From 22b3a4864a0d5a8791427eac7427eca024a87610 Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Fri, 18 Sep 2026 09:54:03 -0400 Subject: [PATCH 1/2] Fix #112: recover 328 replacement characters in the registries, and guard data files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fourteen registry files carried 328 U+FFFD replacement characters, mostly where an em dash belongs. They ship: the registries go out in the npm package, in docs/frameworks-registry.js and in the OSCAL/STIX exports. Every character is recovered from the source text rather than assumed. The registries were extracted from the mapping rows, so for each corrupted string the text either side of the character is looked up in the Markdown and the entry JSON, and the character that sits between them is read off. A character is taken only when every match agrees; the window narrows from 24 to 8 characters when a description concatenates several rows, and keeps the raw slice when only one word follows, since trimming to a word boundary could otherwise empty it. All 328 resolved, every one to U+2014. None was guessed, and no other character was found. The guard from T-ACC06 only ever read Markdown, which is why this sat unnoticed. It now also reads data/frameworks/*.json, data/entries/*.json and data/*.json, checking for U+FFFD alone — the arrow heuristic is tuned for prose and diagrams, not JSON. Negative-tested: a replacement character injected into soc2.json fails validation, naming the file and line. Co-Authored-By: Claude Opus 5 (1M context) --- data/frameworks/cis-controls.json | 50 ++-- data/frameworks/cwe-cve.json | 22 +- data/frameworks/eu-ai-act.json | 2 +- data/frameworks/isa-62443.json | 26 +- data/frameworks/iso-27001.json | 20 +- data/frameworks/iso-42001.json | 30 +-- data/frameworks/nist-ai-rmf.json | 2 +- data/frameworks/nist-csf.json | 44 ++-- data/frameworks/nist-sp-800-82.json | 22 +- data/frameworks/owasp-ai-testing.json | 4 +- data/frameworks/owasp-asvs.json | 48 ++-- data/frameworks/owasp-nhi.json | 20 +- data/frameworks/owasp-samm.json | 6 +- data/frameworks/pci-dss.json | 56 ++-- docs/frameworks-registry.js | 352 +++++++++++++------------- scripts/validate.js | 20 +- 16 files changed, 370 insertions(+), 354 deletions(-) diff --git a/data/frameworks/cis-controls.json b/data/frameworks/cis-controls.json index 1dc1b75..37ee5ef 100644 --- a/data/frameworks/cis-controls.json +++ b/data/frameworks/cis-controls.json @@ -13,7 +13,7 @@ { "control_id": "2.1", "title": "Establish and maintain software inventory", - "description": "ML SBOM as software asset inventory � all agent components (tools, MCP servers, models, libraries)", + "description": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)", "kind": "control", "parent": "CIS-2" }, @@ -55,14 +55,14 @@ { "control_id": "3.10", "title": "Encrypt sensitive data in transit", - "description": "All A2A messages encrypted in transit � no cleartext inter-agent communication", + "description": "All A2A messages encrypted in transit — no cleartext inter-agent communication", "kind": "control", "parent": "CIS-3" }, { "control_id": "3.11", "title": "Encrypt sensitive data at rest", - "description": "Agent credentials encrypted at rest � secret manager, no cleartext storage; Agent memory stores encrypted at rest � embeddings, long-term memory, operational knowledge; Embeddings, training data, and RAG caches containing sensitive data encrypted", + "description": "Agent credentials encrypted at rest — secret manager, no cleartext storage; Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge; Embeddings, training data, and RAG caches containing sensitive data encrypted", "kind": "control", "parent": "CIS-3" }, @@ -76,7 +76,7 @@ { "control_id": "4.1", "title": "Establish secure configuration process", - "description": "Secure configuration includes code execution sandbox � no defaults permitting unrestricted execution; Secure configuration includes circuit breakers and rate limits � cascade prevention as configuration requirement; Secure configuration for LLM deployments � system prompts not in cleartext config", + "description": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution; Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement; Secure configuration for LLM deployments — system prompts not in cleartext config", "kind": "control", "parent": "CIS-4" }, @@ -97,21 +97,21 @@ { "control_id": "5.4", "title": "Restrict administrator privileges", - "description": "Agent tool access managed as privileged access � minimum scope, regular review; Agent credentials managed as privileged accounts � minimum scope, regular review, JIT issuance; Approval flows independent of agent interface � sensitive approvals cannot be completed via agent chat", + "description": "Agent tool access managed as privileged access — minimum scope, regular review; Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance; Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat", "kind": "control", "parent": "CIS-5" }, { "control_id": "6.1", "title": "Establish access granting process", - "description": "Formal process for granting agent tool access � documented justification per tool; Formal process for granting LLM tool access � documented justification required", + "description": "Formal process for granting agent tool access — documented justification per tool; Formal process for granting LLM tool access — documented justification required", "kind": "control", "parent": "CIS-6" }, { "control_id": "6.2", "title": "Establish an access revoking process", - "description": "Agent credential revocation process � immediate revocation on detection, decommission procedure", + "description": "Agent credential revocation process — immediate revocation on detection, decommission procedure", "kind": "control", "parent": "CIS-6" }, @@ -138,21 +138,21 @@ { "control_id": "7.1", "title": "Establish vulnerability management process", - "description": "Agent component CVEs in vulnerability management � urgent patching for code execution risks; Vulnerability management process covers LLM component CVEs and dependency risks", + "description": "Agent component CVEs in vulnerability management — urgent patching for code execution risks; Vulnerability management process covers LLM component CVEs and dependency risks", "kind": "control", "parent": "CIS-7" }, { "control_id": "7.5", "title": "Perform automated vulnerability scanning", - "description": "Automated scanning of training pipeline components � vulnerabilities in data processing libraries", + "description": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries", "kind": "control", "parent": "CIS-7" }, { "control_id": "8.2", "title": "Collect audit logs", - "description": "All agent inputs logged � injection attempts detectable through log analysis; Memory write operations logged � who or what wrote, when, content hash; Comprehensive audit logging of all agent actions � no production deployment without full observability", + "description": "All agent inputs logged — injection attempts detectable through log analysis; Memory write operations logged — who or what wrote, when, content hash; Comprehensive audit logging of all agent actions — no production deployment without full observability", "kind": "control", "parent": "CIS-8" }, @@ -166,14 +166,14 @@ { "control_id": "8.5", "title": "Collect detailed audit logs", - "description": "All tool invocations logged � tool identity, parameters, agent identity, timestamp; All credential operations logged � issuance, use, anomalous patterns detectable; All A2A messages logged � sender identity, content hash, timestamp, schema validation results", + "description": "All tool invocations logged — tool identity, parameters, agent identity, timestamp; All credential operations logged — issuance, use, anomalous patterns detectable; All A2A messages logged — sender identity, content hash, timestamp, schema validation results", "kind": "control", "parent": "CIS-8" }, { "control_id": "8.6", "title": "Collect DNS query audit logs", - "description": "Agent traffic monitored � cascade indicators detected before physical impact", + "description": "Agent traffic monitored — cascade indicators detected before physical impact", "kind": "control", "parent": "CIS-8" }, @@ -213,7 +213,7 @@ { "control_id": "12.4", "title": "Establish and maintain architecture diagram", - "description": "A2A communication channels mapped in network architecture � authentication method, encryption status", + "description": "A2A communication channels mapped in network architecture — authentication method, encryption status", "kind": "control", "parent": "CIS-12" }, @@ -233,14 +233,14 @@ { "control_id": "13.1", "title": "Centralise security event alerting", - "description": "Agent behavioural anomalies centralised and alerted � rogue agent patterns detected through SIEM", + "description": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM", "kind": "control", "parent": "CIS-13" }, { "control_id": "13.3", "title": "Deploy a network-based intrusion detection system", - "description": "Memory store access monitored � bulk read, anomalous write patterns detected", + "description": "Memory store access monitored — bulk read, anomalous write patterns