@ -11060,37 +11060,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing", - "control_name": "PI1.1 — Processing integrity policies", + "control_id": "PI1.1", + "control_name": "Processing integrity policies", "tier": "Foundational", "scope": "Both", + "notes": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation", - "control_name": "CC5.2 — Select and develop control activities", + "control_id": "CC5.2", + "control_name": "Select and develop control activities", "tier": "Foundational", "scope": "Both", + "notes": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content", "confidence": "unreviewed", "reviewed_by": [] }, @@ -11235,7 +11239,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-79", - "control_name": "CWE-79", + "control_name": "Cross-site Scripting (XSS)", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/79.html", @@ -11245,7 +11249,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-89", - "control_name": "CWE-89", + "control_name": "SQL Injection", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/89.html", @@ -11255,7 +11259,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-78", - "control_name": "CWE-78", + "control_name": "OS Command Injection", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/78.html", @@ -11264,8 +11268,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Output injection into downstream systems", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters", @@ -11274,8 +11278,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Crafted inputs designed to produce malicious outputs", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems", @@ -11284,8 +11288,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Downstream system access controls", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation", @@ -11504,8 +11508,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials appearing in model outputs passed to executors", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Credential detection in output pipeline before execution", @@ -11514,8 +11518,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Downstream service credentials with excessive scope", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Apply least-privilege to all credentials used in downstream processing", @@ -12965,8 +12969,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Goal hijack scenarios identified and mitigated in risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Agent goal hijack included in Art. 9 risk assessment for every agentic deployment", @@ -12975,8 +12979,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Meaningful human oversight over high-risk AI system outputs", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Agents whose goals can be hijacked and execute autonomously are an Art. 14 failure — human confirmation required before goal-changing actions", @@ -12985,8 +12989,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Input filtering, goal-state verification, and injection detection are Art. 15 technical requirements", @@ -13065,7 +13069,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -13075,40 +13079,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure application development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure application development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Secure development standards covering agentic integrations — input validation, goal-state verification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing programme", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-18", "notes": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All agent inputs logged — injection attempts detectable through log analysis", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy a network intrusion detection solution", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.8", + "control_name": "Deploy a network intrusion detection solution", "tier": "Foundational", "scope": "Both", + "parent": "CIS-13", "notes": "Network-layer monitoring for injection indicators in agent traffic", "confidence": "unreviewed", "reviewed_by": [] @@ -13215,8 +13223,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Vulnerabilities common to IT/OT", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "Vulnerabilities common to IT/OT", "tier": "Foundational", "scope": "Both", "notes": "Injection via historian and SCADA data feeds", @@ -13225,8 +13233,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess injection risk at every agent data ingestion point", @@ -13235,8 +13243,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls for ICS", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls for ICS", "tier": "Foundational", "scope": "Both", "notes": "Input validation mandatory at OT data boundary", @@ -13285,8 +13293,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Goal hijack risk identified in risk assessment — prompt injection, indirect injection, multi-turn manipulation documented", - "control_name": "CC3.2", + "control_id": "CC3.2", + "control_name": "COSO principle 7 — Risk identification and analysis", "tier": "Foundational", "scope": "Both", "notes": "Risk register with goal hijack entries, treatment status", @@ -13295,8 +13303,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Runtime monitoring for goal-deviation indicators — AI-specific anomaly detection covering instruction-override patterns", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitoring configuration, alert logs, incident records", @@ -13305,8 +13313,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Control activities define acceptable agent actions — agent cannot deviate from authorised goal scope", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Foundational", "scope": "Both", "notes": "Agent permission policy, goal-state verification design documentation", @@ -13315,8 +13323,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agent processing is authorised — actions taken by agent correspond to user's authorised intent, not attacker's injected instruction", - "control_name": "PI1.1", + "control_id": "PI1.1", + "control_name": "Processing integrity — input completeness and accuracy", "tier": "Foundational", "scope": "Both", "notes": "Action audit log, authorisation records per agent session", @@ -13325,8 +13333,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Bespoke agent code reviewed for injection resistance — all agent integration code includes prompt injection as a vulnerability category", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Foundational", "scope": "Both", "notes": "Secure code review records, findings, remediation", @@ -13335,7 +13343,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Penetration testing covers goal hijack — agentic AI systems tested for prompt injection before production and annually", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Foundational", "scope": "Both", @@ -13345,7 +13353,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent actions logged — all goal-relevant agent actions logged with user identity, session ID, and action detail", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -13355,7 +13363,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Targeted risk analysis documents goal hijack — likelihood, impact on CHD, treatment controls specified", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Foundational", "scope": "Both", @@ -13465,8 +13473,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "notes": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted", @@ -13475,8 +13483,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Output Used by a Downstream Component", - "control_name": "CWE-74", + "control_id": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements in Output Used by a Downstream Component", "tier": "Foundational", "scope": "Both", "notes": "Instruction elements in processed content not neutralised before agent reasoning", @@ -13485,8 +13493,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Protection Mechanism Failure", - "control_name": "CWE-693", + "control_id": "CWE-693", + "control_name": "Protection Mechanism Failure", "tier": "Foundational", "scope": "Both", "notes": "Safety and goal-verification controls bypassed through injection", @@ -13495,8 +13503,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Unintended Proxy or Intermediary", - "control_name": "CWE-441", + "control_id": "CWE-441", + "control_name": "Unintended Proxy or Intermediary", "tier": "Foundational", "scope": "Both", "notes": "Agent acts as a proxy executing attacker instructions against backend systems", @@ -13505,8 +13513,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Externally Controlled Reference to a Resource in Another Sphere", - "control_name": "CWE-610", + "control_id": "CWE-610", + "control_name": "Externally Controlled Reference to a Resource in Another Sphere", "tier": "Foundational", "scope": "Both", "notes": "Agent retrieves and acts on externally controlled content (RAG, email, tool returns) without adequate validation", @@ -13515,8 +13523,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Prompt injection via all agent input channels", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Foundational", "scope": "Both", "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, email content, uploaded files, and any other data source the agent processes", @@ -13525,8 +13533,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal consistency under adversarial input", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection", @@ -13535,8 +13543,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Goal state verification effectiveness", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results", @@ -13608,8 +13616,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Hijacked agent with excess privilege causes larger blast radius", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Scope all agent credentials to minimum required — least privilege enforced", @@ -13618,8 +13626,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow hijack to persist beyond session", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens", @@ -13628,8 +13636,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials allow hijacked agent to impersonate other agents", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique identity per agent — no shared service accounts across agent deployments", @@ -13638,8 +13646,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model the agent pipeline for adversarial goal manipulation vectors including direct injection, indirect injection via tool outputs, and context poisoning", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Both", "notes": "Ensures goal integrity is a design-phase requirement for all agentic systems", @@ -13648,8 +13656,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for goal deviation — verify that the agent maintains intended objectives under adversarial input conditions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Catches goal manipulation vulnerabilities before production deployment", @@ -13658,8 +13666,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial red-team testing against goal hijacking vectors including injection through every data source, tool output, and context channel", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates goal integrity controls under realistic attack conditions", @@ -13668,8 +13676,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish procedures to identify goal hijacking incidents in production including goal deviation monitoring, triage, and confirmation workflows", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid detection and response to goal manipulation in live systems", @@ -14312,8 +14320,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Tool misuse risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented", @@ -14322,8 +14330,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI actions", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement", @@ -14332,8 +14340,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing tool misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements", @@ -14422,40 +14430,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "Agent tool access managed as privileged access — minimum scope, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "6.1 Establish access granting process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "6.1", + "control_name": "Establish access granting process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "notes": "Formal process for granting agent tool access — documented justification per tool", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Tool parameter validation as secure development requirement", "confidence": "unreviewed", "reviewed_by": [] @@ -14552,8 +14564,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Common ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "Common ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Excessive privilege is specifically listed as OT vulnerability class", @@ -14562,8 +14574,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess agent permission scope as part of OT risk register", @@ -14572,8 +14584,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Foundational", "scope": "Both", "notes": "Least privilege must be enforced at zone boundary for all automated systems", @@ -14622,8 +14634,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Control activities define tool permission scope — which tools are permitted, which parameters are valid, which actions require confirmation", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Foundational", "scope": "Both", "notes": "Tool permission policy, permitted action allowlist", @@ -14632,8 +14644,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Logical access controls enforce tool permissions — agent cannot invoke tools outside authorised scope", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Foundational", "scope": "Both", "notes": "Tool invocation logs, access rejection records", @@ -14642,8 +14654,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Monitoring for anomalous tool invocations — destructive parameters, out-of-scope tools, unexpected sequences detected", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Foundational", "scope": "Both", "notes": "Tool call audit log, anomaly alert records", @@ -14652,8 +14664,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Tool invocations are complete and accurate — parameter validation ensures tool calls match intended business operation", - "control_name": "PI1.2", + "control_id": "PI1.2", + "control_name": "Processing integrity — system processing", "tier": "Foundational", "scope": "Both", "notes": "Validation configuration, rejected call logs", @@ -14662,7 +14674,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions follow least-privilege — agent can only access CHD systems required for defined function", + "control_id": "Req 7.2", "control_name": "Req 7.2", "tier": "Foundational", "scope": "Both", @@ -14672,7 +14684,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent tool permissions reviewed periodically — unused tool permissions removed; review schedule documented", + "control_id": "Req 7.3", "control_name": "Req 7.3", "tier": "Foundational", "scope": "Both", @@ -14682,7 +14694,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "All tool invocations on CHD systems logged — tool name, parameters, data accessed, user/session identity", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -14692,8 +14704,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Tool parameter validation in agent code — LLM-generated tool parameters validated before execution", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Foundational", "scope": "Both", "notes": "Code review records covering parameter validation", @@ -14792,8 +14804,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated", @@ -14802,8 +14814,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Missing Authorisation", - "control_name": "CWE-862", + "control_id": "CWE-862", + "control_name": "Missing Authorisation", "tier": "Foundational", "scope": "Both", "notes": "No authorisation check before irreversible tool invocations; human confirmation not required", @@ -14812,8 +14824,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Unrestricted Upload of File with Dangerous Type", - "control_name": "CWE-434", + "control_id": "CWE-434", + "control_name": "Unrestricted Upload of File with Dangerous Type", "tier": "Foundational", "scope": "Both", "notes": "Analogy: agent accepts and executes tool payloads without content validation", @@ -14822,8 +14834,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Dynamically-Managed Code Resources", - "control_name": "CWE-913", + "control_id": "CWE-913", + "control_name": "Improper Control of Dynamically-Managed Code Resources", "tier": "Foundational", "scope": "Both", "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled", @@ -14832,8 +14844,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "notes": "Tool parameters generated by LLM not validated against safe ranges before execution", @@ -14842,8 +14854,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Tool permission boundary enforcement", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls", @@ -14852,8 +14864,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Per-tool authorisation", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify each tool enforces its own access controls independently of the agent framework", @@ -14862,8 +14874,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "LLM-generated tool parameters", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify tool call parameters generated by the LLM are validated before execution", @@ -14935,8 +14947,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent with excess privilege can call tools in destructive ways even within normal use", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Per-tool permission manifests — each tool scoped to minimum required operations", @@ -14945,8 +14957,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Compromised third-party tool identity gets full scope of agent credential", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers", @@ -14955,8 +14967,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Single shared credential allows tool misuse to affect multiple services", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens", @@ -14965,8 +14977,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements specifying the maximum permitted tool access, API scope, data source access, and resource boundaries for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Build", "notes": "Establishes access control as a mandatory deployment requirement", @@ -14975,8 +14987,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model all agent access paths to tools, data stores, and APIs; design least-privilege tool manifests and enforce tenant isolation by design", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Build", "notes": "Ensures access boundaries are designed before implementation", @@ -14985,8 +14997,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect agent configuration files, tool manifests, permission policies, and orchestration definitions from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Build", "notes": "Prevents tampering with access control configuration", @@ -14995,8 +15007,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent access control enforcement — verify that tool permission manifests, RBAC policies, and tenant isolation boundaries are correctly implemented and cannot be bypassed", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Build", "notes": "Validates access controls before production deployment", @@ -15582,8 +15594,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Credential exposure risk identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented", @@ -15592,8 +15604,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements", @@ -15602,8 +15614,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for credential incident response", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment", @@ -15672,7 +15684,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.7", + "control_id": "7", "control_name": "Support", "tier": "Foundational", "scope": "Both", @@ -15692,40 +15704,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "6.2 Establish an access revoking process", - "control_name": "CIS 6 — Access Control Management", + "control_id": "6.2", + "control_name": "Establish an access revoking process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "All credential operations logged — issuance, use, anomalous patterns detectable", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "notes": "Agent credentials encrypted at rest — secret manager, no cleartext storage", "confidence": "unreviewed", "reviewed_by": [] @@ -15832,8 +15848,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Memory corruption and state manipulation", @@ -15842,8 +15858,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess agent memory stores as OT data integrity risk", @@ -15892,8 +15908,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agent credentials managed as logical access assets — provisioning, scope, rotation, revocation per access management policy", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Foundational", "scope": "Both", "notes": "Credential lifecycle records, provisioning logs", @@ -15902,8 +15918,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Credentials revoked at session end — no persistent credential caching in agent memory after session terminates", - "control_name": "CC6.3", + "control_id": "CC6.3", + "control_name": "Access removal", "tier": "Foundational", "scope": "Both", "notes": "Session termination logs, credential TTL configuration", @@ -15912,8 +15928,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Credential usage monitored — anomalous scope expansion or after-session access detected", - "control_name": "CC7.3", + "control_id": "CC7.3", + "control_name": "Security event evaluation", "tier": "Foundational", "scope": "Both", "notes": "Credential audit log, anomaly alert records", @@ -15922,8 +15938,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agent credentials treated as confidential information — stored in secrets manager, access-controlled", - "control_name": "C1.1", + "control_id": "C1.1", + "control_name": "Confidentiality identification", "tier": "Foundational", "scope": "Both", "notes": "Secrets management configuration, access control evidence", @@ -15932,7 +15948,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent accounts are system/application accounts — unique agent identity per deployment, no shared credentials", + "control_id": "Req 8.2", "control_name": "Req 8.2", "tier": "Foundational", "scope": "Both", @@ -15942,7 +15958,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent credential management — unique credentials, strong authentication where interactive, credential rotation schedule", + "control_id": "Req 8.3", "control_name": "Req 8.3", "tier": "Foundational", "scope": "Both", @@ -15952,7 +15968,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows need-to-know — access to cardholder data restricted to what agent function requires", + "control_id": "Req 7.2", "control_name": "Req 7.2", "tier": "Foundational", "scope": "Both", @@ -15962,7 +15978,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent credential usage logged — all authentication events for agent accounts in CHD scope logged", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -16062,8 +16078,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Execution with Unnecessary Privileges", - "control_name": "CWE-250", + "control_id": "CWE-250", + "control_name": "Execution with Unnecessary Privileges", "tier": "Foundational", "scope": "Both", "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege", @@ -16072,8 +16088,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Insufficiently Protected Credentials", - "control_name": "CWE-522", + "control_id": "CWE-522", + "control_name": "Insufficiently Protected Credentials", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads", @@ -16082,8 +16098,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Cleartext Storage of Sensitive Information", - "control_name": "CWE-312", + "control_id": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Both", "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration", @@ -16092,8 +16108,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Use of Hard-coded Credentials", - "control_name": "CWE-798", + "control_id": "CWE-798", + "control_name": "Use of Hard-coded Credentials", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials hardcoded in prompts or source code", @@ -16102,8 +16118,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Insufficient Session Expiration", - "control_name": "CWE-613", + "control_id": "CWE-613", + "control_name": "Insufficient Session Expiration", "tier": "Foundational", "scope": "Both", "notes": "Long-lived agent credentials without expiry or rotation — NHI-7", @@ -16112,8 +16128,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential scope enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Foundational", "scope": "Both", "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries", @@ -16122,8 +16138,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential usage audit trail", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation", @@ -16132,8 +16148,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Credential leakage paths", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Foundational", "scope": "Both", "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads", @@ -16205,8 +16221,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials not revoked on decommission — dormant tokens exploitable", - "control_name": "NHI-1 Improper