detected", "kind": "control", "parent": "CIS-13" }, @@ -260,7 +260,7 @@ { "control_id": "14.1", "title": "Establish security awareness programme", - "description": "All users of agentic tools trained on AI limitations � verification requirements, how to identify manipulation; User training on LLM data handling � what data should not be shared with LLMs; User training on LLM output limitations � verification requirements and critical evaluation", + "description": "All users of agentic tools trained on AI limitations — verification requirements, how to identify manipulation; User training on LLM data handling — what data should not be shared with LLMs; User training on LLM output limitations — verification requirements and critical evaluation", "kind": "control", "parent": "CIS-14" }, @@ -280,35 +280,35 @@ { "control_id": "15.1", "title": "Establish service provider management process", - "description": "Agent tool and MCP providers managed as service providers � security assessment before onboarding", + "description": "Agent tool and MCP providers managed as service providers — security assessment before onboarding", "kind": "control", "parent": "CIS-15" }, { "control_id": "16.1", "title": "Establish secure application development standards", - "description": "Secure development standards covering agentic integrations � input validation, goal-state verification; Secure development standards covering LLM integration � input validation, context separation", + "description": "Secure development standards covering agentic integrations — input validation, goal-state verification; Secure development standards covering LLM integration — input validation, context separation", "kind": "control", "parent": "CIS-16" }, { "control_id": "16.2", "title": "Implement code review", - "description": "Code review for all LLM integration code � prompt injection patterns reviewed", + "description": "Code review for all LLM integration code — prompt injection patterns reviewed", "kind": "control", "parent": "CIS-16" }, { "control_id": "16.6", "title": "Use only up-to-date and trusted third-party components", - "description": "Approved component list � only sourced from approved vendors, signatures verified; Only approved, verified LLM components used in production � unsigned components rejected", + "description": "Approved component list — only sourced from approved vendors, signatures verified; Only approved, verified LLM components used in production — unsigned components rejected", "kind": "control", "parent": "CIS-16" }, { "control_id": "16.7", "title": "Use standard hardening configuration templates", - "description": "Hardened training pipeline configurations � immutable infrastructure, locked data sources", + "description": "Hardened training pipeline configurations — immutable infrastructure, locked data sources", "kind": "control", "parent": "CIS-16" }, @@ -328,28 +328,28 @@ { "control_id": "17.1", "title": "Designate personnel for incident response", - "description": "Defined response for cascade events � kill switch activation, process control fallback, operations notification; Defined response for trust exploitation incidents � operator retraining, pattern audit, interface redesign; Defined response for LLM misinformation incidents � correction, notification, root cause", + "description": "Defined response for cascade events — kill switch activation, process control fallback, operations notification; Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign; Defined response for LLM misinformation incidents — correction, notification, root cause", "kind": "control", "parent": "CIS-17" }, { "control_id": "17.2", "title": "Establish incident response procedures", - "description": "Rogue agent containment as incident response procedure � kill switch, audit, state validation, forensic", + "description": "Rogue agent containment as incident response procedure — kill switch, audit, state validation, forensic", "kind": "control", "parent": "CIS-17" }, { "control_id": "18.1", "title": "Establish penetration testing programme", - "description": "Adversarial testing covering goal hijack � direct, indirect, multi-turn injection scenarios; Adversarial testing programme covering prompt injection scenarios", + "description": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios; Adversarial testing programme covering prompt injection scenarios", "kind": "control", "parent": "CIS-18" }, { "control_id": "18.3", "title": "Remediate penetration testing findings", - "description": "Poisoning scenarios in penetration testing � verify data integrity controls hold under attack", + "description": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack", "kind": "control", "parent": "CIS-18" }, diff --git a/data/frameworks/cwe-cve.json b/data/frameworks/cwe-cve.json index 73a9272..dfe718e 100644 --- a/data/frameworks/cwe-cve.json +++ b/data/frameworks/cwe-cve.json @@ -14,7 +14,7 @@ "control_id": "CWE-20", "title": "CWE-20", "kind": "weakness", - "description": "Root cause � agent inputs not validated before entering model context; indirect injection content not treated as untrusted; Tool parameters generated by LLM not validated against safe ranges before execution; Content entering agent memory not validated before write" + "description": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted; Tool parameters generated by LLM not validated against safe ranges before execution; Content entering agent memory not validated before write" }, { "control_id": "CWE-74", @@ -74,7 +74,7 @@ "control_id": "CWE-200", "title": "CWE-200", "kind": "weakness", - "description": "System prompt and agent configuration not protected � extraction enables targeted trust exploitation" + "description": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation" }, { "control_id": "CWE-201", @@ -111,7 +111,7 @@ { "control_id": "CWE-276", "title": "CWE-276", - "description": "Agent deployed with broader permissions than needed � amplifies rogue blast radius", + "description": "Agent deployed with broader permissions than needed — amplifies rogue blast radius", "kind": "weakness", "parent": null }, @@ -119,7 +119,7 @@ "control_id": "CWE-284", "title": "CWE-284", "kind": "weakness", - "description": "Agent can invoke tools it should not have access to; tool parameters not range-validated; Vector store and memory databases with insufficient access controls permitting unauthorised writes; Rogue agent exceeds its permitted access scope � no scope enforcement" + "description": "Agent can invoke tools it should not have access to; tool parameters not range-validated; Vector store and memory databases with insufficient access controls permitting unauthorised writes; Rogue agent exceeds its permitted access scope — no scope enforcement" }, { "control_id": "CWE-285", @@ -129,7 +129,7 @@ { "control_id": "CWE-287", "title": "CWE-287", - "description": "A2A channels without mutual authentication � agents accept messages from any sender", + "description": "A2A channels without mutual authentication — agents accept messages from any sender", "kind": "weakness", "parent": null }, @@ -173,7 +173,7 @@ "control_id": "CWE-346", "title": "CWE-346", "kind": "weakness", - "description": "Agent does not verify that A2A messages originate from the claimed sender; User cannot determine whether advice originates from AI or human � no origin verification" + "description": "Agent does not verify that A2A messages originate from the claimed sender; User cannot determine whether advice originates from AI or human — no origin verification" }, { "control_id": "CWE-349", @@ -191,7 +191,7 @@ "control_id": "CWE-400", "title": "CWE-400", "kind": "weakness", - "description": "Agent resource consumption not bounded � enables exhaustion propagation across cluster" + "description": "Agent resource consumption not bounded — enables exhaustion propagation across cluster" }, { "control_id": "CWE-434", @@ -258,7 +258,7 @@ { "control_id": "CWE-613", "title": "CWE-613", - "description": "Long-lived agent credentials without expiry or rotation � NHI-7", + "description": "Long-lived agent credentials without expiry or rotation — NHI-7", "kind": "weakness", "parent": null }, @@ -291,7 +291,7 @@ { "control_id": "CWE-703", "title": "CWE-703", - "description": "Agent failures not caught and handled � exception propagates to downstream agents", + "description": "Agent failures not caught and handled — exception propagates to downstream agents", "kind": "weakness", "parent": null }, @@ -348,7 +348,7 @@ { "control_id": "CWE-913", "title": "CWE-913", - "description": "MCP descriptors and tool specifications are dynamically loaded code resources � modification not controlled", + "description": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled", "kind": "weakness", "parent": null }, @@ -374,7 +374,7 @@ { "control_id": "CWE-1341", "title": "CWE-1341", - "description": "Memory TTL not enforced � entries persist beyond intended lifetime", + "description": "Memory TTL not enforced — entries persist beyond intended lifetime", "kind": "weakness", "parent": null }, diff --git a/data/frameworks/eu-ai-act.json b/data/frameworks/eu-ai-act.json index 5403a02..718d75c 100644 --- a/data/frameworks/eu-ai-act.json +++ b/data/frameworks/eu-ai-act.json @@ -164,7 +164,7 @@ { "control_id": "Art. 53(1)(a)", "title": "GPAI documentation", - "description": "Data governance for training data � sources, quality, privacy measures � is a GPAI documentation obligation; Data governance for GPAI training data is a binding documentation obligation from Aug 2025", + "description": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation; Data governance for GPAI training data is a binding documentation obligation from Aug 2025", "kind": "control", "parent": null }, diff --git a/data/frameworks/isa-62443.json b/data/frameworks/isa-62443.json index a3eae68..c654bf9 100644 --- a/data/frameworks/isa-62443.json +++ b/data/frameworks/isa-62443.json @@ -269,79 +269,79 @@ { "control_id": "SR 1.9", "title": "Session lock", - "description": "Operator-accessible agent kill switch � halt all agent activity immediately without affecting process control; Agent sessions terminated and credentials revoked immediately on compromise detection; Ability to terminate LLM sessions immediately on detection of suspicious behaviour", + "description": "Operator-accessible agent kill switch — halt all agent activity immediately without affecting process control; Agent sessions terminated and credentials revoked immediately on compromise detection; Ability to terminate LLM sessions immediately on detection of suspicious behaviour", "kind": "control" }, { "control_id": "SR 6.6", "title": "Timely response to events", - "description": "Anomalous tool invocation patterns detected and responded to � alert, suspend, investigate; Cascade indicators detected and responded to before physical process impact; Shadow AI discovery triggers incident response � data impact assessment, vendor notification", + "description": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate; Cascade indicators detected and responded to before physical process impact; Shadow AI discovery triggers incident response — data impact assessment, vendor notification", "kind": "control" }, { "control_id": "SR 1.6", "title": "Authenticator management", - "description": "Agent credentials managed with defined lifecycle � issuance, rotation, revocation procedures; Agent credential lifecycle managed � issuance, rotation, revocation documented per agent; LLM interactions logged with user identity — injection attempts attributable to specific sessions", + "description": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures; Agent credential lifecycle managed — issuance, rotation, revocation documented per agent; LLM interactions logged with user identity — injection attempts attributable to specific sessions", "kind": "control" }, { "control_id": "SR 2.6", "title": "Use control", - "description": "Only approved, verified agent components permitted in OT zones � no runtime loading of unapproved tools; Rogue agent cannot load additional tools or expand its own capability scope; Only approved, validated data sources permitted in Zone 3 GenAI ingestion � unapproved sources blocked", + "description": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools; Rogue agent cannot load additional tools or expand its own capability scope; Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked", "kind": "control" }, { "control_id": "Supplier security requirements", "title": "62443-2-4", - "description": "Security requirements applied to all agent tool and MCP server vendors with OT access; GenAI vendors handling OT-derived assets subject to 62443-2-4 programme; GenAI vendors assessed under OT supplier security programme � same requirements as OT software vendors", + "description": "Security requirements applied to all agent tool and MCP server vendors with OT access; GenAI vendors handling OT-derived assets subject to 62443-2-4 programme; GenAI vendors assessed under OT supplier security programme — same requirements as OT software vendors", "kind": "control" }, { "control_id": "SR 2.3", "title": "Use control", - "description": "Agent code execution restricted to specific, defined operations � no shell access, no network programming; LLM advisory outputs clearly distinguished from authoritative documentation � source always visible; LLM output restricted to authorised actions — no raw output directly to control interfaces", + "description": "Agent code execution restricted to specific, defined operations — no shell access, no network programming; LLM advisory outputs clearly distinguished from authoritative documentation — source always visible; LLM output restricted to authorised actions — no raw output directly to control interfaces", "kind": "control" }, { "control_id": "SR 3.7", "title": "Software and information integrity (monitoring)", - "description": "Runtime monitoring of agent code execution � anomalous system calls detected and blocked; Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications; Continuous behavioural monitoring of all OT agents � deviation from established baseline detected", + "description": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked; Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications; Continuous behavioural monitoring of all OT agents — deviation from established baseline detected", "kind": "control" }, { "control_id": "SR 4.4", "title": "Communication integrity", - "description": "Message integrity enforced � replay protection, nonces, sequence numbers on A2A channels; GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ; OT-specific data masking before telemetry capture � tag IDs, equipment identifiers masked before logging", + "description": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels; GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ; OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging", "kind": "control" }, { "control_id": "SR 7.6", "title": "Denial of service protection", - "description": "Circuit breakers preventing cascade propagation � agent failure contained within defined blast radius; Poisoned model availability impact contained � fallback procedure prevents physical process disruption; Circuit breakers preventing OT GenAI service degradation from affecting process control", + "description": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius; Poisoned model availability impact contained — fallback procedure prevents physical process disruption; Circuit breakers preventing OT GenAI service degradation from affecting process control", "kind": "control" }, { "control_id": "SR 7.7", "title": "Control system backup", - "description": "Agent system failures cannot affect backup and recovery of OT process control; OT GenAI failures cannot affect backup and recovery of process control � independence verified; LLM resource exhaustion cannot affect backup and recovery of OT control systems", + "description": "Agent system failures cannot affect backup and recovery of OT process control; OT GenAI failures cannot affect backup and recovery of process control — independence verified; LLM resource exhaustion cannot affect backup and recovery of OT control systems", "kind": "control" }, { "control_id": "SR 5.3", "title": "Information flow restriction", - "description": "OT-sensitive context minimised before tool API calls � tools receive minimum required, not full OT context", + "description": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context", "kind": "control" }, { "control_id": "Security management system", "title": "62443-2-1", - "description": "OT security management system updated to cover GenAI deployments � policy, roles, assessment", + "description": "OT security management system updated to cover GenAI deployments — policy, roles, assessment", "kind": "control" }, { "control_id": "Security management", "title": "62443-2-1", - "description": "OT synthetic data governance policy � when synthetic data removes OT classification obligation", + "description": "OT synthetic data governance policy — when synthetic data removes OT classification obligation", "kind": "control" }, { diff --git a/data/frameworks/iso-27001.json b/data/frameworks/iso-27001.json index 849b567..c2cd9dc 100644 --- a/data/frameworks/iso-27001.json +++ b/data/frameworks/iso-27001.json @@ -341,61 +341,61 @@ { "control_id": "A.8.29", "title": "Security testing", - "description": "Adversarial testing programme covering goal hijack � direct, indirect, multi-turn injection before each release; Sandbox escape and code injection scenarios in security testing � adversarial testing before each deployment; Adversarial testing of model outputs for poisoning indicators before deployment", + "description": "Adversarial testing programme covering goal hijack — direct, indirect, multi-turn injection before each release; Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment; Adversarial testing of model outputs for poisoning indicators before deployment", "kind": "control" }, { "control_id": "A.5.15", "title": "Identity management", - "description": "Agent tool access governed through identity management � tool permissions scoped per agent identity; LLM tool access governed through identity management � tool permissions scoped per deployment", + "description": "Agent tool access governed through identity management — tool permissions scoped per agent identity; LLM