Offboarding", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "tier": "Foundational", "scope": "Both", "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed", @@ -16215,8 +16231,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials exposed in memory, logs, tool payloads", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "No credentials in agent context, logs, or tool payloads — secret manager only", @@ -16225,8 +16241,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive permissions inherited by agent", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens", @@ -16235,8 +16251,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Weak agent-to-system authentication — credential reuse or weak secrets", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Foundational", "scope": "Both", "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens", @@ -16245,8 +16261,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent holds more permissions than required — lateral movement amplifier", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Least privilege per agent role — scope enforced, reviewed quarterly", @@ -16255,8 +16271,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent credentials stored in cleartext — config files, environment variables", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Secret manager for all agent credentials — no cleartext storage anywhere", @@ -16265,8 +16281,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Agent tokens without expiry — compromise persists indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials — task-scoped tokens with automatic expiry", @@ -16275,8 +16291,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Production agent credentials accessible in dev/test environments", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse", @@ -16285,8 +16301,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared agent credential across multiple instances or deployments", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique identity per agent deployment — no credential sharing", @@ -16295,8 +16311,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent service accounts — no attribution, no MFA", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials machine-only — human use detected and blocked", @@ -16305,8 +16321,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit privilege boundaries for each agent identity — maximum permitted privilege level, credential scope, and escalation constraints", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Both", "notes": "Establishes privilege boundaries as mandatory requirements", @@ -16315,8 +16331,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Implement secure credential handling — agents must not inherit user credentials, store tokens in context, or pass credentials between agents without explicit authorisation", - "control_name": "PW.5.1-PS – Secure coding practices", + "control_id": "PW.5.1-PS", + "control_name": "Secure coding practices", "tier": "Foundational", "scope": "Both", "notes": "Prevents credential leakage through agent code paths", @@ -16325,8 +16341,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect credential stores, identity configurations, and privilege mapping files from unauthorised access and modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Both", "notes": "Prevents tampering with privilege boundaries", @@ -16335,8 +16351,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring and triage procedures for privilege escalation incidents — detect agents operating beyond their assigned privilege level", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid detection of privilege escalation in production", @@ -16920,8 +16936,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Supply chain risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope", @@ -16930,8 +16946,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Quality management includes supply chain controls", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Documented supply chain security procedures — component verification, change management", @@ -16940,8 +16956,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Providers document obligations; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Agent tool and MCP server supply chain obligations distributed along value chain", @@ -17030,40 +17046,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "2.1 Establish and maintain software inventory", - "control_name": "CIS 2 — Inventory and Control of Software Assets", + "control_id": "2.1", + "control_name": "Establish and maintain software inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "notes": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "7.1 Establish vulnerability management process", - "control_name": "CIS 7 — Continuous Vulnerability Management", + "control_id": "7.1", + "control_name": "Establish vulnerability management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-7", "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.6 Use only up-to-date and trusted third-party components", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.6", + "control_name": "Use only up-to-date and trusted third-party components", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "notes": "Approved component list — only sourced from approved vendors, signatures verified", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "15.1 Establish service provider management process", - "control_name": "CIS 15 — Service Provider Management", + "control_id": "15.1", + "control_name": "Establish service provider management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-15", "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding", "confidence": "unreviewed", "reviewed_by": [] @@ -17150,8 +17170,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Lateral movement between control systems", @@ -17160,8 +17180,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess inter-agent trust as OT risk", @@ -17170,8 +17190,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Authenticate all automated system-to-system communications", @@ -17220,8 +17240,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Third-party agentic components assessed — agent frameworks, tool vendors, model providers subject to vendor risk management", - "control_name": "CC9.2", + "control_id": "CC9.2", + "control_name": "Vendor and business partner risk", "tier": "Foundational", "scope": "Both", "notes": "Vendor assessments, contractual security obligations", @@ -17230,8 +17250,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Component changes managed through change management — model updates, framework upgrades, tool changes require security review", - "control_name": "CC8.1", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Foundational", "scope": "Both", "notes": "Change management records, security review sign-offs", @@ -17240,8 +17260,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agentic supply chain risk included in risk assessment — compromised component scenarios documented with treatment", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Foundational", "scope": "Both", "notes": "Risk register with supply chain entries", @@ -17250,8 +17270,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Integrity checks required before component deployment — cryptographic verification of model weights and tool descriptors", - "control_name": "CC5.3", + "control_id": "CC5.3", + "control_name": "COSO principle 12 — Policies and procedures", "tier": "Foundational", "scope": "Both", "notes": "Integrity verification configuration, deployment logs", @@ -17260,8 +17280,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agentic component vendors with CHD access managed as TPSPs — written agreements, annual confirmation of PCI compliance", - "control_name": "Req 12.8", + "control_id": "Req 12.8", + "control_name": "TPSP programme", "tier": "Foundational", "scope": "Both", "notes": "TPSP list, written agreements, compliance confirmations", @@ -17270,7 +17290,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agentic component CVEs in vulnerability management — ML libraries, agent frameworks, inference runtime dependencies scanned", + "control_id": "Req 6.3", "control_name": "Req 6.3", "tier": "Foundational", "scope": "Both", @@ -17280,7 +17300,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Malicious software protection for agent components — integrity verification for model weights and plugin descriptors", + "control_id": "Req 5.2", "control_name": "Req 5.2", "tier": "Foundational", "scope": "Both", @@ -17290,7 +17310,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Secure baseline configuration for agentic infrastructure — hardening standards applied to agent deployment platforms", + "control_id": "Req 2.2", "control_name": "Req 2.2", "tier": "Foundational", "scope": "Both", @@ -17390,8 +17410,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Download of Code Without Integrity Check", - "control_name": "CWE-494", + "control_id": "CWE-494", + "control_name": "Download of Code Without Integrity Check", "tier": "Foundational", "scope": "Both", "notes": "Agent tool components and MCP servers loaded without signature verification", @@ -17400,8 +17420,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Inclusion of Functionality from Untrusted Control Sphere", - "control_name": "CWE-829", + "control_id": "CWE-829", + "control_name": "Inclusion of Functionality from Untrusted Control Sphere", "tier": "Foundational", "scope": "Both", "notes": "MCP servers and plugins from external registries loaded into agent execution context", @@ -17410,8 +17430,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Embedded Malicious Code", - "control_name": "CWE-506", + "control_id": "CWE-506", + "control_name": "Embedded Malicious Code", "tier": "Foundational", "scope": "Both", "notes": "Model weights and tool components containing hidden backdoor functionality", @@ -17420,8 +17440,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Reliance on Insufficiently Trustworthy Component", - "control_name": "CWE-1357", + "control_id": "CWE-1357", + "control_name": "Reliance on Insufficiently Trustworthy Component", "tier": "Foundational", "scope": "Both", "notes": "Agent dependency on third-party MCP servers without security assessment", @@ -17430,8 +17450,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Unintended Proxy or Intermediary", - "control_name": "CWE-441", + "control_id": "CWE-441", + "control_name": "Unintended Proxy or Intermediary", "tier": "Foundational", "scope": "Both", "notes": "Compromised tool acting as malicious intermediary in agent workflow", @@ -17440,8 +17460,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Component integrity verification", - "control_name": "SCT — Supply Chain", + "control_id": "SCT", + "control_name": "Supply Chain", "tier": "Foundational", "scope": "Both", "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors", @@ -17450,8 +17470,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural change detection post-update", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update", @@ -17460,8 +17480,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Runtime component monitoring", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify that component modification at runtime is detected and triggers agent suspension", @@ -17533,8 +17553,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Compromised MCP server holds or can request excessive permissions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources", @@ -17543,8 +17563,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Malicious components extract credentials from agent memory or config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Foundational", "scope": "Both", "notes": "Credential isolation — components cannot access other components' credentials", @@ -17553,8 +17573,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Supply chain compromise introduces credential exfiltration code", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Scan all agent components for credential access patterns before deployment", @@ -17563,8 +17583,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Vet all third-party agent components — tools, plugins, MCP servers, model weights, orchestration libraries — for provenance, integrity, and security posture before use", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", + "control_id": "PW.4.1-PS", + "control_name": "Reuse existing well-secured software", "tier": "Foundational", "scope": "Both", "notes": "Prevents introduction of compromised components into agent pipelines", @@ -17573,8 +17593,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Verify integrity of all agent artefacts and third-party components using cryptographic signatures and checksums before deployment", - "control_name": "PS.2.1-PS – Verify software integrity", + "control_id": "PS.2.1-PS", + "control_name": "Verify software integrity", "tier": "Foundational", "scope": "Both", "notes": "Detects tampering in agent supply chain artefacts", @@ -17583,8 +17603,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Maintain a secure, versioned registry of all agent components with provenance records; enable auditability and rollback", - "control_name": "PS.3.1-PS – Archive and protect software releases", + "control_id": "PS.3.1-PS", + "control_name": "Archive and protect software releases", "tier": "Foundational", "scope": "Both", "notes": "Ensures traceability and recovery capability for supply chain incidents", @@ -17593,8 +17613,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Monitor for newly disclosed vulnerabilities in third-party agent components; establish a triage process for AI-specific supply chain disclosures", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid response to supply chain compromises", @@ -18103,8 +18123,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Code execution risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations", @@ -18113,8 +18133,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical robustness against adversarial code execution", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution", @@ -18123,8 +18143,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering code execution incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Code execution anomaly response in quality management system", @@ -18203,7 +18223,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", @@ -18213,40 +18233,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Sandbox, static analysis, and allowlist as secure development requirements for code execution", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Hardening", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "notes": "Sandbox escape and code injection in penetration testing — adversarial scenarios before each deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.8 Deploy network intrusion detection", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.8", + "control_name": "Deploy network intrusion detection", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "notes": "Code execution environments network-monitored — outbound connection attempts from sandbox detected", "confidence": "unreviewed", "reviewed_by": [] @@ -18333,8 +18357,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Third-party tool components in OT", @@ -18343,8 +18367,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Tool integration approval process", @@ -18353,8 +18377,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Vendor assessment for OT tool providers", @@ -18403,8 +18427,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Control activities define permitted code execution scope — sandbox requirements, approved languages, forbidden operations", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Hardening", "scope": "Both", "notes": "Code execution policy, sandbox configuration", @@ -18413,8 +18437,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Execution sandboxes access-controlled — no host filesystem or network access without authorisation", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Hardening", "scope": "Both", "notes": "Sandbox configuration, access control evidence", @@ -18423,8 +18447,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Code execution events monitored — syscall patterns, network calls, and filesystem access from sandboxes logged", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Execution audit log, alert configuration", @@ -18433,8 +18457,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Code execution is authorised — agent cannot execute code that was not explicitly requested by authorised user", - "control_name": "PI1.1", + "control_id": "PI1.1", + "control_name": "Processing integrity — input completeness and accuracy", "tier": "Hardening", "scope": "Both", "notes": "Code execution authorisation records", @@ -18443,8 +18467,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Code generation and execution controls in secure development — agent cannot execute generated code without validation", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Hardening", "scope": "Both", "notes": "Secure development policy covering code generation", @@ -18453,7 +18477,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent execution environments protected — WAF or equivalent for agent endpoints with code execution capability", + "control_id": "Req 6.4", "control_name": "Req 6.4", "tier": "Hardening", "scope": "Both", @@ -18463,7 +18487,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Code execution paths in penetration testing — test whether crafted inputs cause execution of out-of-scope code", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Hardening", "scope": "Both", @@ -18473,7 +18497,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Code execution events logged — all agent-initiated execution with session identity and code summary", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Hardening", "scope": "Both", @@ -18573,8 +18597,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Generation of Code", - "control_name": "CWE-94", + "control_id": "CWE-94", + "control_name": "Improper Control of Generation of Code", "tier": "Foundational", "scope": "Both", "notes": "Agent generates and executes code without adequate static analysis or sandbox", @@ -18583,8 +18607,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in OS Command", - "control_name": "CWE-78", + "control_id": "CWE-78", + "control_name": "Improper Neutralisation of Special Elements in OS Command", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated code containing shell commands executed without sanitisation", @@ -18593,8 +18617,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Special Elements in Command", - "control_name": "CWE-77", + "control_id": "CWE-77", + "control_name": "Improper Neutralisation of Special Elements in Command", "tier": "Foundational", "scope": "Both", "notes": "LLM output used directly in command context", @@ -18603,8 +18627,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Neutralisation of Directives in Dynamically Evaluated Code", - "control_name": "CWE-95", + "control_id": "CWE-95", + "control_name": "Improper Neutralisation of Directives in Dynamically Evaluated Code", "tier": "Foundational", "scope": "Both", "notes": "Eval of LLM-generated code", @@ -18613,8 +18637,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Use of Potentially Dangerous Function", - "control_name": "CWE-676", + "control_id": "CWE-676", + "control_name": "Use of Potentially Dangerous Function", "tier": "Foundational", "scope": "Both", "notes": "Agent uses exec(), eval(), subprocess without validation", @@ -18623,8 +18647,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Code injection via crafted prompts", - "control_name": "IHT — Input Handling", + "control_id": "IHT", + "control_name": "Input Handling", "tier": "Hardening", "scope": "Both", "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands", @@ -18633,8 +18657,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Generated code validation", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Hardening", "scope": "Both", "notes": "Verify static analysis catches dangerous operations before execution", @@ -18643,8 +18667,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Sandbox escape attempts", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Test sandbox boundary enforcement from within the execution environment", @@ -18716,8 +18740,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Code executes in context of over-privileged agent credential — amplifies RCE impact", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity", @@ -18726,8 +18750,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Code execution in production context with prod credentials", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Hardening", "scope": "Both", "notes": "Strict environment isolation for code execution — dedicated sandboxed identity", @@ -18736,8 +18760,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credential means RCE in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access", @@ -18746,8 +18770,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model all code execution paths in agent workflows; design sandboxing, resource limits, and execution constraints as explicit security requirements", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Both", "notes": "Ensures code execution boundaries are designed before implementation", @@ -18756,8 +18780,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Implement secure coding for agent code execution — sandbox isolation, input validation for code generation, output filtering, and prevention of self-modification", - "control_name": "PW.5.1-PS – Secure coding practices", + "control_id": "PW.5.1-PS", + "control_name": "Secure coding practices", "tier": "Foundational", "scope": "Both", "notes": "Prevents code execution vulnerabilities in agent implementation", @@ -18766,8 +18790,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting code execution — sandbox escapes, resource limit bypasses, self-modification, and host system access through generated code", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates execution boundary controls under attack conditions", @@ -18776,8 +18800,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect agent execution environments, sandbox configurations, and runtime constraints from unauthorised modification", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Both", "notes": "Prevents weakening of execution boundaries through configuration tampering", @@ -19291,8 +19315,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data governance applies to all data influencing AI behaviour — including agent memory", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement", @@ -19301,8 +19325,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against adversarial memory manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Memory integrity monitoring and access controls are Art. 15 requirements", @@ -19311,8 +19335,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring for memory integrity", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Memory anomaly detection in post-market monitoring programme", @@ -19401,40 +19425,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "3.11 Encrypt sensitive data at rest", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "Memory write operations logged — who or what wrote, when, content hash", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "Memory write validation as secure development requirement — untrusted sources cannot write directly", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.3 Deploy a network-based intrusion detection system", - "control_name": "CIS 13 — Network Monitoring", + "control_id": "13.3", + "control_name": "Deploy a network-based intrusion detection system", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "notes": "Memory store access monitored — bulk read, anomalous write patterns detected", "confidence": "unreviewed", "reviewed_by": [] @@ -19521,8 +19549,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality risks in OT", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality risks in OT", "tier": "Hardening", "scope": "Both", "notes": "OT data exfiltration via compromised automation", @@ -19531,8 +19559,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess outbound data paths from agent", @@ -19541,8 +19569,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor all outbound data from OT zone", @@ -19591,8 +19619,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Memory poisoning risk documented in risk assessment — scenarios for RAG, persistent memory, and context window corruption", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Hardening", "scope": "Both", "notes": "Risk register with memory poisoning entries", @@ -19601,8 +19629,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agent memory stores monitored for unexpected modifications — baseline established, deviations trigger alerts", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Memory access log, anomaly alert configuration", @@ -19611,8 +19639,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Processing based on compromised memory is not authorised — memory integrity controls support PI1 evidence", - "control_name": "PI1.1", + "control_id": "PI1.1", + "control_name": "Processing integrity — input completeness and accuracy", "tier": "Hardening", "scope": "Both", "notes": "Integrity verification configuration", @@ -19621,8 +19649,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Controls on memory store write access — only authorised processes may write to agent memory stores", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Hardening", "scope": "Both", "notes": "Memory access policy, write access controls", @@ -19631,7 +19659,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "PAN in agent memory protected — primary account numbers truncated or masked if stored in agent context or memory stores", + "control_id": "Req 3.4", "control_name": "Req 3.4", "tier": "Hardening", "scope": "Both", @@ -19641,7 +19669,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent memory encryption — CHD in persistent memory stores encrypted using strong cryptography", + "control_id": "Req 3.5", "control_name": "Req 3.5", "tier": "Hardening", "scope": "Both", @@ -19651,8 +19679,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Model and memory changes managed — updates to agent memory stores treated as system changes requiring security review", - "control_name": "Req 6.5", + "control_id": "Req 6.5", + "control_name": "Secure system changes", "tier": "Hardening", "scope": "Both", "notes": "Change management records", @@ -19661,7 +19689,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Memory poisoning in penetration test scope — test whether adversarial content in memory affects agent behaviour", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Hardening", "scope": "Both", @@ -19761,8 +19789,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Acceptance of Extraneous Untrusted Data with Trusted Data", - "control_name": "CWE-349", + "control_id": "CWE-349", + "control_name": "Acceptance of Extraneous Untrusted Data with Trusted Data", "tier": "Foundational", "scope": "Both", "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge", @@ -19771,8 +19799,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Insufficient Verification of Data Authenticity", - "control_name": "CWE-345", + "control_id": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Foundational", "scope": "Both", "notes": "Memory content not integrity-verified before storage or retrieval", @@ -19781,8 +19809,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Input Validation", - "control_name": "CWE-20", + "control_id": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Both", "notes": "Content entering agent memory not validated before write", @@ -19791,8 +19819,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes", @@ -19801,8 +19829,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Multiple Releases of Same Resource or Handle", - "control_name": "CWE-1341", + "control_id": "CWE-1341", + "control_name": "Multiple Releases of Same Resource or Handle", "tier": "Foundational", "scope": "Both", "notes": "Memory TTL not enforced — entries persist beyond intended lifetime", @@ -19811,8 +19839,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Memory write path injection", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Attempt to poison memory through every channel that can write to agent memory stores", @@ -19821,8 +19849,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Poisoned memory influence detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Hardening", "scope": "Both", "notes": "Verify that behaviour influenced by poisoned memory differs detectably from baseline", @@ -19831,8 +19859,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Memory content integrity", - "control_name": "DPT — Data Protection", + "control_id": "DPT", + "control_name": "Data Protection", "tier": "Hardening", "scope": "Both", "notes": "Verify memory store content integrity monitoring detects unauthorised modification", @@ -19895,8 +19923,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials leaked — attacker writes poisoned content directly", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Hardening", "scope": "Both", "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context", @@ -19905,8 +19933,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Memory store credentials in cleartext — trivially extracted", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Secret manager for all memory store credentials — no cleartext anywhere", @@ -19915,8 +19943,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived memory store credentials enable persistent access for attacker", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived credentials for memory store access — rotate on each agent session", @@ -19925,8 +19953,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Protect agent memory stores, context databases, and shared state repositories from unauthorised read, write, and modification; enforce access controls per agent identity", - "control_name": "PS.1.1-PS – Protect all code from unauthorised access", + "control_id": "PS.1.1-PS", + "control_name": "Protect all code from unauthorised access", "tier": "Foundational", "scope": "Both", "notes": "Prevents direct tampering with agent memory and context", @@ -19935,8 +19963,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Maintain versioned, integrity-verified snapshots of agent memory and context stores; enable rollback to pre-poisoning states", - "control_name": "PS.3.1-PS – Archive and protect software releases", + "control_id": "PS.3.1-PS", + "control_name": "Archive and protect software releases", "tier": "Foundational", "scope": "Both", "notes": "Ensures recovery capability for memory poisoning incidents", @@ -19945,8 +19973,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for memory-influenced anomalies — verify that persistent memory and shared context do not introduce unintended behaviour changes across sessions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Catches memory poisoning effects before they propagate", @@ -19955,8 +19983,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "When memory poisoning is detected, conduct forensic analysis to identify the poisoned records, their ingestion source, propagation path, and blast radius across agents", - "control_name": "RV.3.1-PS – Analyse root causes", + "control_id": "RV.3.1-PS", + "control_name": "Analyse root causes", "tier": "Foundational", "scope": "Both", "notes": "Enables thorough incident response for memory poisoning events", @@ -20458,8 +20486,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "A2A communication risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status", @@ -20468,8 +20496,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting all system components", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems", @@ -20478,8 +20506,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documentation of A2A security controls", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "A2A authentication and encryption documented in quality management system", @@ -20558,7 +20586,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.8", + "control_id": "8", "control_name": "Operation", "tier": "Hardening", "scope": "Both", @@ -20568,40 +20596,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "12.4 Establish and maintain architecture diagram", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.4", + "control_name": "Establish and maintain architecture diagram", "tier": "Hardening", "scope": "Both", + "parent": "CIS-12", "notes": "A2A communication channels mapped in network architecture — authentication method, encryption status", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "3.10 Encrypt sensitive data in transit", - "control_name": "CIS 3 — Data Protection", + "control_id": "3.10", + "control_name": "Encrypt sensitive data in transit", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "notes": "All A2A messages encrypted in transit — no cleartext inter-agent communication", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "16.1 Establish secure development standards", - "control_name": "CIS 16 — Application Software Security", + "control_id": "16.1", + "control_name": "Establish secure development standards", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "notes": "A2A authentication and schema validation as secure development requirements", "confidence": "unreviewed", "reviewed_by": [] @@ -20688,8 +20720,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Expanded to include agentic AI components", @@ -20698,8 +20730,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "SBOM and vendor assessment for agentic stack", @@ -20708,8 +20740,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Formal vendor programme for OT agent components", @@ -20758,8 +20790,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Inter-agent authentication required — all agent-to-agent messages authenticated before acting", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Hardening", "scope": "Both", "notes": "mTLS configuration, certificate management records", @@ -20768,8 +20800,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Inter-agent communication policy — which agents may communicate with which, under what conditions, with what data", - "control_name": "CC5.2", + "control_id": "CC5.2", + "control_name": "COSO principle 11 — Technology controls", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent communication policy document", @@ -20778,8 +20810,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Inter-agent traffic monitored — unexpected communication patterns, unauthorised agent requests detected", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent traffic logs, anomaly alert records", @@ -20788,8 +20820,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Third-party agents treated as vendor risk — agents from external providers assessed before integration", - "control_name": "CC9.2", + "control_id": "CC9.2", + "control_name": "Vendor and business partner risk", "tier": "Hardening", "scope": "Both", "notes": "Vendor assessment records for third-party agents", @@ -20798,7 +20830,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "CHD encrypted in transit between agents — all inter-agent communication carrying CHD uses TLS 1.2+", + "control_id": "Req 4.2", "control_name": "Req 4.2", "tier": "Hardening", "scope": "Both", @@ -20808,7 +20840,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Inter-agent authentication — agents authenticate to each other before exchanging CHD", + "control_id": "Req 8.2", "control_name": "Req 8.2", "tier": "Hardening", "scope": "Both", @@ -20818,7 +20850,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Inter-agent CHD exchanges logged — source, destination, data classification, timestamp", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Hardening", "scope": "Both", @@ -20828,8 +20860,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Secure development requirements for inter-agent APIs — authentication and encryption requirements in design specifications", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Hardening", "scope": "Both", "notes": "Design documentation, code review records", @@ -20928,8 +20960,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Authentication", - "control_name": "CWE-287", + "control_id": "CWE-287", + "control_name": "Improper Authentication", "tier": "Foundational", "scope": "Both", "notes": "A2A channels without mutual authentication — agents accept messages from any sender", @@ -20938,8 +20970,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Authentication Bypass by Capture-replay", - "control_name": "CWE-294", + "control_id": "CWE-294", + "control_name": "Authentication Bypass by Capture-replay", "tier": "Foundational", "scope": "Both", "notes": "Replay attacks on A2A channels without nonce-based replay protection", @@ -20948,8 +20980,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Cleartext Transmission of Sensitive Information", - "control_name": "CWE-319", + "control_id": "CWE-319", + "control_name": "Cleartext Transmission of Sensitive Information", "tier": "Foundational", "scope": "Both", "notes": "A2A messages containing sensitive context transmitted without encryption", @@ -20958,8 +20990,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Origin Validation Error", - "control_name": "CWE-346", + "control_id": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Foundational", "scope": "Both", "notes": "Agent does not verify that A2A messages originate from the claimed sender", @@ -20968,8 +21000,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Enforcement of Message Integrity During Transmission", - "control_name": "CWE-924", + "control_id": "CWE-924", + "control_name": "Improper Enforcement of Message Integrity During Transmission", "tier": "Foundational", "scope": "Both", "notes": "A2A message integrity not cryptographically verified", @@ -20978,8 +21010,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "A2A authentication enforcement", - "control_name": "ACT — Access Control", + "control_id": "ACT", + "control_name": "Access Control", "tier": "Hardening", "scope": "Both", "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery", @@ -20988,8 +21020,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Replay attack prevention", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Capture and replay a valid A2A message; verify replay is rejected", @@ -20998,8 +21030,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "A2A audit completeness", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Hardening", "scope": "Both", "notes": "Verify all A2A messages are logged with sender identity and content hash", @@ -21062,8 +21094,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Weak or missing authentication on A2A channels — agent spoofing enabled", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Hardening", "scope": "Both", "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived", @@ -21072,8 +21104,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived A2A tokens enable persistent replay attacks", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived A2A tokens with nonce-based replay protection", @@ -21082,8 +21114,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared A2A credentials allow one compromised agent to impersonate others", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Unique identity per agent — A2A authentication bound to specific agent identity", @@ -21092,8 +21124,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit security requirements constraining permitted tool invocation sequences and cross-tool data flows for each agent deployment", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Build", "notes": "Establishes chaining constraints as mandatory requirements", @@ -21102,8 +21134,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Threat model tool interaction graphs — identify composite action sequences that could achieve unauthorised outcomes; design controls for chain-level authorisation", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Build", "notes": "Ensures chaining risks are addressed at design time", @@ -21112,8 +21144,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for chain-based scope violations — verify that multi-step tool sequences cannot achieve outcomes exceeding individual tool permissions", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Build", "notes": "Catches chaining vulnerabilities before production", @@ -21122,8 +21154,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for anomalous tool invocation sequences; define triage procedures for suspected lateral chaining incidents", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Build", "notes": "Enables detection of chaining attacks in production", @@ -21585,8 +21617,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cascade risks identified and mitigated — blast radius defined", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds", @@ -21595,8 +21627,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Human oversight over high-risk AI — ability to pause and stop", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms", @@ -21605,8 +21637,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against cascading failures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers, fail-safe defaults, and cascade containment architecture are Art. 15 requirements", @@ -21675,7 +21707,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.6.1", + "control_id": "6.1", "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", @@ -21685,7 +21717,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "tier": "Foundational", "scope": "Both", @@ -21695,40 +21727,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "4.1 Establish secure configuration process", - "control_name": "CIS 4 — Secure Configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "12.6 Use network-based URL filters", - "control_name": "CIS 12 — Network Infrastructure Management", + "control_id": "12.6", + "control_name": "Use network-based URL filters", "tier": "Foundational", "scope": "Both", + "parent": "CIS-12", "notes": "Network controls prevent cascade propagation across agent cluster boundaries", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for cascade events — kill switch activation, process control fallback, operations notification", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.6 Collect DNS query audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.6", + "control_name": "Collect DNS query audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Agent traffic monitored — cascade indicators detected before physical impact", "confidence": "unreviewed", "reviewed_by": [] @@ -21815,8 +21851,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Advanced", "scope": "Both", "notes": "Safety system bypass is the highest severity OT threat", @@ -21825,8 +21861,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Advanced", "scope": "Both", "notes": "Safety control inversion must be in OT risk register", @@ -21835,8 +21871,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Advanced", "scope": "Both", "notes": "Mandatory: safety function must be independent of AI decision layer", @@ -21885,8 +21921,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Availability commitments defined for multi-agent system — RTO/RPO documented; cascade failure scenarios in availability risk", - "control_name": "A1.1", + "control_id": "A1.1", + "control_name": "Availability commitments", "tier": "Foundational", "scope": "Both", "notes": "Availability SLA, BCP documentation", @@ -21895,8 +21931,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Capacity and performance monitoring — early warning of cascade failure precursors (latency, error rate, queue depth)", - "control_name": "A1.2", + "control_id": "A1.2", + "control_name": "Environmental protections and recovery", "tier": "Foundational", "scope": "Both", "notes": "Monitoring dashboards, alert configuration", @@ -21905,8 +21941,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Cascade failure incidents detected and responded to — incident response procedures for multi-agent failures", - "control_name": "CC7.3", + "control_id": "CC7.3", + "control_name": "Security event evaluation", "tier": "Foundational", "scope": "Both", "notes": "IR plan covering cascade scenarios, incident records", @@ -21915,8 +21951,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Cascade failure risk in risk assessment — blast radius analysis, dependency mapping documented", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Foundational", "scope": "Both", "notes": "Risk register with cascade failure entries", @@ -21925,7 +21961,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Critical agent control failures detected promptly — monitoring for cascade precursors with alert thresholds", + "control_id": "Req 10.7", "control_name": "Req 10.7", "tier": "Foundational", "scope": "Both", @@ -21935,7 +21971,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Cascade failure risk analysis — targeted risk analysis documents cascade failure likelihood, impact, treatment", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Foundational", "scope": "Both", @@ -21945,7 +21981,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Network controls prevent cascade propagation — agent network segments isolated to contain blast radius", + "control_id": "Req 1.3", "control_name": "Req 1.3", "tier": "Foundational", "scope": "Both", @@ -21955,7 +21991,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Baseline availability configuration for agent infrastructure — capacity and resilience requirements in hardening baseline", + "control_id": "Req 2.2", "control_name": "Req 2.2", "tier": "Foundational", "scope": "Both", @@ -22055,8 +22091,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Uncontrolled Resource Consumption", - "control_name": "CWE-400", + "control_id": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "tier": "Foundational", "scope": "Both", "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster", @@ -22065,8 +22101,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Check or Handling of Exceptional Conditions", - "control_name": "CWE-703", + "control_id": "CWE-703", + "control_name": "Improper Check or Handling of Exceptional Conditions", "tier": "Foundational", "scope": "Both", "notes": "Agent failures not caught and handled — exception propagates to downstream agents", @@ -22075,8 +22111,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Handling of Exceptional Conditions", - "control_name": "CWE-755", + "control_id": "CWE-755", + "control_name": "Improper Handling of Exceptional Conditions", "tier": "Foundational", "scope": "Both", "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully", @@ -22085,8 +22121,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "OWASP ReDoS", - "control_name": "CWE-730", + "control_id": "CWE-730", + "control_name": "OWASP ReDoS", "tier": "Foundational", "scope": "Both", "notes": "Regex-based input processing causing runaway computation propagating through pipeline", @@ -22095,8 +22131,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Uncontrolled Recursion", - "control_name": "CWE-674", + "control_id": "CWE-674", + "control_name": "Uncontrolled Recursion", "tier": "Foundational", "scope": "Both", "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade", @@ -22105,8 +22141,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Circuit breaker trigger and recovery", - "control_name": "AVT — Availability", + "control_id": "AVT", + "control_name": "Availability", "tier": "Foundational", "scope": "Both", "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path", @@ -22115,8 +22151,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Blast radius containment", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Foundational", "scope": "Both", "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters", @@ -22125,8 +22161,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Cascade detection alert", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring raises alert on cascade indicators before physical impact", @@ -22189,8 +22225,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Cascading agent failure with over-privileged credentials exposes all accessible systems", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Least privilege per agent — cascade blast radius limited by credential scope", @@ -22199,8 +22235,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credentials mean cascade in one agent affects all agents sharing the credential", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement", @@ -22209,8 +22245,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials exposed during cascade remain valid for attacker use post-incident", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens", @@ -22219,8 +22255,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Design circuit breakers, step limits, cost budgets, and human approval gates as explicit security requirements for all agentic automation workflows", - "control_name": "PW.2.1-PS – Design software to meet security requirements", + "control_id": "PW.2.1-PS", + "control_name": "Design software to meet security requirements", "tier": "Foundational", "scope": "Both", "notes": "Ensures cascade prevention is a design-phase requirement", @@ -22229,8 +22265,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing of cascade failure paths — test error propagation, hallucination amplification, and runaway automation scenarios", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates cascade prevention controls under attack conditions", @@ -22239,8 +22275,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for cascade failure incidents including automatic circuit breaker activation, workflow suspension, cost cap enforcement, and rollback", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", + "control_id": "RV.2.1-PS", + "control_name": "Assess, prioritise, and remediate vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid response to cascading automation failures", @@ -22249,8 +22285,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Define explicit requirements for maximum automation depth, step limits, cost budgets, and mandatory human checkpoints for each agent workflow", - "control_name": "PW.1.1-PS – Define security requirements", + "control_id": "PW.1.1-PS", + "control_name": "Define security requirements", "tier": "Foundational", "scope": "Both", "notes": "Establishes automation boundaries as mandatory requirements", @@ -22711,8 +22747,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Users informed of capabilities, limitations, and AI nature", - "control_name": "Art. 13 — Transparency", + "control_id": "Art. 13", + "control_name": "Transparency", "tier": "Foundational", "scope": "Both", "notes": "Agents must clearly communicate their AI nature and advisory limitations", @@ -22721,8 +22757,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Effective human oversight over high-risk AI", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness", @@ -22731,8 +22767,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Chatbots and AI-generated content must disclose AI nature", - "control_name": "Art. 50 — Transparency for certain AI systems", + "control_id": "Art. 50", + "control_name": "Transparency for certain AI systems", "tier": "Foundational", "scope": "Both", "notes": "All agent-user interactions require