tool access governed through identity management — tool permissions scoped per deployment", "kind": "control" }, { "control_id": "A.5.16", "title": "Identity management", - "description": "NHI lifecycle management � all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process; All agent identities inventoried and lifecycle-managed as non-human identities", + "description": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process; All agent identities inventoried and lifecycle-managed as non-human identities", "kind": "control" }, { "control_id": "A.5.20", "title": "Supplier agreements", - "description": "Contractual security requirements for all agent component suppliers � integrity guarantees, vulnerability notification SLA; Contractual requirements covering data minimisation, retention, and training use for tool providers; Contractual data handling requirements for labelling vendors and HITL service providers", + "description": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA; Contractual requirements covering data minimisation, retention, and training use for tool providers; Contractual data handling requirements for labelling vendors and HITL service providers", "kind": "control" }, { "control_id": "A.5.21", "title": "Supply chain security", - "description": "Managing ICT supply chain risks � agent tool and MCP server ecosystem explicitly in scope; Managing ICT supply chain risks � LLM model and library supply chain explicitly in scope", + "description": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope; Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope", "kind": "control" }, { "control_id": "A.8.26", "title": "Application security requirements", - "description": "Security requirements for agent code execution capability specified before development � sandbox spec, permitted operations; Input validation requirements specified for all GenAI data ingestion interfaces; Security requirements for LLM-to-SQL interfaces � read-only by default, parameterisation mandatory", + "description": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations; Input validation requirements specified for all GenAI data ingestion interfaces; Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory", "kind": "control" }, { "control_id": "A.8.13", "title": "Backup", - "description": "Agent state and configuration backed up � recovery to known-good state after cascade incident; Backup and recovery for all AI data assets � vector stores, embedding indexes, RAG corpora; Backup and recovery for LLM service infrastructure � failover capability tested", + "description": "Agent state and configuration backed up — recovery to known-good state after cascade incident; Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora; Backup and recovery for LLM service infrastructure — failover capability tested", "kind": "control" }, { "control_id": "A.5.17", "title": "Authentication information", - "description": "Secure management of agent credentials � no hardcoding, rotation enforced", + "description": "Secure management of agent credentials — no hardcoding, rotation enforced", "kind": "control" }, { "control_id": "A.8.27", "title": "Secure system architecture", - "description": "Training pipeline designed with integrity controls and supply chain verification; RAG pipeline designed with source trust verification and integrity controls; Training pipeline designed with integrity controls � data validation, source allowlisting, lineage tracking", + "description": "Training pipeline designed with integrity controls and supply chain verification; RAG pipeline designed with source trust verification and integrity controls; Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking", "kind": "control" }, { "control_id": "A.8.10", "title": "Information deletion", - "description": "Deletion and erasure obligations enforced across all derived assets � embeddings, caches, backups", + "description": "Deletion and erasure obligations enforced across all derived assets — embeddings, caches, backups", "kind": "control" }, { diff --git a/data/frameworks/iso-42001.json b/data/frameworks/iso-42001.json index 8be2b4e..1771176 100644 --- a/data/frameworks/iso-42001.json +++ b/data/frameworks/iso-42001.json @@ -52,7 +52,7 @@ { "control_id": "5", "title": "Policy", - "description": "Leadership commitment to AI transparency � AI disclosure and advisory labelling requirements in AI policy; Leadership commitment to human oversight � autonomous action scope defined in AI policy, signed off at executive level", + "description": "Leadership commitment to AI transparency — AI disclosure and advisory labelling requirements in AI policy; Leadership commitment to human oversight — autonomous action scope defined in AI policy, signed off at executive level", "kind": "control", "parent": null }, @@ -123,7 +123,7 @@ { "control_id": "7", "title": "Support", - "description": "Resources for AI systems include NHIs � agent identities inventoried and managed as AIMS resources; Documented information controls � system prompts managed as AIMS documented information with appropriate access controls", + "description": "Resources for AI systems include NHIs — agent identities inventoried and managed as AIMS resources; Documented information controls — system prompts managed as AIMS documented information with appropriate access controls", "kind": "control", "parent": null }, @@ -162,7 +162,7 @@ { "control_id": "8", "title": "Operation", - "description": "A2A communication documented as AIMS operational control � authentication requirements, encryption standards; Operational controls for LLM deployment � output handling requirements documented as AIMS operational procedures", + "description": "A2A communication documented as AIMS operational control — authentication requirements, encryption standards; Operational controls for LLM deployment — output handling requirements documented as AIMS operational procedures", "kind": "control", "parent": null }, @@ -201,7 +201,7 @@ { "control_id": "9", "title": "Performance evaluation", - "description": "Cascade incidents in AIMS performance evaluation � circuit breaker effectiveness, recovery times in management review; Rogue agent detection rates and containment times in AIMS management review; Resource consumption metrics in AIMS performance evaluation � consumption trends in management review", + "description": "Cascade incidents in AIMS performance evaluation — circuit breaker effectiveness, recovery times in management review; Rogue agent detection rates and containment times in AIMS management review; Resource consumption metrics in AIMS performance evaluation — consumption trends in management review", "kind": "control", "parent": null }, @@ -301,7 +301,7 @@ { "control_id": "A.5.2", "title": "Impact assessment", - "description": "Impact assessment covers goal hijack risk � what autonomous actions are possible if goal is redirected, who is affected; Tool misuse impact assessed � what harm is possible if each tool is misused autonomously; Impact of code execution capability formally assessed � RCE impact on persons and systems documented", + "description": "Impact assessment covers goal hijack risk — what autonomous actions are possible if goal is redirected, who is affected; Tool misuse impact assessed — what harm is possible if each tool is misused autonomously; Impact of code execution capability formally assessed — RCE impact on persons and systems documented", "kind": "control" }, { @@ -315,25 +315,25 @@ { "control_id": "A.6.1.2", "title": "Responsible AI system management", - "description": "Tool access managed responsibly throughout agent lifecycle � permission review, irreversibility classification, human oversight requirements; Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation; LLM components managed responsibly through lifecycle � acquisition, testing, deployment, decommission", + "description": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements; Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation; LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission", "kind": "control" }, { "control_id": "A.6.2.3", "title": "AI system security", - "description": "Goal-state verification and input validation as AIMS security design requirements � structural controls enforced at orchestration layer; Per-tool permission manifests and parameter validation as AIMS security controls; Credential security as AIMS design requirement � short-lived JIT credentials, no cleartext storage, least privilege", + "description": "Goal-state verification and input validation as AIMS security design requirements — structural controls enforced at orchestration layer; Per-tool permission manifests and parameter validation as AIMS security controls; Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege", "kind": "control" }, { "control_id": "A.6.2.6", "title": "Testing of AI systems", - "description": "Goal hijack scenarios in AIMS testing � direct, indirect, multi-turn injection tested before each production release; Sandbox escape and code injection scenarios in AIMS testing � adversarial testing before each deployment; A2A security scenarios in AIMS testing � spoofing, replay, schema violations before deployment", + "description": "Goal hijack scenarios in AIMS testing — direct, indirect, multi-turn injection tested before each production release; Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment; A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment", "kind": "control" }, { "control_id": "A.6.2.8", "title": "Monitoring of AI systems", - "description": "Memory integrity monitored in operation � anomalous write patterns, content integrity checks as AIMS monitoring; Cascade indicators monitored in operation � correlated failure patterns detected as AIMS monitoring; Behavioural monitoring as AIMS operational control � baseline deviation detection is the primary rogue agent control", + "description": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring; Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring; Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control", "kind": "control" }, { @@ -347,13 +347,13 @@ { "control_id": "A.7.2", "title": "Data quality", - "description": "Training data from third-party sources assessed � same data quality criteria as internal data; Agent memory content quality requirements � access controls, integrity verification, TTL as data quality controls; Training data and RAG content quality requirements � sensitivity, completeness, appropriateness assessed before use", + "description": "Training data from third-party sources assessed — same data quality criteria as internal data; Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls; Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use", "kind": "control" }, { "control_id": "A.7.3", "title": "Data provenance and characteristics", - "description": "Agent credentials tracked as AI system data � issuance, scope, expiry, rotation documented; Memory provenance tracked � source, write access controls, TTL, modification history in AIMS; Data provenance documented � source, classification, handling requirements tracked from ingestion through all derived forms", + "description": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented; Memory provenance tracked — source, write access controls, TTL, modification history in AIMS; Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms", "kind": "control" }, { @@ -367,7 +367,7 @@ { "control_id": "A.8.1", "title": "Information for interested parties", - "description": "AI system transparency obligations � users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment; Transparency obligations balanced with operational security � what must be disclosed vs what may be kept confidential; Transparency about AI system limitations � users informed of advisory status, accuracy limitations, verification requirements", + "description": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment; Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential; Transparency about AI system limitations — users informed of advisory status, accuracy limitations, verification requirements", "kind": "control" }, { @@ -381,7 +381,7 @@ { "control_id": "A.9.1", "title": "Use of AI systems", - "description": "Guidance on appropriate use � domains requiring human verification, how to distinguish AI advisory from authoritative content; Guidance on AI system use � downstream consumers informed that LLM output must be validated before use; Guidance on appropriate AI system use � domains requiring human verification documented as AIMS use guidance", + "description": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content; Guidance on AI system use — downstream consumers informed that LLM output must be validated before use; Guidance on appropriate AI system use — domains requiring human verification documented as AIMS use guidance", "kind": "control" }, { @@ -395,13 +395,13 @@ { "control_id": "A.10.1", "title": "Third-party AI system acquisition", - "description": "Tool and MCP server providers assessed as third-party AI components � security obligations in contracts; Third-party services accessed via agent credentials assessed � security obligations in access arrangements; All agent tool and MCP server providers assessed � security obligations, integrity guarantees, disclosure SLA in contracts", + "description": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts; Third-party services accessed via agent credentials assessed — security obligations in access arrangements; All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts", "kind": "control" }, { "control_id": "A.10.2", "title": "Customer relationships", - "description": "Obligations to downstream consumers of agentic systems � what supply chain security is guaranteed; LLM deployment obligations to downstream customers � what security properties are guaranteed", + "description": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed; LLM deployment obligations to downstream customers — what security properties are guaranteed", "kind": "control" }, { diff --git a/data/frameworks/nist-ai-rmf.json b/data/frameworks/nist-ai-rmf.json index 50135cc..d57f141 100644 --- a/data/frameworks/nist-ai-rmf.json +++ b/data/frameworks/nist-ai-rmf.json @@ -685,7 +685,7 @@ { "control_id": "MP-3.5", "title": "AI system impact", - "description": "Impact assessment of shadow AI on organisational data security posture � ungoverned data flows quantified; Impact assessment of endpoint AI agents � data access scope, exfiltration paths, user risk", + "description": "Impact assessment of shadow AI on organisational data security posture — ungoverned data flows quantified; Impact assessment of endpoint AI agents — data access scope, exfiltration paths, user risk", "kind": "control" } ], diff --git a/data/frameworks/nist-csf.json b/data/frameworks/nist-csf.json index 06d97a4..99a3198 100644 --- a/data/frameworks/nist-csf.json +++ b/data/frameworks/nist-csf.json @@ -189,133 +189,133 @@ { "control_id": "GV.OC-01", "title": "Organisational Context", - "description": "Policy defines permissible agent autonomy � agents cannot change stated goals without human confirmation; Policy defines permissible tool invocations � which tools require human confirmation; Policy requires AI disclosure and advisory labelling � agent transparency as a governance requirement", + "description": "Policy defines permissible agent autonomy — agents cannot change stated goals without human confirmation; Policy defines permissible tool invocations — which tools require human confirmation; Policy requires AI disclosure and advisory labelling — agent transparency as a governance requirement", "kind": "control" }, { "control_id": "PR.PS-04", "title": "Platform Security", - "description": "Secure software development � input validation and goal-state verification as platform security controls; Secure software development � static analysis, sandbox, allowlist as code execution platform security controls; Secure software development � multi-stage validation, path traversal prevention in ingestion code", + "description": "Secure software development — input validation and goal-state verification as platform security controls; Secure software development — static analysis, sandbox, allowlist as code execution platform security controls; Secure software development — multi-stage validation, path traversal prevention in ingestion code", "kind": "control" }, { "control_id": "DE.CM-01", "title": "Continuous Monitoring", - "description": "Networks and assets monitored � injection indicators detected across all agent input channels; All tool invocations logged and monitored � anomalous parameters, unusual sequences, high frequency detected; Credential usage monitored � anomalous access patterns detected", + "description": "Networks and assets monitored — injection indicators detected across all agent input channels; All tool invocations logged and monitored — anomalous parameters, unusual sequences, high frequency detected; Credential usage monitored — anomalous access patterns detected", "kind": "control" }, { "control_id": "RS.MI-01", "title": "Incident Mitigation", - "description": "Incidents contained � agent suspended, actions reversed, kill switch activated; Code execution incidents contained � sandbox isolated, forensic capture initiated; Incidents contained � kill switch activated, process control fallback initiated", + "description": "Incidents contained — agent suspended, actions reversed, kill switch activated; Code execution incidents contained — sandbox isolated, forensic capture initiated; Incidents contained — kill switch activated, process control fallback initiated", "kind": "control" }, { "control_id": "PR.AA-05", "title": "Identity Management, Authentication & Access Control", - "description": "Access permissions managed � per-tool permission manifests, least privilege per tool, irreversibility classification; Access permissions managed � agent credential scope enforced, least privilege per agent role; Access permissions managed � rogue agent cannot exceed its permission envelope regardless of internal goal state", + "description": "Access permissions managed — per-tool permission manifests, least privilege per tool, irreversibility classification; Access permissions managed — agent credential scope enforced, least privilege per agent role; Access permissions managed — rogue agent