AI disclosure — universal obligation", @@ -22811,7 +22847,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.5", + "control_id": "5", "control_name": "Policy", "tier": "Foundational", "scope": "Both", @@ -22821,40 +22857,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "14.1 Establish security awareness programme", - "control_name": "CIS 14 — Security Awareness and Skills Training", + "control_id": "14.1", + "control_name": "Establish security awareness programme", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "notes": "All users of agentic tools trained on AI limitations — verification requirements, how to identify manipulation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.1 Designate personnel for incident response", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.1", + "control_name": "Designate personnel for incident response", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "notes": "Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "5.4 Restrict administrator privileges", - "control_name": "CIS 5 — Account Management", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "8.5 Collect detailed audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable", "confidence": "unreviewed", "reviewed_by": [] @@ -22931,8 +22971,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Inadequate human oversight cited as OT vulnerability category", @@ -22941,8 +22981,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Quantify consequences of unsupervised agent OT actions", @@ -22951,8 +22991,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", + "control_id": "§8.2", + "control_name": "OT security programme", "tier": "Foundational", "scope": "Both", "notes": "Governance policy for autonomous OT systems", @@ -23001,8 +23041,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "AI disclosure policy — users informed when interacting with AI agents; deceptive design patterns prohibited", - "control_name": "CC5.3", + "control_id": "CC5.3", + "control_name": "COSO principle 12 — Policies and procedures", "tier": "Foundational", "scope": "Both", "notes": "AI disclosure policy, UI evidence", @@ -23011,8 +23051,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Trust exploitation risk in risk assessment — social engineering, impersonation, false urgency scenarios documented", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Foundational", "scope": "Both", "notes": "Risk register with trust exploitation entries", @@ -23021,7 +23061,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agent outputs are accurate and complete — outputs not designed to mislead; factual accuracy controls for high-stakes outputs", + "control_id": "PI1.3", "control_name": "PI1.3", "tier": "Foundational", "scope": "Both", @@ -23031,7 +23071,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Accuracy of personal data in AI outputs — privacy criteria require that AI-generated information about individuals is accurate", + "control_id": "P7.1", "control_name": "P7.1", "tier": "Foundational", "scope": "Both", @@ -23041,7 +23081,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Security awareness covers AI deception — staff trained to recognise AI impersonation and social engineering", + "control_id": "Req 12.6", "control_name": "Req 12.6", "tier": "Foundational", "scope": "Both", @@ -23051,8 +23091,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Honest design requirements for agent interactions — AI disclosure requirements in secure development policy", - "control_name": "Req 6.2", + "control_id": "Req 6.2", + "control_name": "Bespoke software security", "tier": "Foundational", "scope": "Both", "notes": "Secure development policy, design review records", @@ -23061,7 +23101,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent-human interaction events logged — session records for agent interactions involving CHD decisions", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Foundational", "scope": "Both", @@ -23071,7 +23111,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Trust exploitation risk analysis — targeted risk analysis documents scenarios and treatment", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Foundational", "scope": "Both", @@ -23171,8 +23211,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Permissive List of Allowed Inputs", - "control_name": "CWE-183", + "control_id": "CWE-183", + "control_name": "Permissive List of Allowed Inputs", "tier": "Foundational", "scope": "Both", "notes": "System accepts human-like agent output without disclosure requirements", @@ -23181,8 +23221,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "User Interface Misrepresentation of Critical Information", - "control_name": "CWE-451", + "control_id": "CWE-451", + "control_name": "User Interface Misrepresentation of Critical Information", "tier": "Foundational", "scope": "Both", "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI", @@ -23191,8 +23231,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Origin Validation Error", - "control_name": "CWE-346", + "control_id": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Foundational", "scope": "Both", "notes": "User cannot determine whether advice originates from AI or human — no origin verification", @@ -23201,8 +23241,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Verification of Source of a Communication Channel", - "control_name": "CWE-940", + "control_id": "CWE-940", + "control_name": "Improper Verification of Source of a Communication Channel", "tier": "Foundational", "scope": "Both", "notes": "User cannot verify the agent is operating under its stated configuration", @@ -23211,8 +23251,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Exposure of Sensitive Information to an Unauthorised Actor", - "control_name": "CWE-200", + "control_id": "CWE-200", + "control_name": "Exposure of Sensitive Information to an Unauthorised Actor", "tier": "Foundational", "scope": "Both", "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation", @@ -23221,8 +23261,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "AI disclosure enforcement", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Foundational", "scope": "Both", "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment", @@ -23231,8 +23271,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Advisory label persistence", - "control_name": "OHT — Output Handling", + "control_id": "OHT", + "control_name": "Output Handling", "tier": "Foundational", "scope": "Both", "notes": "Verify advisory labels persist through all rendering environments", @@ -23241,8 +23281,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Over-trust pattern detection", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Foundational", "scope": "Both", "notes": "Verify monitoring can detect aggregate patterns of uncritical operator acceptance", @@ -23314,8 +23354,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using agent credentials — or agents using human credentials — destroys attribution", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Strict separation: agent credentials machine-only, human credentials human-only", @@ -23324,8 +23364,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Over-privileged agent identity makes its recommendations appear more authoritative to users", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do", @@ -23334,8 +23374,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Review agent behaviour for emergent capabilities — verify that self-modification, dynamic tool discovery, and autonomous agent spawning do not create unintended security exposures", - "control_name": "PW.7.2-PS – Review the software for security vulnerabilities", + "control_id": "PW.7.2-PS", + "control_name": "Review the software for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Catches emergent pattern risks before production", @@ -23344,8 +23384,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Conduct adversarial testing targeting emerging agentic patterns — self-evolution, prompt self-modification, autonomous tool acquisition, and dynamic agent creation", - "control_name": "PW.8.2-PS – Test for security vulnerabilities", + "control_id": "PW.8.2-PS", + "control_name": "Test for security vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Validates controls against novel attack surfaces", @@ -23354,8 +23394,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Establish monitoring for emergent agent behaviours — detect agents acquiring new capabilities, modifying their own definitions, or spawning sub-agents outside approved patterns", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables detection of emerging risks in production", @@ -23364,8 +23404,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "When incidents involve novel agentic patterns, conduct root cause analysis focused on understanding the emergent capability and its security implications", - "control_name": "RV.3.1-PS – Analyse root causes", + "control_id": "RV.3.1-PS", + "control_name": "Analyse root causes", "tier": "Foundational", "scope": "Both", "notes": "Builds organisational knowledge of emerging agentic risks", @@ -23856,8 +23896,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Rogue agent scenarios identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Hardening", "scope": "Both", "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented", @@ -23866,8 +23906,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Human oversight mechanisms effective against rogue behaviour", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Hardening", "scope": "Both", "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems", @@ -23876,8 +23916,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical resilience against rogue agent behaviour", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements", @@ -23886,8 +23926,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering rogue agent detection", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Behavioural monitoring in post-market monitoring programme", @@ -23966,7 +24006,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Cl.9", + "control_id": "9", "control_name": "Performance evaluation", "tier": "Hardening", "scope": "Both", @@ -23976,40 +24016,44 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "8.2 Collect audit logs", - "control_name": "CIS 8 — Audit Log Management", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "13.1 Centralise security event alerting", - "control_name": "CIS 13 — Network Monitoring and Defence", + "control_id": "13.1", + "control_name": "Centralise security event alerting", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "notes": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "17.2 Establish incident response procedures", - "control_name": "CIS 17 — Incident Response", + "control_id": "17.2", + "control_name": "Establish incident response procedures", "tier": "Hardening", "scope": "Both", + "parent": "CIS-17", "notes": "Rogue agent containment as incident response procedure — kill switch, audit, state validation, forensic", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "18.1 Establish penetration testing", - "control_name": "CIS 18 — Penetration Testing", + "control_id": "18.1", + "control_name": "Establish penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "notes": "Rogue agent scenarios in penetration testing — persistent hidden goal simulation, detection verification", "confidence": "unreviewed", "reviewed_by": [] @@ -24096,8 +24140,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Availability risks", - "control_name": "§5.6", + "control_id": "§5.6", + "control_name": "Availability risks", "tier": "Hardening", "scope": "Both", "notes": "Cascading failure across OT components", @@ -24106,8 +24150,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Cascade failure scenarios in OT risk register", @@ -24116,8 +24160,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Circuit breakers between OT automation layers", @@ -24166,8 +24210,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Continuous monitoring for rogue agent behaviour — actions outside authorised scope detected and alerted", - "control_name": "CC7.2", + "control_id": "CC7.2", + "control_name": "Event monitoring", "tier": "Hardening", "scope": "Both", "notes": "Agent action audit log, anomaly alert records", @@ -24176,8 +24220,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Access controls define authorised agent scope — technical enforcement of what agents may and may not do", - "control_name": "CC6.1", + "control_id": "CC6.1", + "control_name": "Logical and physical access controls", "tier": "Hardening", "scope": "Both", "notes": "Permission policy, access control configuration", @@ -24186,8 +24230,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Rogue agent risk in risk assessment — autonomous agent operating outside scope is a documented risk", - "control_name": "CC3.3", + "control_id": "CC3.3", + "control_name": "COSO principle 8 — Fraud risk", "tier": "Hardening", "scope": "Both", "notes": "Risk register with rogue agent scenarios", @@ -24196,8 +24240,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Rogue agent impact on availability — resource consumption by rogue agents does not degrade service for authorised operations", - "control_name": "A1.1", + "control_id": "A1.1", + "control_name": "Availability commitments", "tier": "Hardening", "scope": "Both", "notes": "Resource monitoring, quota enforcement records", @@ -24206,7 +24250,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Agent access to CHD follows documented scope — technical controls prevent access outside defined role", + "control_id": "Req 7.2", "control_name": "Req 7.2", "tier": "Hardening", "scope": "Both", @@ -24216,7 +24260,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Rogue agent behaviour logged — actions outside defined scope generate audit log entries and alerts", + "control_id": "Req 10.2", "control_name": "Req 10.2", "tier": "Hardening", "scope": "Both", @@ -24226,7 +24270,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Rogue agent scenarios in penetration test scope — test whether agents can operate outside authorised scope", + "control_id": "Req 11.3", "control_name": "Req 11.3", "tier": "Hardening", "scope": "Both", @@ -24236,7 +24280,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "PCI DSS v4.0", - "control_id": "Rogue agent risk analysis — targeted risk analysis documents scenarios, CHD impact, treatment", + "control_id": "Req 12.3", "control_name": "Req 12.3", "tier": "Hardening", "scope": "Both", @@ -24336,8 +24380,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Access Control", - "control_name": "CWE-284", + "control_id": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement", @@ -24346,8 +24390,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Protection Mechanism Failure", - "control_name": "CWE-693", + "control_id": "CWE-693", + "control_name": "Protection Mechanism Failure", "tier": "Foundational", "scope": "Both", "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent", @@ -24356,8 +24400,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Improper Control of Interaction Frequency", - "control_name": "CWE-799", + "control_id": "CWE-799", + "control_name": "Improper Control of Interaction Frequency", "tier": "Foundational", "scope": "Both", "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations", @@ -24366,8 +24410,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Embedded Malicious Code", - "control_name": "CWE-506", + "control_id": "CWE-506", + "control_name": "Embedded Malicious Code", "tier": "Foundational", "scope": "Both", "notes": "Rogue behaviour may result from backdoored model or component", @@ -24376,8 +24420,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "CWE/CVE", - "control_id": "Incorrect Default Permissions", - "control_name": "CWE-276", + "control_id": "CWE-276", + "control_name": "Incorrect Default Permissions", "tier": "Foundational", "scope": "Both", "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius", @@ -24386,8 +24430,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Behavioural baseline establishment and deviation", - "control_name": "AST — Agent-Specific", + "control_id": "AST", + "control_name": "Agent-Specific", "tier": "Hardening", "scope": "Both", "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection", @@ -24396,8 +24440,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Hidden goal persistence detection", - "control_name": "MBT — Model Behaviour", + "control_id": "MBT", + "control_name": "Model Behaviour", "tier": "Hardening", "scope": "Both", "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis", @@ -24406,8 +24450,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP AI Testing Guide", - "control_id": "Kill switch activation coverage", - "control_name": "LMT — Logging & Monitoring", + "control_id": "LMT", + "control_name": "Logging & Monitoring", "tier": "Hardening", "scope": "Both", "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA", @@ -24488,8 +24532,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent detected but not offboarded — credentials remain valid", - "control_name": "NHI-1 Improper Offboarding", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "tier": "Hardening", "scope": "Both", "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked", @@ -24498,8 +24542,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Rogue agent with excess privilege causes larger blast radius before detection", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment", @@ -24508,8 +24552,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived tokens allow rogue agent to operate indefinitely after detection", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation", @@ -24518,8 +24562,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Vet all external agent dependencies — LLM APIs, tool endpoints, MCP servers, orchestration platforms — for reliability, security posture, and failure mode characteristics before adoption", - "control_name": "PW.4.1-PS – Reuse existing well-secured software", + "control_id": "PW.4.1-PS", + "control_name": "Reuse existing well-secured software", "tier": "Foundational", "scope": "Both", "notes": "Prevents adoption of unreliable dependencies", @@ -24528,8 +24572,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Verify that external dependency responses are consistent with expected behaviour — detect API version changes, model swaps, or degraded output quality that could affect agent correctness", - "control_name": "PS.2.1-PS – Verify software integrity", + "control_id": "PS.2.1-PS", + "control_name": "Verify software integrity", "tier": "Foundational", "scope": "Both", "notes": "Detects dependency degradation and tampering", @@ -24538,8 +24582,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Monitor all agent dependencies for availability, behavioural consistency, and security posture changes; establish triage procedures for dependency degradation events", - "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities", + "control_id": "RV.1.1-PS", + "control_name": "Identify and confirm vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Enables rapid detection of dependency failures", @@ -24548,8 +24592,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-218A", - "control_id": "Define remediation procedures for dependency failures — graceful degradation, fallback providers, workflow suspension, and stakeholder notification", - "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities", + "control_id": "RV.2.1-PS", + "control_name": "Assess, prioritise, and remediate vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Ensures operational continuity during dependency outages", @@ -25085,8 +25129,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data must be relevant, representative, and subject to appropriate privacy measures", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Data governance controls preventing sensitive data ingestion and memorisation are Art. 10 requirements", @@ -25095,8 +25139,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient and implement cybersecurity measures", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Output scanning, DLP, and access controls on RAG retrieval are Art. 15 technical requirements", @@ -25105,8 +25149,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI providers must maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation", @@ -25165,8 +25209,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data for AI — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -25175,8 +25219,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data for AI — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data for AI — preparation", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -25185,8 +25229,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -25195,8 +25239,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -25205,37 +25249,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Establish and maintain data management process", + "control_id": "3.1", + "control_name": "Establish and maintain data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.13 — Deploy DLP solutions", + "control_id": "3.13", + "control_name": "Deploy DLP solutions", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.12 — Implement code-level security checks", + "control_id": "16.12", + "control_name": "Implement code-level security checks", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -25326,8 +25374,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Common ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "Common ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Injection via OT data feeds is a documented attack vector", @@ -25336,8 +25384,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess injection risk at every OT data ingestion point", @@ -25346,8 +25394,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Foundational", "scope": "Both", "notes": "Input validation mandatory at OT data boundary", @@ -25396,46 +25444,51 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Technical controls protecting confidential data in GenAI pipelines — encryption, access controls, output scanning", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on RAG retrieval — users retrieve only data they are authorised to access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in GenAI scope used only for authorised purposes — LLM processing limited to agreed use cases", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "DLP monitoring on all GenAI output channels — sensitive patterns detected before delivery to users", "confidence": "unreviewed", "reviewed_by": [] }, @@ -25572,7 +25625,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to Unauthorised Actor", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -25582,7 +25635,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -25592,7 +25645,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -25668,8 +25721,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injection blast radius limited only by credential scope", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Apply least-privilege to all data pipeline credentials", @@ -25678,8 +25731,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Injected actions can use pipeline tokens for extended period", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Short-lived tokens for all data pipeline service accounts", @@ -26278,8 +26331,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Credential exposure must be identified as a foreseeable risk and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Agent credential lifecycle included in Art. 9 risk management system", @@ -26288,8 +26341,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against credential theft and misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Short-lived credentials, NHI inventory, and access controls are Art. 15 requirements", @@ -26298,8 +26351,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for credential management and incident response", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Agent identity governance procedures documented in quality management system", @@ -26358,8 +26411,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -26368,8 +26421,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -26378,8 +26431,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Internal organisation — roles", - "control_name": "A.3.3", + "control_id": "A.3.3", + "control_name": "Internal organisation — roles", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -26388,8 +26441,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Leadership", - "control_name": "Cl.5", + "control_id": "5", + "control_name": "Leadership", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -26398,37 +26451,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 5", - "control_name": "5.4 — Restrict administrator privileges", + "control_id": "5.4", + "control_name": "Restrict administrator privileges", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.5 — Require MFA for admin access", + "control_id": "6.5", + "control_name": "Require MFA for admin access", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 5", - "control_name": "5.3 — Disable dormant accounts", + "control_id": "5.3", + "control_name": "Disable dormant accounts", "tier": "Foundational", "scope": "Both", + "parent": "CIS-5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 12", - "control_name": "12.7 — Deploy host-based intrusion detection", + "control_id": "12.7", + "control_name": "Deploy host-based intrusion detection", "tier": "Foundational", "scope": "Both", + "parent": "CIS-12", "confidence": "unreviewed", "reviewed_by": [] }, @@ -26510,8 +26567,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Data integrity in OT — training data is OT data", @@ -26520,8 +26577,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Assess training data integrity