cannot exceed its permission envelope regardless of internal goal state", "kind": "control" }, { "control_id": "RS.AN-03", "title": "Incident Analysis", - "description": "Root cause analysis � which tool was misused, what downstream impact occurred, what parameters were used; Memory poisoning incidents analysed � affected sessions identified, operational decisions influenced reviewed; Root cause analysis � what caused rogue behaviour, which sessions were affected, what was the blast radius", + "description": "Root cause analysis — which tool was misused, what downstream impact occurred, what parameters were used; Memory poisoning incidents analysed — affected sessions identified, operational decisions influenced reviewed; Root cause analysis — what caused rogue behaviour, which sessions were affected, what was the blast radius", "kind": "control" }, { "control_id": "PR.AA-01", "title": "Identity Management, Authentication & Access Control", - "description": "Identities and credentials managed � NHI inventory, lifecycle management, unique identity per agent; Agent identities managed � each agent has a unique, verifiable identity for A2A authentication; Identities and credentials managed � NHI inventory, lifecycle, short-lived JIT issuance", + "description": "Identities and credentials managed — NHI inventory, lifecycle management, unique identity per agent; Agent identities managed — each agent has a unique, verifiable identity for A2A authentication; Identities and credentials managed — NHI inventory, lifecycle, short-lived JIT issuance", "kind": "control" }, { "control_id": "PR.DS-01", "title": "Data Security", - "description": "Sensitive data protected at rest � agent credentials encrypted, not stored in cleartext; Agent memory stores protected at rest � access controls, encryption, integrity verification; Sensitive data at rest protected � training data, embeddings, RAG stores, prompt caches encrypted", + "description": "Sensitive data protected at rest — agent credentials encrypted, not stored in cleartext; Agent memory stores protected at rest — access controls, encryption, integrity verification; Sensitive data at rest protected — training data, embeddings, RAG stores, prompt caches encrypted", "kind": "control" }, { "control_id": "GV.SC-01", "title": "Supply Chain Risk Management", - "description": "Cybersecurity supply chain risk management programme � all agent component vendors in scope; Inter-agent communication infrastructure treated as internal supply chain � authentication requirements documented; All approved AI tools managed as suppliers � TPSP assessment, contractual obligations", + "description": "Cybersecurity supply chain risk management programme — all agent component vendors in scope; Inter-agent communication infrastructure treated as internal supply chain — authentication requirements documented; All approved AI tools managed as suppliers — TPSP assessment, contractual obligations", "kind": "control" }, { "control_id": "GV.SC-06", "title": "Supply Chain Risk Management", - "description": "Cybersecurity requirements in supplier contracts � integrity guarantees, vulnerability disclosure SLA; Cybersecurity requirements included in contracts with suppliers � LLM model and data vendors", + "description": "Cybersecurity requirements in supplier contracts — integrity guarantees, vulnerability disclosure SLA; Cybersecurity requirements included in contracts with suppliers — LLM model and data vendors", "kind": "control" }, { "control_id": "ID.AM-08", "title": "Asset Management", - "description": "Agent components inventoried � ML SBOM for all tools, MCP servers, model weights, libraries; Agent memory stores inventoried as data assets � content classification, access controls, TTL documented; All tool integrations inventoried � data received, retained, training use, security assessment status", + "description": "Agent components inventoried — ML SBOM for all tools, MCP servers, model weights, libraries; Agent memory stores inventoried as data assets — content classification, access controls, TTL documented; All tool integrations inventoried — data received, retained, training use, security assessment status", "kind": "control" }, { "control_id": "PR.PS-02", "title": "Platform Security", - "description": "Software managed to reduce risk � component integrity verification, change management; Software managed to reduce risk � vector database CVEs patched promptly; Software managed to reduce risk � browser AI extensions version-controlled, patched, approved before deployment", + "description": "Software managed to reduce risk — component integrity verification, change management; Software managed to reduce risk — vector database CVEs patched promptly; Software managed to reduce risk — browser AI extensions version-controlled, patched, approved before deployment", "kind": "control" }, { "control_id": "PR.IR-01", "title": "Infrastructure Resilience", - "description": "Networks and environments protected � sandbox isolated from production infrastructure; Networks and environments protected for resilience � circuit breakers, blast radius limits, fail-safe defaults; Networks and environments protected for resilience � circuit breakers, freshness monitoring, redundancy", + "description": "Networks and environments protected — sandbox isolated from production infrastructure; Networks and environments protected for resilience — circuit breakers, blast radius limits, fail-safe defaults; Networks and environments protected for resilience — circuit breakers, freshness monitoring, redundancy", "kind": "control" }, { "control_id": "DE.CM-09", "title": "Continuous Monitoring", - "description": "Monitoring for anomalous data � memory content integrity checks, unusual write patterns detected; Monitoring for aggregate over-trust patterns � systematic operator acceptance without verification detected; Monitoring for anomalous data and software use � behavioural baseline deviation detected", + "description": "Monitoring for anomalous data — memory content integrity checks, unusual write patterns detected; Monitoring for aggregate over-trust patterns — systematic operator acceptance without verification detected; Monitoring for anomalous data and software use — behavioural baseline deviation detected", "kind": "control" }, { "control_id": "PR.DS-02", "title": "Data Security", - "description": "Data in transit protected � all A2A communication encrypted, integrity verified; Sensitive data in transit protected � all GenAI API calls and RAG retrieval paths encrypted; Extracted sensitive content encrypted in transit � multimodal extraction pipelines covered", + "description": "Data in transit protected — all A2A communication encrypted, integrity verified; Sensitive data in transit protected — all GenAI API calls and RAG retrieval paths encrypted; Extracted sensitive content encrypted in transit — multimodal extraction pipelines covered", "kind": "control" }, { "control_id": "RC.RP-01", "title": "Incident Recovery", - "description": "Recovery plan includes agent cluster failures � BCP covers AI system availability, RTO/RPO defined; Recovery plan includes GenAI pipeline failures � BCP covers AI availability, RTO/RPO defined", + "description": "Recovery plan includes agent cluster failures — BCP covers AI system availability, RTO/RPO defined; Recovery plan includes GenAI pipeline failures — BCP covers AI availability, RTO/RPO defined", "kind": "control" }, { "control_id": "PR.AT-01", "title": "Awareness and Training", - "description": "Users trained on AI limitations � operators understand agent advisory status and verification requirements; Users trained on shadow AI risk � policy awareness, prohibited tool use, reporting obligations; Labelling staff trained on data handling � classification, prohibited use, incident reporting", + "description": "Users trained on AI limitations — operators understand agent advisory status and verification requirements; Users trained on shadow AI risk — policy awareness, prohibited tool use, reporting obligations; Labelling staff trained on data handling — classification, prohibited use, incident reporting", "kind": "control" }, { "control_id": "RS.CO-03", "title": "Communication", - "description": "Information shared following incidents � trust exploitation incidents reported to affected users; Regulatory incident communication � breach notification, regulatory reporting, authority contact procedures", + "description": "Information shared following incidents — trust exploitation incidents reported to affected users; Regulatory incident communication — breach notification, regulatory reporting, authority contact procedures", "kind": "control" }, { "control_id": "DE.AE-02", "title": "Adverse Event Analysis", - "description": "Detected events analysed to understand attack targets � rogue agent patterns correlated across sessions", + "description": "Detected events analysed to understand attack targets — rogue agent patterns correlated across sessions", "kind": "control" }, { "control_id": "GV.RM-06", "title": "Risk Management Strategy", - "description": "Risk tolerance established � acceptable sensitive data disclosure risk defined per GenAI use case; Agent credential exposure in risk register � blast radius per deployment documented; Risk tolerance defined for re-identification risk in synthetic datasets � legal standard, not technical checkbox", + "description": "Risk tolerance established — acceptable sensitive data disclosure risk defined per GenAI use case; Agent credential exposure in risk register — blast radius per deployment documented; Risk tolerance defined for re-identification risk in synthetic datasets — legal standard, not technical checkbox", "kind": "control" }, { "control_id": "ID.RA-01", "title": "Risk Assessment", - "description": "Ingestion interface vulnerabilities documented in risk assessment � CVE-2024-3584 class; Compliance risks identified per GenAI deployment � applicable regulations, triggered obligations, controls gaps; Re-identification risk assessed for all synthetic datasets before use or distribution", + "description": "Ingestion interface vulnerabilities documented in risk assessment — CVE-2024-3584 class; Compliance risks identified per GenAI deployment — applicable regulations, triggered obligations, controls gaps; Re-identification risk assessed for all synthetic datasets before use or distribution", "kind": "control" }, { "control_id": "GV.RM-01", "title": "Risk Management Strategy", - "description": "Risk management strategy includes regulatory compliance risk � GenAI-specific obligations in risk programme; Risk management strategy established � LLM availability requirements and acceptable consumption risk defined", + "description": "Risk management strategy includes regulatory compliance risk — GenAI-specific obligations in risk programme; Risk management strategy established — LLM availability requirements and acceptable consumption risk defined", "kind": "control" } ], diff --git a/data/frameworks/nist-sp-800-82.json b/data/frameworks/nist-sp-800-82.json index d226ecd..7c10115 100644 --- a/data/frameworks/nist-sp-800-82.json +++ b/data/frameworks/nist-sp-800-82.json @@ -90,35 +90,35 @@ { "control_id": "AC-3", "title": "AC-3", - "description": "LLM access to OT systems enforced by policy � injection cannot escalate LLM access beyond defined scope; LLM access to OT data enforced by classification � sensitive process and network data requires elevated access tier; LLM access to OT systems enforced by policy � scope cannot be exceeded regardless of model instruction", + "description": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope; LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier; LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction", "kind": "control", "parent": null }, { "control_id": "AC-6", "title": "AC-6", - "description": "LLM granted minimum necessary OT access � read-only to historian, no write access without documented justification", + "description": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification", "kind": "control", "parent": null }, { "control_id": "AT-3", "title": "AT-3", - "description": "Operator training on LLM advisory limitations � mandatory for all operators using LLM decision-support tools", + "description": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools", "kind": "control", "parent": null }, { "control_id": "AU-9", "title": "AU-9", - "description": "LLM access logs to OT data protected � audit trail of all OT data accessed by LLM; System prompt access logs protected � unauthorised access attempts detectable", + "description": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM; System prompt access logs protected — unauthorised access attempts detectable", "kind": "control", "parent": null }, { "control_id": "AU-12", "title": "AU-12", - "description": "Full audit trail of LLM outputs � poisoning indicators detectable through output analysis; All LLM actions in OT context logged � full accountability for every OT data access and any recommended action; LLM resource consumption logged � patterns indicating exhaustion attacks detectable", + "description": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis; All LLM actions in OT context logged — full accountability for every OT data access and any recommended action; LLM resource consumption logged — patterns indicating exhaustion attacks detectable", "kind": "control", "parent": null }, @@ -132,7 +132,7 @@ { "control_id": "SA-12", "title": "SA-12", - "description": "Security requirements applied to all LLM component vendors � provenance, integrity, vulnerability disclosure", + "description": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure", "kind": "control", "parent": null }, @@ -146,35 +146,35 @@ { "control_id": "SC-28", "title": "SC-28", - "description": "OT data used in LLM context encrypted at rest � historian exports, embedding stores, prompt caches; System prompts encrypted at rest � not stored in cleartext configuration files; OT vector store content encrypted at rest", + "description": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches; System prompts encrypted at rest — not stored in cleartext configuration files; OT vector store content encrypted at rest", "kind": "control", "parent": null }, { "control_id": "SI-3", "title": "SI-3", - "description": "Treat prompt injection as a malicious code analog � detection and response controls required; LLM output scanning for malicious content before OT system ingestion; Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs", + "description": "Treat prompt injection as a malicious code analog — detection and response controls required; LLM output scanning for malicious content before OT system ingestion; Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs", "kind": "control", "parent": null }, { "control_id": "SI-7", "title": "SI-7", - "description": "Model integrity verification before each OT deployment � hash-based integrity check; Vector store integrity monitoring � alert on anomalous content or unexpected modifications", + "description": "Model integrity verification before each OT deployment — hash-based integrity check; Vector store integrity monitoring — alert on anomalous content or unexpected modifications", "kind": "control", "parent": null }, { "control_id": "SI-10", "title": "SI-10", - "description": "Validate all inputs to LLMs connected to OT systems � reject inputs containing injection indicators; Training data validation � adversarial content detected and rejected before training; LLM outputs validated before passing to OT systems � schema validation, allowlist enforcement", + "description": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators; Training data validation — adversarial content detected and rejected before training; LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement", "kind": "control", "parent": null }, { "control_id": "SI-17", "title": "SI-17", - "description": "LLM service degradation has defined fail-safe behaviour � process control continues without LLM", + "description": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM", "kind": "control", "parent": null }, diff --git a/data/frameworks/owasp-ai-testing.json b/data/frameworks/owasp-ai-testing.json index d099103..b664719 100644 --- a/data/frameworks/owasp-ai-testing.json +++ b/data/frameworks/owasp-ai-testing.json @@ -20,7 +20,7 @@ { "control_id": "AST", "title": "Agent-Specific", - "description": "Attempt to redirect agent goal through indirect injection paths specific to your deployment � historian data, vendor communications, web results", + "description": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results", "kind": "control", "parent": null }, @@ -55,7 +55,7 @@ { "control_id": "MBT", "title": "Model Behaviour", - "description": "Verify the agent's stated goal at session start matches its actions at session end � test divergence after indirect injection; Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection", + "description": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection; Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection", "kind": "control", "parent": null }, diff --git a/data/frameworks/owasp-asvs.json b/data/frameworks/owasp-asvs.json index 53183e9..5812b51 100644 --- a/data/frameworks/owasp-asvs.json +++ b/data/frameworks/owasp-asvs.json @@ -269,13 +269,13 @@ { "control_id": "V5.1.1", "title": "Verify all user input validated against allowlist", - "description": "All inputs to agents validated � indirect injection through processed content equally in scope; All content entering agent memory validated � injection patterns rejected at write boundary; All inputs to LLMs validated � indirect injection through processed content equally in scope", + "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", "kind": "control" }, { "control_id": "V5.2.1", "title": "Verify output encoding prevents injection", - "description": "Agent responses encoded before passing to downstream renderers � outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled � users cannot mistake AI output for authoritative content", + "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", "kind": "control" }, { @@ -287,73 +287,73 @@ { "control_id": "V1.1.2", "title": "Threat modelling of all data flows", - "description": "All agent input sources threat-modelled � every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled � all injection