as OT risk", @@ -26530,8 +26587,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Integrity verification on all OT data used for training", @@ -26580,46 +26637,51 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Agent credentials managed as privileged access — minimum scope, documented justification, regular review", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs", - "control_name": "CC6.3 — Access removal", + "control_id": "CC6.3", + "control_name": "Access removal", "tier": "Foundational", "scope": "Both", + "notes": "Agent credentials revoked on decommission and anomaly detection — no dormant agent NHIs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Agent tool providers assessed — data handling, credential security requirements in vendor agreements", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Agent credential anomaly monitoring — unusual usage patterns detected and alerted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Agent credential lifecycle procedures — issuance, rotation, revocation documented", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Agent credential lifecycle procedures — issuance, rotation, revocation documented", "confidence": "unreviewed", "reviewed_by": [] }, @@ -26756,7 +26818,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -26766,7 +26828,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-798", - "control_name": "CWE-798", + "control_name": "Use of Hard-coded Credentials", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/798.html", @@ -26776,7 +26838,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-522", - "control_name": "CWE-522", + "control_name": "Insufficiently Protected Credentials", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/522.html", @@ -26852,8 +26914,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Write access to training data stores enables poisoning", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Separate read and write credentials; write requires MFA", @@ -26862,8 +26924,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Training pipeline credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault all training pipeline credentials", @@ -26872,8 +26934,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived write credentials create persistent poisoning window", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Short-lived write tokens; rotate frequently", @@ -27339,8 +27401,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Shadow AI usage is a foreseeable risk requiring mitigation in the risk management system", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment", @@ -27349,8 +27411,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Organisations deploying AI are responsible for AI used within their operations", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use", @@ -27359,8 +27421,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Deployers must use AI systems as instructed and ensure appropriate oversight", - "control_name": "Art. 29 — Deployer obligations", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "tier": "Foundational", "scope": "Both", "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage", @@ -27409,8 +27471,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies — acceptable use", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies — acceptable use", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -27419,8 +27481,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -27429,8 +27491,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party relationships", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party relationships", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -27439,8 +27501,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context", - "control_name": "Cl.4", + "control_id": "4", + "control_name": "Context", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -27449,37 +27511,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 2", - "control_name": "2.1 — Maintain authorised software inventory", + "control_id": "2.1", + "control_name": "Maintain authorised software inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.1 — Establish secure configuration", + "control_id": "4.1", + "control_name": "Establish secure configuration", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.4 — Perform traffic filtering", + "control_id": "13.4", + "control_name": "Perform traffic filtering", "tier": "Foundational", "scope": "Both", + "parent": "CIS-13", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 14", - "control_name": "14.6 — Train workforce on AI security", + "control_id": "14.6", + "control_name": "Train workforce on AI security", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "confidence": "unreviewed", "reviewed_by": [] }, @@ -27551,8 +27617,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "OT data confidentiality requirements apply to training data", @@ -27561,8 +27627,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess sensitivity of OT data in training sets", @@ -27571,8 +27637,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor for unexpected exfiltration of OT training data", @@ -27621,37 +27687,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data", "confidence": "unreviewed", "reviewed_by": [] }, @@ -27788,7 +27858,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-668", - "control_name": "CWE-668", + "control_name": "Exposure of Resource to Wrong Sphere", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/668.html", @@ -27798,7 +27868,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -27864,8 +27934,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to sensitive data stores", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Scope pipeline credentials to approved data sources only", @@ -27874,8 +27944,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in config files include sensitive data source access", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Audit config files for embedded credentials", @@ -28310,8 +28380,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data must be subject to governance practices — relevant, representative, free of errors", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations", @@ -28320,8 +28390,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence", @@ -28330,8 +28400,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify and mitigate systemic risks", - "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing", + "control_id": "Art. 55(1)(b)", + "control_name": "Systemic risk GPAI adversarial testing", "tier": "Hardening", "scope": "Both", "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models", @@ -28390,8 +28460,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -28400,8 +28470,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -28410,8 +28480,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -28420,8 +28490,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Hardening", "scope": "Both", "notes": "Foundational", @@ -28430,28 +28500,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 7", - "control_name": "7.1 — Establish vulnerability management", + "control_id": "7.1", + "control_name": "Establish vulnerability management", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.11 — Use up-to-date software components", + "control_id": "16.11", + "control_name": "Use up-to-date software components", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Establish penetration testing programme", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -28533,8 +28606,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Pipeline integrity is a core OT security requirement", @@ -28543,8 +28616,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Data pipeline security in OT risk assessment", @@ -28553,8 +28626,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Foundational", "scope": "Both", "notes": "Authenticated, integrity-verified data flows across zone boundaries", @@ -28603,37 +28676,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model promotions through change management — integrity verification before production deployment", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Hardening", "scope": "Both", + "notes": "Model promotions through change management — integrity verification before production deployment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Hardening", "scope": "Both", + "notes": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model output anomaly monitoring — poisoning indicators detected before operational impact", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Model output anomaly monitoring — poisoning indicators detected before operational impact", "confidence": "unreviewed", "reviewed_by": [] }, @@ -28770,7 +28847,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -28780,7 +28857,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-346", - "control_name": "CWE-346", + "control_name": "Origin Validation Error", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/346.html", @@ -28790,7 +28867,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -28875,8 +28952,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated connections between pipeline stages", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Foundational", "scope": "Both", "notes": "Require mTLS or token auth for all pipeline connections", @@ -28885,8 +28962,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Pipeline service account with access to all stages", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Per-stage credentials with minimum scope", @@ -28895,8 +28972,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same credential used for multiple pipeline stages", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per stage", @@ -29406,8 +29483,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Ingestion integrity risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Data ingestion attack surfaces included in Art. 9 risk management", @@ -29416,8 +29493,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI resilient against adversarial input manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements", @@ -29426,8 +29503,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for data ingestion and pipeline integrity", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Ingestion validation procedures and CVE patching documented in quality management", @@ -29476,8 +29553,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -29486,8 +29563,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -29496,8 +29573,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -29506,8 +29583,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -29516,19 +29593,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.1 — Establish secure coding practices", + "control_id": "16.1", + "control_name": "Establish secure coding practices", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.5 — Collect detailed audit logs", + "control_id": "8.5", + "control_name": "Collect detailed audit logs", "tier": "Foundational", "scope": "Build", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, @@ -29601,8 +29680,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Safety system bypass in OT", @@ -29611,8 +29690,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Guardrail bypass must be in OT risk register", @@ -29621,8 +29700,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Hardening", "scope": "Both", "notes": "GenAI guardrails must be independent of model inference layer", @@ -29671,37 +29750,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing", - "control_name": "PI1.2 — System inputs complete and accurate", + "control_id": "PI1.2", + "control_name": "System inputs complete and accurate", "tier": "Foundational", "scope": "Both", + "notes": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Ingestion anomaly detection — unusual payloads detected before pipeline completion", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Ingestion anomaly detection — unusual payloads detected before pipeline completion", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -29838,7 +29921,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -29848,7 +29931,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-116", - "control_name": "CWE-116", + "control_name": "Improper Encoding or Escaping of Output", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/116.html", @@ -29858,7 +29941,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-74", - "control_name": "CWE-74", + "control_name": "Improper Neutralisation of Special Elements", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/74.html", @@ -29925,8 +30008,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Service account with guardrail configuration write access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Minimum scope; no service account has guardrail disable capability", @@ -30442,8 +30525,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Third-party tool data exchange risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All tool integrations assessed in Art. 9 risk management", @@ -30452,8 +30535,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Providers document obligations flowing to deployers; deployers verify", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Tool data exchange obligations explicitly distributed along the value chain", @@ -30462,8 +30545,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI providers document all third-party integrations", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Tool and plugin data exchange documented in GPAI technical documentation", @@ -30512,8 +30595,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — AI supply chain", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party — AI supply chain", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -30522,8 +30605,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party — customer data", - "control_name": "A.10.2", + "control_id": "A.10.2", + "control_name": "Third-party — customer data", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -30532,8 +30615,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -30542,8 +30625,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -30552,28 +30635,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.2 — Maintain secure configuration of cloud assets", + "control_id": "4.2", + "control_name": "Maintain secure configuration of cloud assets", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.4 — Require password manager", + "control_id": "6.4", + "control_name": "Require password manager", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 15", - "control_name": "15.1 — Establish service provider management policy", + "control_id": "15.1", + "control_name": "Establish service provider management policy", "tier": "Foundational", "scope": "Both", + "parent": "CIS-15", "confidence": "unreviewed", "reviewed_by": [] }, @@ -30636,8 +30722,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "OT data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "OT data must not be disclosed without authorisation", @@ -30646,8 +30732,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Assess disclosure risk for each OT data type in GenAI outputs", @@ -30656,8 +30742,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor outputs for OT data disclosure patterns", @@ -30706,37 +30792,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions", - "control_name": "CC9.2 — Vendor agreements", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "tier": "Foundational", "scope": "Both", + "notes": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Context minimisation for tool calls — tools receive minimum confidential data required for function", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Context minimisation for tool calls — tools receive minimum confidential data required for function", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Tool access scoped to minimum required — agent tool permissions as privileged access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Tool access scoped to minimum required — agent tool permissions as privileged access", "confidence": "unreviewed", "reviewed_by": [] }, @@ -30873,7 +30963,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -30883,7 +30973,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-269", - "control_name": "CWE-269", + "control_name": "Improper Privilege Management", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/269.html", @@ -30893,7 +30983,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-602", - "control_name": "CWE-602", + "control_name": "Client-side Enforcement of Server-side Security", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/602.html", @@ -30969,8 +31059,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Credentials embedded in model outputs or training data surface in responses", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Output scanning for credential patterns", @@ -30979,8 +31069,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Over-broad retrieval credentials return data beyond user entitlement", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope for retrieval service accounts", @@ -31413,8 +31503,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI training data subject to governance — relevant, representative, privacy-preserving", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Data governance policy covering the full AI data lifecycle is an Art. 10 compliance requirement", @@ -31423,8 +31513,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented quality management system including data handling procedures", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Data lifecycle procedures — classification, retention, deletion — documented in quality management", @@ -31433,8 +31523,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI providers maintain technical documentation including training data governance", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Foundational", "scope": "Both", "notes": "Full data governance documentation for GPAI training data is a binding Art. 53 obligation", @@ -31483,8 +31573,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -31493,8 +31583,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -31503,8 +31593,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -31513,8 +31603,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -31523,37 +31613,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.2 — Establish data inventory", + "control_id": "3.2", + "control_name": "Establish data inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Configure data access control lists", + "control_id": "3.3", + "control_name": "Configure data access control lists", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.11 — Encrypt sensitive data at rest", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.3 — Ensure adequate audit log storage", + "control_id": "8.3", + "control_name": "Ensure adequate audit log storage", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, @@ -31616,8 +31710,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Foundational", "scope": "Both", "notes": "Excessive OT data access is a documented vulnerability", @@ -31626,8 +31720,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Data access scope in OT risk assessment", @@ -31636,8 +31730,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Secure architecture", - "control_name": "§7.1", + "control_id": "§7.1", + "control_name": "Secure architecture", "tier": "Foundational", "scope": "Both", "notes": "Least privilege enforced at OT data boundary", @@ -31686,37 +31780,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)", - "control_name": "C1.1 — Confidentiality policy", + "control_id": "C1.1", + "control_name": "Confidentiality policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy identifies all confidential information in GenAI scope — including derived assets (embeddings, caches, traces)", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations", - "control_name": "P4.1 — Privacy information lifecycle", + "control_id": "P4.1", + "control_name": "Privacy information lifecycle", "tier": "Foundational", "scope": "Both", + "notes": "Personal information lifecycle management covers GenAI-derived assets — embeddings inherit source data obligations", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Data lifecycle procedures documented — classification propagation, retention schedules, deletion procedures", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Ungoverned derived asset risks identified in assessment — embeddings, caches, agent memory outside governance scope", "confidence": "unreviewed", "reviewed_by": [] }, @@ -31853,7 +31951,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -31863,7 +31961,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-213", - "control_name": "CWE-213", + "control_name": "Exposure of Sensitive Information Due to Incompatible Policies", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/213.html", @@ -31939,8 +32037,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "GenAI system service account has access to more data than declared function requires", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Audit and reduce credential scope per system component", @@ -31949,8 +32047,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived credentials maintain excessive access indefinitely", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Foundational", "scope": "Both", "notes": "Rotate or replace with short-lived tokens", @@ -31959,8 +32057,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same data access credential used across multiple GenAI system functions", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per function", @@ -32387,8 +32485,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Mandatory risk management system for high-risk AI", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Absence of a documented risk management system is an Art. 9 violation", @@ -32397,8 +32495,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented quality management system including post-market monitoring", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Absence of a quality management system is an Art. 17 violation", @@ -32407,8 +32505,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Graduated fines based on violation type", - "control_name": "Art. 72 — Fines", + "control_id": "Art. 72", + "control_name": "Fines", "tier": "Foundational", "scope": "Both", "notes": "Understanding fine exposure is the starting point for compliance prioritisation", @@ -32457,8 +32555,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -32467,8 +32565,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Information for interested parties", - "control_name": "A.8.1", + "control_id": "A.8.1", + "control_name": "Information for interested parties", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -32477,8 +32575,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context — interested parties", - "control_name": "Cl.4.2", + "control_id": "4.2", + "control_name": "Context — interested parties", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -32487,8 +32585,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -32497,28 +32595,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Data management process", + "control_id": "3.1", + "control_name": "Data management process", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 17", - "control_name": "17.1 — Incident response management", + "control_id": "17.1", + "control_name": "Incident response management", "tier": "Foundational", "scope": "Both", + "parent": "CIS-17", "confidence": "unreviewed", "reviewed_by": [] }, @@ -32581,8 +32682,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Hardening", "scope": "Both", "notes": "OT data in retrieval corpora requires access control", @@ -32591,8 +32692,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Entitlement leakage in OT data retrieval", @@ -32601,8 +32702,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor retrieval patterns for unauthorised OT data access", @@ -32651,37 +32752,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Commitment to compliance with applicable laws and regulations including AI-specific obligations", - "control_name": "CC5.1 — Control environment", + "control_id": "CC5.1", + "control_name": "Control environment", "tier": "Foundational", "scope": "Both", + "notes": "Commitment to compliance with applicable laws and regulations including AI-specific obligations", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Regulatory risks identified in GenAI risk assessment — GDPR, EU AI Act, sector-specific regulations", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability", - "control_name": "P1.1 — Privacy management", + "control_id": "P1.1", + "control_name": "Privacy management", "tier": "Foundational", "scope": "Both", + "notes": "Privacy programme covers GenAI processing of personal information — policies, notices, accountability", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements", - "control_name": "CC2.1 — Communication", + "control_id": "CC2.1", + "control_name": "Communication", "tier": "Foundational", "scope": "Both", + "notes": "Regulatory compliance status communicated to management — AI Act obligations, NIS2 requirements", "confidence": "unreviewed", "reviewed_by": [] }, @@ -32818,7 +32923,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -32828,7 +32933,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-778", - "control_name": "CWE-778", + "control_name": "Insufficient Logging", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/778.html", @@ -32894,8 +32999,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Embedding store service account with cross-tenant read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-tenant credentials or row-level security with minimum scope", @@ -32904,8 +33009,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Unauthenticated embedding store access", - "control_name": "NHI-4 Insecure Authentication", + "control_id": "NHI-4", + "control_name": "Insecure Authentication", "tier": "Hardening", "scope": "Both", "notes": "Require authentication for all vector database connections", @@ -32914,8 +33019,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same embedding store credential used for multiple tenants", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Separate credentials per tenant or use row-level security", @@ -33459,8 +33564,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data governance covers all input modalities — images, audio, video — not only text", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs", @@ -33469,8 +33574,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures covering all data channels including multimodal inputs", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements", @@ -33479,8 +33584,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Technical documentation covers all input modalities processed by the model", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Hardening", "scope": "Both", "notes": "Multimodal data governance documented in GPAI technical documentation", @@ -33529,8 +33634,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -33539,8 +33644,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -33549,8 +33654,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -33559,8 +33664,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -33569,28 +33674,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.13 — Deploy DLP solutions", + "control_id": "3.13", + "control_name": "Deploy DLP solutions", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.1 — Centralise security event alerting", + "control_id": "13.1", + "control_name": "Centralise security event alerting", "tier": "Hardening", "scope": "Both", + "parent": "CIS-13", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.12 — Implement code-level security checks", + "control_id": "16.12", + "control_name": "Implement code-level security checks", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -33653,8 +33761,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities — data integrity", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities — data integrity", "tier": "Hardening", "scope": "Both", "notes": "Corpus manipulation directly threatens OT operational integrity", @@ -33663,8 +33771,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "OT corpus manipulation must be in risk register as critical scenario", @@ -33673,8 +33781,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Write authentication on all OT corpus stores", @@ -33723,37 +33831,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information extracted from multimodal inputs subject to same use restrictions as source data", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Personal information extracted from multimodal inputs subject to same use restrictions as source data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on multimodal content stores — same rigour as equivalent text data stores", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Hardening", "scope": "Both", + "notes": "Access controls on multimodal content stores — same rigour as equivalent text data stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -33890,7 +34002,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information to Unauthorised Actor", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -33900,7 +34012,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -33967,8 +34079,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Corpus write access held by service accounts that do not need it", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Separate read and write credentials; write accounts require MFA", @@ -33977,8 +34089,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Corpus write credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault all corpus write credentials", @@ -33987,8 +34099,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived corpus write credentials persist beyond need", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Rotate corpus write credentials; implement short-lived write pattern", @@ -34437,8 +34549,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data must be subject to appropriate data governance — privacy measures must be effective", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Anonymisation effectiveness is an Art. 10 data governance requirement, not a self-certification", @@ -34447,8 +34559,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI training data governance documented — privacy measures included", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Hardening", "scope": "Both", "notes": "Synthetic data generation methodology and re-identification risk assessment documented for GPAI", @@ -34497,8 +34609,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -34507,8 +34619,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -34517,8 +34629,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -34527,8 +34639,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Hardening", "scope": "Build", "notes": "Hardening", @@ -34537,19 +34649,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.7 — Establish data classification scheme", + "control_id": "3.7", + "control_name": "Establish data classification scheme", "tier": "Hardening", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.3 — Remediate penetration test findings", + "control_id": "18.3", + "control_name": "Remediate penetration test findings", "tier": "Hardening", "scope": "Build", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -34603,8 +34717,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "In-context manipulation of OT decision support", @@ -34613,8 +34727,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Context poisoning risk for OT data feeds", @@ -34663,37 +34777,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data", - "control_name": "P4.2 — Retention of personal information", + "control_id": "P4.2", + "control_name": "Retention of personal information", "tier": "Hardening", "scope": "Both", + "notes": "Synthetic datasets that are not truly anonymous subject to same retention obligations as source personal data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Synthetic data use must respect underlying privacy commitments if re-identification risk exists", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Re-identification risk in synthetic datasets identified in risk assessment", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Re-identification risk in synthetic datasets identified in risk assessment", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Synthetic OT data and business data protected at source classification level until re-identification risk formally assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -34820,7 +34938,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -34830,7 +34948,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-330", - "control_name": "CWE-330", + "control_name": "Use of Insufficiently Random Values", "tier": "Hardening", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/330.html", @@ -34887,8 +35005,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Data feed service accounts with access to sensitive data that should not enter context", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Scope data feed credentials to approved data only", @@ -35330,8 +35448,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data governance covering multi-tenant deployments — session isolation as a data handling requirement", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Session isolation controls are an Art. 10 data governance obligation for multi-user deployments", @@ -35340,8 +35458,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures preventing cross-session data exposure", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Session isolation and tenant separation are Art. 15 technical requirements", @@ -35350,8 +35468,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring detecting and responding to session bleed incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Cross-session leakage detection in post-market monitoring programme", @@ -35400,8 +35518,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -35410,8 +35528,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -35420,8 +35538,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -35430,8 +35548,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -35440,28 +35558,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Configure data access control lists", + "control_id": "3.3", + "control_name": "Configure data access control lists", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.2 — Establish allowlist of authorised software", + "control_id": "6.2", + "control_name": "Establish allowlist of authorised software", "tier": "Foundational", "scope": "Build", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.6 — Establish security requirements", + "control_id": "16.6", + "control_name": "Establish security requirements", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -35533,8 +35654,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "ICS vulnerabilities", - "control_name": "§5.3", + "control_id": "§5.3", + "control_name": "ICS vulnerabilities", "tier": "Hardening", "scope": "Both", "notes": "Persistent compromise of OT decision support", @@ -35543,8 +35664,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Session persistence as OT risk scenario", @@ -35593,37 +35714,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Strict session isolation — each user's context inaccessible to all other sessions", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Strict session isolation — each user's context inaccessible to all other sessions", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "User session context classified as confidential — technical isolation controls", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "User session context classified as confidential — technical isolation controls", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in user sessions used only for that user's authorised purposes — cross-session leakage is a P5 violation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Cross-session access anomalies monitored — unusual retrieval patterns detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Cross-session access anomalies monitored — unusual retrieval patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -35750,7 +35875,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -35760,7 +35885,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-488", - "control_name": "CWE-488", + "control_name": "Exposure of Data Element to Wrong Session", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/488.html", @@ -35826,8 +35951,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Session store service account with cross-user read/write access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-user session store access controls", @@ -35836,8 +35961,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Session store access credentials in plaintext", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault session store credentials", @@ -36288,8 +36413,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "LLM gateway risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management", @@ -36298,8 +36423,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow effective human oversight — ability to pause, stop, and override", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure", @@ -36308,8 +36433,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against adversarial misuse", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements", @@ -36318,8 +36443,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Documented procedures for LLM gateway security", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Security testing procedures and query log retention documented in quality management", @@ -36368,8 +36493,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -36378,8 +36503,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -36388,8 +36513,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — access control", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — access control", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -36398,8 +36523,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -36408,28 +36533,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.2 — Establish secure configuration for software", + "control_id": "16.2", + "control_name": "Establish secure configuration for software", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.3 — Require password manager for service accounts", + "control_id": "6.3", + "control_name": "Require password manager for service accounts", "tier": "Foundational", "scope": "Build", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Establish penetration testing programme", + "control_id": "18.1", + "control_name": "Establish penetration testing programme", "tier": "Foundational", "scope": "Build", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -36511,8 +36639,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Hardening", "scope": "Both", "notes": "OT knowledge encoded in models requires protection", @@ -36521,8 +36649,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Model extraction as OT intelligence gathering vector", @@ -36531,8 +36659,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor for systematic extraction query patterns", @@ -36581,46 +36709,51 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted", - "control_name": "PI1.1 — Processing integrity policy", + "control_id": "PI1.1", + "control_name": "Processing integrity policy", "tier": "Foundational", "scope": "Both", + "notes": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM-generated query results validated — destructive or over-broad queries blocked before execution", - "control_name": "PI1.3 — Outputs complete and accurate", + "control_id": "PI1.3", + "control_name": "Outputs complete and accurate", "tier": "Foundational", "scope": "Both", + "notes": "LLM-generated query results validated — destructive or over-broad queries blocked before execution", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Query allowlisting and human confirmation procedures documented", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Query allowlisting and human confirmation procedures documented", "confidence": "unreviewed", "reviewed_by": [] }, @@ -36747,7 +36880,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-89", - "control_name": "CWE-89", + "control_name": "SQL Injection", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/89.html", @@ -36757,7 +36890,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -36767,7 +36900,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -36843,8 +36976,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "API credentials with high quota enabling systematic extraction", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-user quotas; minimum default quota", @@ -36853,8 +36986,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Long-lived inference API credentials enable sustained extraction campaigns", - "control_name": "NHI-7 Long-Lived Credentials", + "control_id": "NHI-7", + "control_name": "Long-Lived Credentials", "tier": "Hardening", "scope": "Both", "notes": "Rotate API credentials; implement per-session tokens", @@ -37287,8 +37420,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Vector store security risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "All vector store deployments assessed in Art. 9 risk management", @@ -37297,8 +37430,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI infrastructure protected against cybersecurity risks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements", @@ -37307,8 +37440,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering AI infrastructure components", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Vector store security monitoring in post-market monitoring programme", @@ -37357,8 +37490,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — acquisition", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — acquisition", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -37367,8 +37500,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — preparation", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — preparation", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -37377,8 +37510,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -37387,8 +37520,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -37397,28 +37530,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.11 — Encrypt sensitive data at rest", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.1 — Establish access control inventory", + "control_id": "6.1", + "control_name": "Establish access control inventory", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.7 — Use standard-security components", + "control_id": "16.7", + "control_name": "Use standard-security components", "tier": "Foundational", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -37481,8 +37617,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Third-party OT tool data leakage", @@ -37491,8 +37627,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Tool data scope in OT security assessment", @@ -37501,8 +37637,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor OT tool data flows", @@ -37551,37 +37687,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Vector store content encrypted at rest — embeddings of confidential data protected", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Vector store content encrypted at rest — embeddings of confidential data protected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RBAC on all vector store collections — no unauthenticated access", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Vector database CVE patching managed through change management — timely remediation documented", - "control_name": "CC8.1 — Change management", + "control_id": "CC8.1", + "control_name": "Change management", "tier": "Foundational", "scope": "Both", + "notes": "Vector database CVE patching managed through change management — timely remediation documented", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Vector store query anomaly monitoring — bulk extraction patterns detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "Vector store query anomaly monitoring — bulk extraction patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -37718,7 +37858,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -37728,7 +37868,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/327.html", @@ -37804,8 +37944,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party tool credentials with excessive data access", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review all third-party tool credentials; reduce to minimum scope", @@ -37814,8 +37954,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Tool integration credentials with broad data access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope per tool integration", @@ -37824,8 +37964,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same credential used across multiple tool integrations", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per tool", @@ -38293,8 +38433,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including telemetry and monitoring data", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement", @@ -38303,8 +38443,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring required — but the monitoring infrastructure must itself be secured", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement", @@ -38353,8 +38493,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — governance", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — governance", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -38363,8 +38503,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -38373,8 +38513,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -38383,8 +38523,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Performance evaluation", - "control_name": "Cl.9", + "control_id": "9", + "control_name": "Performance evaluation", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -38393,37 +38533,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.2 — Collect audit logs", + "control_id": "8.2", + "control_name": "Collect audit logs", "tier": "Foundational", "scope": "Build", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.10 — Retain audit logs", + "control_id": "8.10", + "control_name": "Retain audit logs", "tier": "Foundational", "scope": "Build", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.13 — Deploy DLP on log pipelines", + "control_id": "3.13", + "control_name": "Deploy DLP on log pipelines", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.3 — Access control on log infrastructure", + "control_id": "6.3", + "control_name": "Access control on log infrastructure", "tier": "Foundational", "scope": "Build", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, @@ -38495,8 +38639,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Hardening", "scope": "Both", "notes": "OT-trained model weights are sensitive OT intellectual property", @@ -38505,8 +38649,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Model theft as OT IP theft scenario", @@ -38515,8 +38659,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Hardening", "scope": "Both", "notes": "Monitor model storage access patterns", @@ -38565,37 +38709,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information in telemetry used only for authorised purposes — same restrictions as production data", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Personal information in telemetry used only for authorised purposes — same restrictions as production data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access controls on telemetry stores — same rigour as production data stores", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Access controls on telemetry stores — same rigour as production data stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Access anomaly monitoring on telemetry stores — bulk access patterns detected", - "control_name": "CC7.2 — Monitoring", + "control_id": "CC7.2", + "control_name": "Monitoring", "tier": "Foundational", "scope": "Both", + "notes": "Access anomaly monitoring on telemetry stores — bulk access patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, @@ -38732,7 +38880,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-312", - "control_name": "CWE-312", + "control_name": "Cleartext Storage of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/312.html", @@ -38742,7 +38890,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-532", - "control_name": "CWE-532", + "control_name": "Insertion of Sensitive Information Into Log File", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/532.html", @@ -38752,7 +38900,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -38818,8 +38966,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model storage service account with read access from unexpected paths", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Minimum scope: only authorised inference service can read model weights", @@ -38828,8 +38976,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model storage credentials in plaintext config", - "control_name": "NHI-6 Insecure Credential Storage", + "control_id": "NHI-6", + "control_name": "Insecure Credential Storage", "tier": "Hardening", "scope": "Both", "notes": "Vault all model storage credentials", @@ -39301,8 +39449,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Data governance applies to all data in AI system scope — including context window content", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement", @@ -39311,8 +39459,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity against adversarial exploitation of context window content", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures", @@ -39321,8 +39469,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering context window exploitation incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "Context window security in post-market monitoring programme", @@ -39371,8 +39519,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — minimisation", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — minimisation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -39381,8 +39529,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — operational", - "control_name": "A.6.2.3", + "control_id": "A.6.2.3", + "control_name": "Lifecycle — operational", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -39391,8 +39539,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Foundational", "scope": "Build", "notes": "Hardening", @@ -39401,8 +39549,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Build", "notes": "Foundational", @@ -39411,28 +39559,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Configure data access control lists", + "control_id": "3.3", + "control_name": "Configure data access control lists", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.1 — Data minimisation", + "control_id": "3.1", + "control_name": "Data minimisation", "tier": "Foundational", "scope": "Build", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.6 — Security requirements", + "control_id": "16.6", + "control_name": "Security requirements", "tier": "Foundational", "scope": "Build", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, @@ -39495,8 +39646,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "OT data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "Inference inputs are OT data and require protection", @@ -39505,8 +39656,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Inference data exposure in OT risk assessment", @@ -39515,8 +39666,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Network monitoring", - "control_name": "§7.3", + "control_id": "§7.3", + "control_name": "Network monitoring", "tier": "Foundational", "scope": "Both", "notes": "Monitor inference data leaving OT boundary", @@ -39565,37 +39716,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Foundational", "scope": "Both", + "notes": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Minimum-necessary context injection procedures — documented and enforced", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Minimum-necessary context injection procedures — documented and enforced", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Over-broad context risks identified — cross-trust-domain aggregation assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Over-broad context risks identified — cross-trust-domain aggregation assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -39722,7 +39877,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -39732,7 +39887,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -39742,7 +39897,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-285", - "control_name": "CWE-285", + "control_name": "Improper Authorisation", "tier": "Foundational", "scope": "Build", "url": "https://cwe.mitre.org/data/definitions/285.html", @@ -39808,8 +39963,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Inference log service account with broad read access", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope: only authorised audit function can read inference logs", @@ -39818,8 +39973,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Service account credentials embedded in inference log entries", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Scan and scrub credentials from inference logs", @@ -40256,8 +40411,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Endpoint AI agent risks identified and mitigated", - "control_name": "Art. 9 — Risk management", + "control_id": "Art. 9", + "control_name": "Risk management", "tier": "Foundational", "scope": "Both", "notes": "Browser and endpoint agent deployments assessed in Art. 9 risk management", @@ -40266,8 +40421,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI designed to allow human oversight — users must be able to stop and override", - "control_name": "Art. 14 — Human oversight", + "control_id": "Art. 14", + "control_name": "Human oversight", "tier": "Foundational", "scope": "Both", "notes": "Users must be able to pause and override endpoint AI agents — Art. 14 human oversight requirement", @@ -40276,8 +40431,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Deployers ensure human oversight as instructed by provider", - "control_name": "Art. 29 — Deployer obligations", + "control_id": "Art. 29", + "control_name": "Deployer obligations", "tier": "Foundational", "scope": "Both", "notes": "Deployers responsible for ensuring endpoint AI agents operate within Art. 14 human oversight scope", @@ -40326,8 +40481,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Use of AI systems", - "control_name": "A.9.1", + "control_id": "A.9.1", + "control_name": "Use of AI systems", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -40336,8 +40491,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -40346,8 +40501,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Policies", - "control_name": "A.2.2", + "control_id": "A.2.2", + "control_name": "Policies", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -40356,8 +40511,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Context", - "control_name": "Cl.4", + "control_id": "4", + "control_name": "Context", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -40366,28 +40521,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 2", - "control_name": "2.6 — Allowlist authorised software", + "control_id": "2.6", + "control_name": "Allowlist authorised software", "tier": "Foundational", "scope": "Both", + "parent": "CIS-2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 4", - "control_name": "4.1 — Secure configuration baseline", + "control_id": "4.1", + "control_name": "Secure configuration baseline", "tier": "Foundational", "scope": "Both", + "parent": "CIS-4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 10", - "control_name": "10.1 — Deploy anti-malware", + "control_id": "10.1", + "control_name": "Deploy anti-malware", "tier": "Foundational", "scope": "Both", + "parent": "CIS-10", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40450,8 +40608,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Third-party data in OT context", @@ -40460,8 +40618,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Data source assessment for OT GenAI", @@ -40470,8 +40628,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Vendor programme for OT data suppliers", @@ -40520,37 +40678,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Foundational", "scope": "Both", + "notes": "Approved AI assistants with scoped permissions — permission minimisation documented and enforced", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Browser AI extension providers assessed in vendor risk programme — data handling, telemetry, update security", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement", - "control_name": "CC5.2 — Control activities", + "control_id": "CC5.2", + "control_name": "Control activities", "tier": "Foundational", "scope": "Both", + "notes": "Endpoint AI acceptable use procedures — approved extension list, prohibited data access, employee acknowledgement", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Endpoint AI overreach risks identified — data access scope, exfiltration paths assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40677,7 +40839,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-668", - "control_name": "CWE-668", + "control_name": "Exposure of Resource to Wrong Sphere", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/668.html", @@ -40687,7 +40849,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-272", - "control_name": "CWE-272", + "control_name": "Least Privilege Violation", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/272.html", @@ -40697,7 +40859,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -40763,8 +40925,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party data source API keys with excessive scope", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review all third-party credentials; reduce to minimum", @@ -40773,8 +40935,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party development credentials used in production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Enforce environment isolation for third-party credentials", @@ -40783,8 +40945,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Third-party credentials embedded in shared config", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Vault all third-party data source credentials", @@ -41265,8 +41427,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI must remain accurate and available under adverse conditions", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Foundational", "scope": "Both", "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements", @@ -41275,8 +41437,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering availability and resilience", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Foundational", "scope": "Both", "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme", @@ -41325,8 +41487,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — decommissioning", - "control_name": "A.6.2.8", + "control_id": "A.6.2.8", + "control_name": "Lifecycle — decommissioning", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -41335,8 +41497,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -41345,8 +41507,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Operation", - "control_name": "Cl.8", + "control_id": "8", + "control_name": "Operation", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -41355,8 +41517,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Improvement", - "control_name": "Cl.10", + "control_id": "10", + "control_name": "Improvement", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -41365,28 +41527,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 11", - "control_name": "11.1 — Establish recovery capability", + "control_id": "11.1", + "control_name": "Establish recovery capability", "tier": "Foundational", "scope": "Both", + "parent": "CIS-11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 11", - "control_name": "11.4 — Test data recovery", + "control_id": "11.4", + "control_name": "Test data recovery", "tier": "Foundational", "scope": "Both", + "parent": "CIS-11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 13", - "control_name": "13.8 — Deploy DNS filtering", + "control_id": "13.8", + "control_name": "Deploy DNS filtering", "tier": "Foundational", "scope": "Both", + "parent": "CIS-13", "confidence": "unreviewed", "reviewed_by": [] }, @@ -41450,8 +41615,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risks", - "control_name": "§5.5", + "control_id": "§5.5", + "control_name": "Supply chain risks", "tier": "Foundational", "scope": "Both", "notes": "Model components are supply chain assets in OT", @@ -41460,8 +41625,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Supply chain risk management", - "control_name": "§6.3", + "control_id": "§6.3", + "control_name": "Supply chain risk management", "tier": "Foundational", "scope": "Both", "notes": "Model provenance for OT deployments", @@ -41470,8 +41635,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Third-party management", - "control_name": "§8.4", + "control_id": "§8.4", + "control_name": "Third-party management", "tier": "Foundational", "scope": "Both", "notes": "Vendor assessment for model providers", @@ -41520,37 +41685,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure", - "control_name": "A1.1 — Availability policy", + "control_id": "A1.1", + "control_name": "Availability policy", "tier": "Foundational", "scope": "Both", + "notes": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure", - "control_name": "A1.2 — Environmental protections", + "control_id": "A1.2", + "control_name": "Environmental protections", "tier": "Foundational", "scope": "Both", + "notes": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Foundational", "scope": "Both", + "notes": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Silent RAG degradation identified as availability risk in assessment", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", + "notes": "Silent RAG degradation identified as availability risk in assessment", "confidence": "unreviewed", "reviewed_by": [] }, @@ -41687,7 +41856,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-400", - "control_name": "CWE-400", + "control_name": "Uncontrolled Resource Consumption", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/400.html", @@ -41697,7 +41866,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-770", - "control_name": "CWE-770", + "control_name": "Allocation of Resources Without Limits", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/770.html", @@ -41773,8 +41942,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model provider API keys with excessive access to model versions", - "control_name": "NHI-3 Vulnerable Third-Party NHI", + "control_id": "NHI-3", + "control_name": "Vulnerable Third-Party NHI", "tier": "Foundational", "scope": "Both", "notes": "Review and scope all model provider credentials", @@ -41783,8 +41952,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Same model registry token used across dev/staging/production", - "control_name": "NHI-8 Environment Isolation Failure", + "control_id": "NHI-8", + "control_name": "Environment Isolation Failure", "tier": "Foundational", "scope": "Both", "notes": "Separate credentials per environment", @@ -41793,8 +41962,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Model provider credentials in pipeline config", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Vault all model provider credentials", @@ -42294,8 +42463,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data privacy measures required — protecting sensitive data used in training", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements", @@ -42304,8 +42473,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting against attacks including inference attacks", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements", @@ -42354,8 +42523,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — privacy-preserving", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — privacy-preserving", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -42364,8 +42533,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -42374,8 +42543,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Hardening", "scope": "Both", "notes": "Advanced", @@ -42384,8 +42553,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -42394,19 +42563,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.11 — Encrypt sensitive data at rest", + "control_id": "3.11", + "control_name": "Encrypt sensitive data at rest", "tier": "Hardening", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Penetration testing", + "control_id": "18.1", + "control_name": "Penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -42460,8 +42631,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Data confidentiality", - "control_name": "§5.4", + "control_id": "§5.4", + "control_name": "Data confidentiality", "tier": "Foundational", "scope": "Both", "notes": "Retention of OT data beyond required period is a confidentiality risk", @@ -42470,8 +42641,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Data retention as OT risk scenario", @@ -42520,37 +42691,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Hardening", "scope": "Both", + "notes": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Output monitoring for reconstruction indicators — systematic query patterns detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Output monitoring for reconstruction indicators — systematic query patterns detected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors", "confidence": "unreviewed", "reviewed_by": [] }, @@ -42677,7 +42852,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-200", - "control_name": "CWE-200", + "control_name": "Exposure of Sensitive Information", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/200.html", @@ -42687,7 +42862,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-327", - "control_name": "CWE-327", + "control_name": "Use of a Broken or Risky Cryptographic Algorithm", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/327.html", @@ -42743,8 +42918,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Service account with access to retained data beyond declared function", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Foundational", "scope": "Both", "notes": "Minimum scope for data access credentials", @@ -42753,8 +42928,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials for data deletion — no audit trail", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce human identity for all compliance operations", @@ -43179,8 +43354,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training data governance includes human annotation workflows", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Foundational", "scope": "Both", "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data", @@ -43189,8 +43364,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Labelling vendors are part of the AI value chain — obligations distributed accordingly", - "control_name": "Art. 25 — Value chain responsibilities", + "control_id": "Art. 25", + "control_name": "Value chain responsibilities", "tier": "Foundational", "scope": "Both", "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations", @@ -43239,8 +43414,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — minimisation", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — minimisation", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -43249,8 +43424,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Third-party", - "control_name": "A.10.1", + "control_id": "A.10.1", + "control_name": "Third-party", "tier": "Foundational", "scope": "Both", "notes": "Hardening", @@ -43259,8 +43434,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Internal organisation — roles", - "control_name": "A.3.3", + "control_id": "A.3.3", + "control_name": "Internal organisation — roles", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -43269,8 +43444,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Support", - "control_name": "Cl.7", + "control_id": "7", + "control_name": "Support", "tier": "Foundational", "scope": "Both", "notes": "Foundational", @@ -43279,28 +43454,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 3", - "control_name": "3.3 — Access control lists", + "control_id": "3.3", + "control_name": "Access control lists", "tier": "Foundational", "scope": "Both", + "parent": "CIS-3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.5 — Require MFA", + "control_id": "6.5", + "control_name": "Require MFA", "tier": "Foundational", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 14", - "control_name": "14.3 — Train workforce to identify attacks", + "control_id": "14.3", + "control_name": "Train workforce to identify attacks", "tier": "Foundational", "scope": "Both", + "parent": "CIS-14", "confidence": "unreviewed", "reviewed_by": [] }, @@ -43363,8 +43541,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Availability risks", - "control_name": "§5.6", + "control_id": "§5.6", + "control_name": "Availability risks", "tier": "Hardening", "scope": "Both", "notes": "OT GenAI pipeline failure as availability risk", @@ -43373,8 +43551,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", "notes": "Cascade failure scenarios in OT risk register", @@ -43383,8 +43561,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Security controls", - "control_name": "§7.2", + "control_id": "§7.2", + "control_name": "Security controls", "tier": "Hardening", "scope": "Both", "notes": "Circuit breakers between OT data pipeline layers", @@ -43433,37 +43611,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Foundational", "scope": "Both", + "notes": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use", - "control_name": "CC9.2 — Vendor agreements", + "control_id": "CC9.2", + "control_name": "Vendor agreements", "tier": "Foundational", "scope": "Both", + "notes": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Personal information accessed by labellers documented — purpose, scope, and safeguards", - "control_name": "P3.1 — Personal information collection", + "control_id": "P3.1", + "control_name": "Personal information collection", "tier": "Foundational", "scope": "Both", + "notes": "Personal information accessed by labellers documented — purpose, scope, and safeguards", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task", - "control_name": "P5.1 — Personal information use", + "control_id": "P5.1", + "control_name": "Personal information use", "tier": "Foundational", "scope": "Both", + "notes": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task", "confidence": "unreviewed", "reviewed_by": [] }, @@ -43600,7 +43782,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-285", - "control_name": "CWE-285", + "control_name": "Improper Authorisation", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/285.html", @@ -43610,7 +43792,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-359", - "control_name": "CWE-359", + "control_name": "Exposure of Private Personal Information", "tier": "Foundational", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/359.html", @@ -43676,8 +43858,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Shared credential across pipeline stages — one failure affects all", - "control_name": "NHI-9 NHI Reuse", + "control_id": "NHI-9", + "control_name": "NHI Reuse", "tier": "Hardening", "scope": "Both", "notes": "Separate credentials per pipeline stage", @@ -43686,8 +43868,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Single credential covering multiple pipeline stages amplifies cascade", - "control_name": "NHI-5 Over-Privileged NHI", + "control_id": "NHI-5", + "control_name": "Over-Privileged NHI", "tier": "Hardening", "scope": "Both", "notes": "Per-stage minimum scope credentials", @@ -44119,8 +44301,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Cybersecurity measures protecting AI system integrity", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements", @@ -44129,8 +44311,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "GPAI technical documentation includes model architecture and capability details", - "control_name": "Art. 53(1)(a) — GPAI documentation", + "control_id": "Art. 53(1)(a)", + "control_name": "GPAI documentation", "tier": "Hardening", "scope": "Both", "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations", @@ -44139,8 +44321,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Post-market monitoring covering security incidents", - "control_name": "Art. 17 — Quality management", + "control_id": "Art. 17", + "control_name": "Quality management", "tier": "Hardening", "scope": "Both", "notes": "Model extraction detection in post-market monitoring programme", @@ -44189,8 +44371,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — model artefacts", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — model artefacts", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -44199,8 +44381,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — design", - "control_name": "A.6.1.2", + "control_id": "A.6.1.2", + "control_name": "Lifecycle — design", "tier": "Hardening", "scope": "Both", "notes": "Foundational", @@ -44209,8 +44391,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Lifecycle — testing", - "control_name": "A.6.2.6", + "control_id": "A.6.2.6", + "control_name": "Lifecycle — testing", "tier": "Hardening", "scope": "Both", "notes": "Advanced", @@ -44219,8 +44401,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Planning — risk", - "control_name": "Cl.6.1", + "control_id": "6.1", + "control_name": "Planning — risk", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -44229,28 +44411,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 6", - "control_name": "6.2 — Allowlist authorised access", + "control_id": "6.2", + "control_name": "Allowlist authorised access", "tier": "Hardening", "scope": "Both", + "parent": "CIS-6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 8", - "control_name": "8.6 — Collect DNS query audit logs", + "control_id": "8.6", + "control_name": "Collect DNS query audit logs", "tier": "Hardening", "scope": "Both", + "parent": "CIS-8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Penetration testing", + "control_id": "18.1", + "control_name": "Penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -44313,8 +44498,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Regulatory compliance as OT risk scenario", @@ -44323,8 +44508,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", + "control_id": "§8.2", + "control_name": "OT security programme", "tier": "Foundational", "scope": "Both", "notes": "Compliance programme for OT GenAI deployments", @@ -44373,37 +44558,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection", - "control_name": "C2.1 — Confidential information protection", + "control_id": "C2.1", + "control_name": "Confidential information protection", "tier": "Hardening", "scope": "Both", + "notes": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "API rate limiting as access control limiting systematic model extraction", - "control_name": "CC6.1 — Logical access", + "control_id": "CC6.1", + "control_name": "Logical access", "tier": "Hardening", "scope": "Both", + "notes": "API rate limiting as access control limiting systematic model extraction", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model extraction pattern monitoring — unusual query diversity and volume detected", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "Model extraction pattern monitoring — unusual query diversity and volume detected", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed", - "control_name": "CC3.2 — Risk assessment", + "control_id": "CC3.2", + "control_name": "Risk assessment", "tier": "Hardening", "scope": "Both", + "notes": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed", "confidence": "unreviewed", "reviewed_by": [] }, @@ -44540,7 +44729,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-284", - "control_name": "CWE-284", + "control_name": "Improper Access Control", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/284.html", @@ -44550,7 +44739,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-201", - "control_name": "CWE-201", + "control_name": "Insertion of Sensitive Information Into Sent Data", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/201.html", @@ -44626,8 +44815,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Humans using machine credentials — no attribution for compliance evidence", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce human identity for all regulated data operations", @@ -44636,8 +44825,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Compliance audit credentials leaked — tampering with evidence possible", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Protect audit credential integrity", @@ -45103,8 +45292,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Training and retrieval data free from errors — source integrity required", - "control_name": "Art. 10 — Data and data governance", + "control_id": "Art. 10", + "control_name": "Data and data governance", "tier": "Hardening", "scope": "Both", "notes": "RAG corpus integrity controls and source verification are Art. 10 requirements", @@ -45113,8 +45302,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "High-risk AI accurate and resilient against adversarial data manipulation", - "control_name": "Art. 15 — Accuracy, robustness, cybersecurity", + "control_id": "Art. 15", + "control_name": "Accuracy, robustness, cybersecurity", "tier": "Hardening", "scope": "Both", "notes": "Source trust scoring and ingestion validation are Art. 15 robustness requirements", @@ -45123,8 +45312,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "Systemic risk GPAI providers must assess and mitigate risks including disinformation", - "control_name": "Art. 55(1)(a) — Systemic risk GPAI", + "control_id": "Art. 55(1)(a)", + "control_name": "Systemic risk GPAI", "tier": "Hardening", "scope": "Both", "notes": "Disinformation risk assessment and RAG integrity controls are binding Art. 55 obligations", @@ -45133,8 +45322,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "EU AI Act", - "control_id": "AI-generated content that could be mistaken as human must be disclosed", - "control_name": "Art. 50 — Transparency", + "control_id": "Art. 50", + "control_name": "Transparency", "tier": "Hardening", "scope": "Both", "notes": "Disinformation risk amplified when users cannot distinguish AI-generated content — Art. 50 applies", @@ -45183,8 +45372,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — provenance", - "control_name": "A.7.2", + "control_id": "A.7.2", + "control_name": "Data — provenance", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -45193,8 +45382,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Data — quality", - "control_name": "A.7.3", + "control_id": "A.7.3", + "control_name": "Data — quality", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -45203,8 +45392,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Impact assessment", - "control_name": "A.5.2", + "control_id": "A.5.2", + "control_name": "Impact assessment", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -45213,8 +45402,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "ISO/IEC 42001:2023", - "control_id": "Transparency", - "control_name": "A.8.1", + "control_id": "A.8.1", + "control_name": "Transparency", "tier": "Hardening", "scope": "Both", "notes": "Hardening", @@ -45223,28 +45412,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 7", - "control_name": "7.1 — Vulnerability management", + "control_id": "7.1", + "control_name": "Vulnerability management", "tier": "Hardening", "scope": "Both", + "parent": "CIS-7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 16", - "control_name": "16.11 — Use up-to-date components", + "control_id": "16.11", + "control_name": "Use up-to-date components", "tier": "Hardening", "scope": "Both", + "parent": "CIS-16", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "CIS Controls v8.1", - "control_id": "CIS 18", - "control_name": "18.1 — Penetration testing", + "control_id": "18.1", + "control_name": "Penetration testing", "tier": "Hardening", "scope": "Both", + "parent": "CIS-18", "confidence": "unreviewed", "reviewed_by": [] }, @@ -45308,8 +45500,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "Risk assessment", - "control_name": "§6.2", + "control_id": "§6.2", + "control_name": "Risk assessment", "tier": "Foundational", "scope": "Both", "notes": "Provenance as OT data quality and audit risk", @@ -45318,8 +45510,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "NIST SP 800-82 Rev 3", - "control_id": "OT security programme", - "control_name": "§8.2", + "control_id": "§8.2", + "control_name": "OT security programme", "tier": "Foundational", "scope": "Both", "notes": "Data lineage as OT governance requirement", @@ -45368,37 +45560,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "SOC 2", - "control_id": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index", - "control_name": "PI1.2 — System inputs complete and accurate", + "control_id": "PI1.2", + "control_name": "System inputs complete and accurate", "tier": "Hardening", "scope": "Both", + "notes": "RAG corpus integrity controls — only accurate, verified content enters the retrieval index", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery", - "control_name": "PI1.3 — Outputs complete and accurate", + "control_id": "PI1.3", + "control_name": "Outputs complete and accurate", "tier": "Hardening", "scope": "Both", + "notes": "LLM outputs derived from poisoned RAG are a processing integrity failure — detection before delivery", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees", - "control_name": "CC9.1 — Vendor risk", + "control_id": "CC9.1", + "control_name": "Vendor risk", "tier": "Hardening", "scope": "Both", + "notes": "RAG corpus data source providers assessed — content quality, update process, integrity guarantees", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "SOC 2", - "control_id": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production", - "control_name": "CC7.2 — Anomaly detection", + "control_id": "CC7.2", + "control_name": "Anomaly detection", "tier": "Hardening", "scope": "Both", + "notes": "RAG corpus anomaly detection — unusual content or modifications detected before reaching production", "confidence": "unreviewed", "reviewed_by": [] }, @@ -45535,7 +45731,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-345", - "control_name": "CWE-345", + "control_name": "Insufficient Verification of Data Authenticity", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/345.html", @@ -45545,7 +45741,7 @@ window.CROSSWALK_DATA = [ { "framework": "CWE/CVE", "control_id": "CWE-20", - "control_name": "CWE-20", + "control_name": "Improper Input Validation", "tier": "Hardening", "scope": "Both", "url": "https://cwe.mitre.org/data/definitions/20.html", @@ -45601,8 +45797,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Machine credentials used for ingestion operations — no individual attribution", - "control_name": "NHI-10 Human Use of NHI", + "control_id": "NHI-10", + "control_name": "Human Use of NHI", "tier": "Foundational", "scope": "Both", "notes": "Enforce machine identity per pipeline component; log with component identity", @@ -45611,8 +45807,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Decommissioned pipeline identities remain in lineage records", - "control_name": "NHI-1 Improper Offboarding", + "control_id": "NHI-1", + "control_name": "Improper Offboarding", "tier": "Foundational", "scope": "Both", "notes": "Timely offboarding of pipeline NHIs", @@ -45621,8 +45817,8 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP NHI Top 10", - "control_id": "Lineage system credentials leaked — provenance records can be tampered", - "control_name": "NHI-2 Secret Leakage", + "control_id": "NHI-2", + "control_name": "Secret Leakage", "tier": "Foundational", "scope": "Both", "notes": "Protect lineage system credentials", diff --git a/scripts/control-ids.js b/scripts/control-ids.js new file mode 100644 index 0000000..e367df9 --- /dev/null +++ b/scripts/control-ids.js @@ -0,0 +1,163 @@ +'use strict'; +/** + * Per-framework control identifier grammar (issue #35). + * + * The mapping files write the same framework differently across the source + * lists — `CC3.2 — Name | prose` in one, `CC3.2 | prose | evidence` in + * another — so a positional rule ("the id is column 1") cannot hold. The old + * parser tried `looksLikeId()`, which rejects every identifier containing a + * space (`Req 6.2.4`, `Art. 9`, `§5.3`), then fell through to "column 0 is the + * id" and wrote the requirement prose into `control_id` on 612 rows. + * + * This scans a row's cells for the framework's own identifier shape instead. + * Wherever the identifier sits, it becomes `control_id`; the rest of that cell + * becomes the name, or failing that a short neighbouring cell. + * + * Canonical forms are the maintainer's ruling on #35: `§5.3`, `Art. 9`, + * `Req 6.2.4`, `NHI-5`, ISO clauses bare (`6.1`), SP 800-218A keeping NIST's + * `-PS` suffix, and CIS identified by safeguard with the control as `parent`. + */ + +/** A cell longer than this is prose, not a control name. */ +const NAME_MAX = 120; + +const GRAMMARS = { + 'SOC 2': { + re: /\b((?:CC|PI|A|C|P)\d\.\d{1,2})\b/, + }, + 'EU AI Act': { + // The files cite paragraphs as well as articles — Art. 55(1)(b) — and the + // paragraph is the part that says which obligation was mapped, so it stays. + re: /\b(?:Art\.?|Article)\s*(\d{1,3}(?:\(\w{1,3}\))*)|\bAnnex\s+([IVXL]+)\b/i, + canonical: (m) => (m[1] ? `Art. ${m[1]}` : `Annex ${m[2].toUpperCase()}`), + }, + 'OWASP NHI Top 10': { + re: /\bNHI[-\s]?(\d{1,2})\b/i, + canonical: (m) => `NHI-${m[1]}`, + }, + 'CIS Controls v8.1': { + // The safeguard is the identifier; the control it belongs to is the parent. + re: /\b(\d{1,2}\.\d{1,2})\b/, + parentRe: /\bCIS[-\s]?(\d{1,2})\b/i, + parent: (m) => `CIS-${m[1]}`, + }, + 'PCI DSS v4.0': { + re: /\bReq(?:uirement)?\.?\s*(\d{1,2}(?:\.\d{1,3}){0,2})\b/i, + canonical: (m) => `Req ${m[1]}`, + }, + 'NIST SP 800-218A': { + re: /\b([A-Z]{2}\.\d{1,2}\.\d{1,2}(?:-PS)?)\b/, + }, + 'NIST SP 800-82 Rev 3': { + // Sections of the overlay, and the SP 800-53 controls it cites (#35 B). + re: /(?:§|\bSection\s+)(\d{1,2}(?:\.\d{1,2}){0,2})\b|\b([A-Z]{2}-\d{1,2})\b/, + canonical: (m) => (m[1] ? `§${m[1]}` : m[2]), + }, + 'CWE/CVE': { + re: /\b(CWE-\d{1,4}|CVE-\d{4}-\d{4,7})\b/i, + canonical: (m) => m[1].toUpperCase(), + }, + 'OWASP AI Testing Guide': { + // Category codes, always written "IHT — Input Handling". + re: /\b([A-Z]{3})\b(?=\s*[—–-])/, + }, + 'ISO/IEC 42001:2023': { + re: /\b(A\.\d{1,2}(?:\.\d{1,2}){0,2})\b|\bCl(?:ause)?\.?\s*(\d{1,2}(?:\.\d{1,2}){0,2})\b/, + canonical: (m) => m[1] || m[2], + }, +}; + +/** Strip the identifier and any leading separator from the cell it was found in. */ +function remainder(cell, matchText) { + return cell + .replace(matchText, ' ') + .replace(/^[\s—–\-–:.)\]]+/, '') + .replace(/\s{2,}/g, ' ') + .trim(); +} + +/** + * Resolve one row. + * + * @param {string} framework framework name as the mapping files write it + * @param {string[]} cells the row's cells, in order + * @param {string[]} headers the table's header cells, when it has them + * @returns {{id: string, name: string, parent: string|null, cellIndex: number}|null} + * null when the framework has no grammar, or no cell carries its id + */ +/** Header labels that introduce a control's name rather than its requirement. */ +const NAME_HEADER = /^(name|title|control|criteri|safeguard|practice|categor|article|section|clause|requirement|principle|domain)/; + +function resolveControlId(framework, cells, headers = []) { + const g = GRAMMARS[framework]; + if (!g) return null; + + for (let i = 0; i < cells.length; i++) { + const cell = String(cells[i] || '').replace(/\*\*/g, '').trim(); + if (!cell) continue; + const m = cell.match(g.re); + if (!m) continue; + + const id = g.canonical ? g.canonical(m) : m[1]; + if (!id) continue; + + // The name: what is left in this cell once the id is removed. Failing + // that, the nearest cell *before* the id — these tables write + // "Name | ID | prose", never "ID | prose | Name", so a later cell is the + // requirement or its evidence, not a control name. + let name = remainder(cell, m[0]); + if (!name || name.length > NAME_MAX) { + name = ''; + const usable = (j) => { + const text = String(cells[j] || '').replace(/\*\*/g, '').trim(); + return text && text.length <= NAME_MAX && !g.re.test(text) ? text : null; + }; + // The table says which column holds the name. + for (let j = 0; j < cells.length && !name; j++) { + if (j === i) continue; + const h = String(headers[j] || '').toLowerCase().replace(/[^a-z ]/g, ' ').trim(); + if (h && NAME_HEADER.test(h)) name = usable(j) || ''; + } + // Otherwise the nearest cell before the id: these tables write + // "Name | ID | prose", never "ID | prose | Name". + for (let j = i - 1; j >= 0 && !name; j--) name = usable(j) || ''; + } + + let parent = null; + if (g.parentRe) { + for (const c of cells) { + const pm = String(c || '').match(g.parentRe); + if (pm) { parent = g.parent(pm); break; } + } + } + + return { id, name, parent, cellIndex: i }; + } + return null; +} + +/** + * What a finished `control_id` must look like, per framework — the anchored + * form of the grammar above. The validator uses it to prove the repair holds + * and to catch a future row that reintroduces prose. + */ +const ID_SHAPES = { + 'SOC 2': /^(?:CC|PI|A|C|P)\d\.\d{1,2}$/, + 'EU AI Act': /^(?:Art\. \d{1,3}(?:\(\w{1,3}\))*|Annex [IVXL]+)$/, + 'OWASP NHI Top 10': /^NHI-\d{1,2}$/, + 'CIS Controls v8.1': /^\d{1,2}\.\d{1,2}$/, + 'PCI DSS v4.0': /^Req \d{1,2}(?:\.\d{1,3}){0,2}$/, + 'NIST SP 800-218A': /^[A-Z]{2}\.\d{1,2}\.\d{1,2}(?:-PS)?$/, + 'NIST SP 800-82 Rev 3': /^(?:§\d{1,2}(?:\.\d{1,2}){0,2}|[A-Z]{2}-\d{1,2})$/, + 'CWE/CVE': /^(?:CWE-\d{1,4}|CVE-\d{4}-\d{4,7})$/, + 'OWASP AI Testing Guide': /^[A-Z]{3}$/, + 'ISO/IEC 42001:2023': /^(?:A\.\d{1,2}(?:\.\d{1,2}){0,2}|\d{1,2}(?:\.\d{1,2}){0,2})$/, +}; + +/** True when `id` is a well-formed identifier for `framework`. */ +function isValidControlId(framework, id) { + const shape = ID_SHAPES[framework]; + return shape ? shape.test(String(id).trim()) : true; +} + +module.exports = { resolveControlId, isValidControlId, GRAMMARS, ID_SHAPES, NAME_MAX }; diff --git a/scripts/control-ids.test.mjs b/scripts/control-ids.test.mjs new file mode 100644 index 0000000..5e1a9e9 --- /dev/null +++ b/scripts/control-ids.test.mjs @@ -0,0 +1,68 @@ +/** + * The identifier grammar behind the #35 repair. + * + * Every case below is a row shape that exists in the mapping files today — + * the same framework written differently across the source lists, which is why + * a positional rule cannot work. + */ + +import { test } from 'node:test'; +import assert from 'node:assert/strict'; +import { createRequire } from 'node:module'; + +const require = createRequire(import.meta.url); +const { resolveControlId } = require('./control-ids.js'); + +const cases = [ + // framework, row cells, expected id, expected name, expected parent, table headers + ['SOC 2', ['C1.1 — Confidentiality policy', 'Policy identifying confidential information in GenAI scope'], 'C1.1', 'Confidentiality policy', null], + ['SOC 2', ['CC3.2', 'Goal hijack risk identified in risk assessment — prompt injection, indirect injection', 'Risk register'], 'CC3.2', '', null, ['Criteria', 'How it applies', 'Evidence']], + ['EU AI Act', ['Art. 9', 'Risk management system', 'Mandatory for high-risk'], 'Art. 9', 'Risk management system', null, ['Article', 'Title', 'Relevance']], + ['EU AI Act', ['Art. 9 — Risk management', 'Goal hijack scenarios identified and mitigated in risk management system'], 'Art. 9', 'Risk management', null], + ['EU AI Act', ['Article 15', 'Accuracy, robustness, cybersecurity'], 'Art. 15', 'Accuracy, robustness, cybersecurity', null, ['Article', 'Title']], + // No header to say where the name is, and the id cell holds only the id: + // the row yields no name rather than promoting a requirement into one. + ['PCI DSS v4.0', ['Req 11.3', 'Penetration testing covers goal hijack'], 'Req 11.3', '', null], + ['OWASP NHI Top 10', ['NHI-5 Over-Privileged NHI', 'Hijacked agent with excess privilege causes larger blast radius'], 'NHI-5', 'Over-Privileged NHI', null], + ['CIS Controls v8.1', ['CIS 16 — Application Software Security', '16.1 Establish secure application development standards', 'IG2', 'Secure development standards'], '16.1', 'Establish secure application development standards', 'CIS-16'], + ['CIS Controls v8.1', ['3.1 — Safeguard name', 'CIS 3', 'IG1'], '3.1', 'Safeguard name', 'CIS-3'], + ['PCI DSS v4.0', ['Req 6.2', 'Bespoke agent code reviewed for injection resistance — all agent integration code'], 'Req 6.2', '', null], + ['PCI DSS v4.0', ['Bespoke and custom software', 'Requirement 6.2.4', 'Injection resistance'], 'Req 6.2.4', 'Bespoke and custom software', null, ['Title', 'Requirement', 'How it applies']], + ['NIST SP 800-218A', ['PW.2.1-PS – Design software to meet security requirements', 'Threat modelling covers prompt injection'], 'PW.2.1-PS', 'Design software to meet security requirements', null], + ['NIST SP 800-82 Rev 3', ['§5.3', 'Vulnerabilities common to IT and OT', 'Applies to agent control loops'], '§5.3', 'Vulnerabilities common to IT and OT', null, ['Section', 'Title', 'Relevance']], + ['NIST SP 800-82 Rev 3', ['Section 5.3 — Threats', 'Guidance', 'How it applies'], '§5.3', 'Threats', null, ['Section', 'Guidance', 'How it applies']], + ['NIST SP 800-82 Rev 3', ['SI-10 Information Input Validation', 'Validate all inputs to the control system'], 'SI-10', 'Information Input Validation', null], + ['CWE/CVE', ['Improper Input Validation', 'CWE-20', 'Unvalidated prompt content'], 'CWE-20', 'Improper Input Validation', null], + ['CWE/CVE', ['CWE-74', 'Injection', 'Prompt injection is an injection flaw'], 'CWE-74', 'Injection', null, ['ID', 'Name', 'Relevance']], + ['OWASP AI Testing Guide', ['IHT — Input Handling', 'Prompt injection test cases'], 'IHT', 'Input Handling', null], + ['ISO/IEC 42001:2023', ['A.6.2.3', 'AI system security', 'Controls for AI system security'], 'A.6.2.3', 'AI system security', null, ['Control', 'Title', 'Relevance']], + ['ISO/IEC 42001:2023', ['Cl. 6.1 — Actions to address risks', 'Risk treatment covers AI-specific risk'], '6.1', 'Actions to address risks', null], +]; + +test('the grammar finds the identifier wherever the row puts it', () => { + for (const [framework, cells, id, name, parent, headers] of cases) { + const got = resolveControlId(framework, cells, headers); + assert.ok(got, `${framework}: no id found in ${JSON.stringify(cells)}`); + assert.equal(got.id, id, `${framework}: id from ${JSON.stringify(cells)}`); + assert.equal(got.name, name, `${framework}: name from ${JSON.stringify(cells)}`); + assert.equal(got.parent, parent, `${framework}: parent from ${JSON.stringify(cells)}`); + } +}); + +test('a framework with no grammar is left to the existing parser', () => { + assert.equal(resolveControlId('MITRE ATLAS', ['Evade AI Model', 'AML.T0015']), null); + assert.equal(resolveControlId('NIST AI RMF 1.0', ['GOVERN 1.1', 'Policies']), null); +}); + +test('a row that carries no identifier resolves to nothing rather than guessing', () => { + assert.equal(resolveControlId('SOC 2', ['Some heading', 'Some prose about controls']), null); + assert.equal(resolveControlId('EU AI Act', ['Governance', 'General obligations']), null); +}); + +test('prose is never returned as a control name', () => { + const prose = 'Policy identifying confidential information in GenAI scope — training data, RAG corpus, embeddings, outputs, and every downstream copy of them'; + const got = resolveControlId('SOC 2', ['CC6.1', prose]); + assert.equal(got.id, 'CC6.1'); + assert.notEqual(got.name, prose); + assert.ok(got.name.length <= 120); +}); diff --git a/scripts/generate.js b/scripts/generate.js index 14ff33e..8bd5858 100644 --- a/scripts/generate.js +++ b/scripts/generate.js @@ -15,10 +15,36 @@ const fs = require('fs'); const path = require('path'); const { indexFailures, evidenceForMapping } = require('./evidence'); +const { resolveControlId } = require('./control-ids.js'); const ROOT = path.resolve(__dirname, '..'); const ENTRIES_DIR = path.join(ROOT, 'data', 'entries'); +/** + * Registry titles, keyed by framework then control id. + * + * Some mapping tables carry the identifier and the requirement but no control + * name — "CC3.2 | prose | evidence". The framework registry already holds the + * official title for that id, so the row takes it from there rather than + * repeating the id as its own name. + */ +let REGISTRY_TITLES = null; +function registryTitle(framework, controlId) { + if (!REGISTRY_TITLES) { + REGISTRY_TITLES = new Map(); + const dir = path.join(ROOT, 'data', 'frameworks'); + if (fs.existsSync(dir)) { + for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.json'))) { + const reg = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')); + const byId = new Map(); + for (const c of reg.controls || []) if (c.control_id && c.title) byId.set(c.control_id, c.title); + REGISTRY_TITLES.set(reg.name, byId); + } + } + } + return REGISTRY_TITLES.get(framework)?.get(controlId) ?? null; +} + const DRY_RUN = process.argv.includes('--dry-run'); const SINGLE_ID = (() => { const i = process.argv.indexOf('--id'); return i !== -1 ? process.argv[i + 1] : null; })(); @@ -466,9 +492,26 @@ function parseControlTable(sectionBody, frameworkName, qr) { if (!rows.length) return []; const header = v2HeaderIndex(mappingSection.body); + const headerLine = mappingSection.body.split('\n').find((l) => l.trim().startsWith('|')); + const headerCells = headerLine ? splitRow(headerLine) : []; const mappings = []; + // A section can hold more than one table — LLM_NISTSP80082.md follows its + // SP 800-82 sections with an SP 800-53 table. The second table's header row + // reaches us as data, preceded by its own |---|---| separator. Splitting on + // those separators drops the header rows and gives each table the headers + // that actually describe its columns. + const tableRows = []; + let currentHeader = headerCells; for (const cols of rows) { + if (cols.length && cols.every((c) => /^[-:\s]*$/.test(c))) { + if (tableRows.length) currentHeader = tableRows.pop().cols; + continue; + } + tableRows.push({ cols, headers: currentHeader }); + } + + for (const { cols, headers: rowHeaders } of tableRows) { if (cols.length < 2) continue; const col0 = cols[0]; @@ -490,7 +533,17 @@ function parseControlTable(sectionBody, frameworkName, qr) { const id1 = extractIdAndUrl(col1); const id0 = extractIdAndUrl(col0); - if (id1.url) { + // The framework's own identifier shape decides first (#35). Only when the + // row carries no such identifier do the positional rules below apply. + const byGrammar = resolveControlId(frameworkName, cols.map((c) => extractIdAndUrl(c).text), rowHeaders); + let grammarParent = null; + + if (byGrammar) { + controlId = byGrammar.id; + controlName = byGrammar.name || registryTitle(frameworkName, byGrammar.id) || ''; + grammarParent = byGrammar.parent; + controlUrl = (id1.url || id0.url) ?? null; + } else if (id1.url) { // col1 is a link — ID is the link text, name is col0 text controlId = id1.text; controlName = id0.text; @@ -520,7 +573,7 @@ function parseControlTable(sectionBody, frameworkName, qr) { // Skip separator / header rows that leaked through if (!controlId || /^[-:=]+$/.test(controlId) || controlId === controlName && !controlId) continue; // Skip rows where the ID is clearly a column heading word - if (/^(technique|control|practice|category|domain|function|id|name|risk|measure)$/i.test(controlId)) continue; + if (/^(technique|control|practice|category|domain|function|id|name|risk|measure|title|criteria|safeguard|requirement|article|clause|section|code|abbreviation)$/i.test(controlId)) continue; const mapping = { framework: frameworkName, @@ -531,10 +584,26 @@ function parseControlTable(sectionBody, frameworkName, qr) { }; if (controlUrl) mapping.url = controlUrl; + // CIS rows name both the safeguard and the control it belongs to (#35 A). + if (grammarParent) mapping.parent = grammarParent; + // The SP 800-82 files also map the SP 800-53 controls the overlay cites. + // Those ids are kept, and labelled, so they are not read as 800-82 + // section numbers (#35 B). + if (frameworkName === 'NIST SP 800-82 Rev 3' && /^[A-Z]{2}-\d{1,2}$/.test(controlId)) { + mapping.id_source = 'NIST SP 800-53 control cited by the SP 800-82 overlay'; + } // Notes: last column if it differs from the ID/name columns and has useful length if (cols.length >= 3 && lastCol && lastCol !== controlId && lastCol !== controlName && lastCol.length > 5) { mapping.notes = lastCol.replace(/\s+/g, ' ').trim().substring(0, 350); + } else if (byGrammar && cols.length === 2 && lastIdx !== byGrammar.cellIndex) { + // Two-column tables ("CC3.2 — Name | requirement") used to keep the + // requirement by mis-filing it as the control id. Now that the id comes + // from the grammar, the requirement belongs in notes rather than nowhere. + const other = extractIdAndUrl(cols[lastIdx]).text; + if (other && other !== controlName && other.length > 5) { + mapping.notes = other.replace(/\s+/g, ' ').trim().substring(0, 350); + } } // Schema v2: read the columns when a file has been migrated, and tag the diff --git a/scripts/validate.js b/scripts/validate.js index 017caa7..8e64aaa 100644 --- a/scripts/validate.js +++ b/scripts/validate.js @@ -819,6 +819,45 @@ function checkMaestroLayers() { return bad === 0; } +/** + * 21. Every mapping row's `control_id` must be an identifier, not prose. + * + * `parseControlTable()` used to fall through to "column 0 is the id" whenever + * a row did not look positional, which put the requirement text in + * `control_id` on 612 rows — a reader could not follow an id back to the + * framework, and the control-level join resolved by luck (issue #35). The + * per-framework grammar in scripts/control-ids.js fixed that; this keeps it + * fixed for the ten frameworks whose identifier shape is known. + */ +function checkControlIdShapes() { + const { isValidControlId, ID_SHAPES } = require('./control-ids.js'); + const dir = path.join(ROOT, 'data', 'entries'); + if (!fs.existsSync(dir)) return true; + + const offenders = new Map(); + let checked = 0; + + for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.json'))) { + const entry = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')); + for (const m of entry.mappings || []) { + if (!ID_SHAPES[m.framework]) continue; + checked++; + if (!isValidControlId(m.framework, m.control_id)) { + const key = `${m.framework}: "${String(m.control_id).slice(0, 60)}"`; + offenders.set(key, (offenders.get(key) || 0) + 1); + } + } + } + + for (const [what, n] of offenders) { + fail('Control ids', `${what} is not a ${what.split(':')[0]} identifier (${n} row(s)) — see issue #35`); + } + if (!offenders.size) { + pass('Control ids', `All ${checked} rows in the ${Object.keys(ID_SHAPES).length} frameworks with a known id grammar carry a well-formed identifier`); + } + return offenders.size === 0; +} + /** * 20. MITRE ATLAS mapping rows must agree with the ATLAS registry. * @@ -1063,6 +1102,7 @@ function run() { checkFrameworkVersions(); checkMaestroLayers(); checkAtlasMappings(); + checkControlIdShapes(); checkEvidence(); }