paths identified and documented", + "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", "kind": "control" }, { "control_id": "V11.1.2", "title": "Verify business logic limits prevent function abuse", - "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model � mitigations implemented and verified; Code execution capability in agents subject to business logic controls � sandbox, allowlist, static analysis", + "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", "kind": "control" }, { "control_id": "V4.1.3", "title": "Verify access control enforces least privilege", - "description": "Agent tool access scoped to minimum required operations � read-only by default, write access formally approved; Agent credential scope minimum required � no over-privileged NHIs; Memory write access restricted to minimum required sources � only agent and authorised administrators can write", + "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", "kind": "control" }, { "control_id": "V4.1.1", "title": "Verify all sensitive functions have access control", - "description": "All destructive tool operations require explicit authorisation � not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", "kind": "control" }, { "control_id": "V7.2.2", "title": "Verify all business logic decisions logged", - "description": "All tool invocations logged � tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged � systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context � every tool call auditable", + "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", "kind": "control" }, { "control_id": "V13.1.1", "title": "Verify API rate limiting", - "description": "Tool API endpoints rate-limited � anomalous invocation frequency detected; Rate limiting on all agent API endpoints � cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", "kind": "control" }, { "control_id": "V2.1.1", "title": "Verify credentials not in source code", - "description": "Agent credentials not hardcoded � secret manager required", + "description": "Agent credentials not hardcoded — secret manager required", "kind": "control" }, { "control_id": "V6.1.1", "title": "Verify sensitive data encrypted at rest", - "description": "Agent credentials encrypted at rest � no cleartext in config or agent memory; Agent memory stores encrypted at rest � embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", "kind": "control" }, { "control_id": "V7.2.1", "title": "Verify access control decisions logged", - "description": "All credential usage logged � issuance, access, expiry detectable; All A2A messages logged � sender identity, content hash, schema validation results; All agent actions logged � no production deployment without complete observability", + "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", "kind": "control" }, { "control_id": "V14.2.3", "title": "Verify secrets not in source code", - "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code � stored in secret management system", + "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", "kind": "control" }, { "control_id": "V10.2.1", "title": "Verify third-party components current and free of vulnerabilities", - "description": "All agent component libraries scanned for CVEs � ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs � ML SBOM maintained; Training pipeline components scanned � compromised dependencies rejected", + "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected", "kind": "control" }, { "control_id": "V10.2.2", "title": "Verify only minimal approved external libraries", - "description": "Approved component list � unsigned or unverified agent components rejected; Approved component list for LLM deployments � unsigned or unverified components rejected", + "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected", "kind": "control" }, { @@ -365,49 +365,49 @@ { "control_id": "V5.2.4", "title": "Verify application does not use eval or dynamic code", - "description": "No eval or exec of agent-generated code � absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", + "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", "kind": "control" }, { "control_id": "V5.3.5", "title": "Verify output encoding in SQL context", - "description": "No raw agent output in SQL context � parameterised execution only; LLM-generated SQL parameterised � never raw LLM output in SQL context", + "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", "kind": "control" }, { "control_id": "V12.1.1", "title": "Verify file upload malware scanning", - "description": "Content entering agent memory scanned � adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion � adversarial content detected; Content validation on all vector store ingestion � adversarial content detected", + "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", "kind": "control" }, { "control_id": "V9.1.1", "title": "Verify TLS used for all client connectivity", - "description": "All A2A communication encrypted � mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit � TLS 1.2 minimum", + "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", "kind": "control" }, { "control_id": "V3.3.1", "title": "Verify anti-replay tokens in state-changing operations", - "description": "Replay protection on all A2A messages � nonces, timestamps, sequence numbers", + "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", "kind": "control" }, { "control_id": "V11.1.1", "title": "Verify business logic assumptions documented", - "description": "Cascade blast radius documented as business logic assumption � maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions � verification requirements per domain; LLM accuracy limitations documented as business logic assumptions � verification requirements defined", + "description": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions — verification requirements per domain; LLM accuracy limitations documented as business logic assumptions — verification requirements defined", "kind": "control" }, { "control_id": "V7.4.1", "title": "Verify error handling does not expose sensitive data", - "description": "Cascade errors handled gracefully � no sensitive system information in error responses; Agent-influenced operator decisions logged � aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged � production monitoring for output quality", + "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", "kind": "control" }, { "control_id": "V13.1.3", "title": "Verify API rejects large unexpected payloads", - "description": "Approval flows independent of agent interface � no state-changing approvals via agent chat; Token limits on LLM API inputs � requests exceeding limits rejected at the gateway", + "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", "kind": "control" }, { @@ -483,7 +483,7 @@ { "control_id": "V5.1.2", "title": "Verify that HTTP request parts are validated, sanitised, or rejected", - "description": "LLM API request validation � prompt structure, content type, and character set enforced", + "description": "LLM API request validation — prompt structure, content type, and character set enforced", "kind": "control" }, { @@ -507,7 +507,7 @@ { "control_id": "V11.1.4", "title": "Verify business logic rate limits", - "description": "Business logic controls on LLM usage � per-tenant cost budgets, rate limit policies", + "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", "kind": "control" } ], diff --git a/data/frameworks/owasp-nhi.json b/data/frameworks/owasp-nhi.json index 90da753..1b0991f 100644 --- a/data/frameworks/owasp-nhi.json +++ b/data/frameworks/owasp-nhi.json @@ -13,70 +13,70 @@ { "control_id": "NHI-1", "title": "Improper Offboarding", - "description": "Formal agent offboarding � all credentials revoked, tokens invalidated, access removed", + "description": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed", "kind": "control", "parent": null }, { "control_id": "NHI-2", "title": "Secret Leakage", - "description": "No credentials in agent context, logs, or tool payloads � secret manager only", + "description": "No credentials in agent context, logs, or tool payloads — secret manager only", "kind": "control", "parent": null }, { "control_id": "NHI-3", "title": "Vulnerable Third-Party NHI", - "description": "Validate all third-party tool identities � reject tokens from unregistered issuers", + "description": "Validate all third-party tool identities — reject tokens from unregistered issuers", "kind": "control", "parent": null }, { "control_id": "NHI-4", "title": "Insecure Authentication", - "description": "Strong authentication for all agent-to-system connections � mTLS, short-lived tokens", + "description": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens", "kind": "control", "parent": null }, { "control_id": "NHI-5", "title": "Over-Privileged NHI", - "description": "Scope all agent credentials to minimum required � least privilege enforced", + "description": "Scope all agent credentials to minimum required — least privilege enforced", "kind": "control", "parent": null }, { "control_id": "NHI-6", "title": "Insecure Credential Storage", - "description": "Secret manager for all agent credentials � no cleartext storage anywhere", + "description": "Secret manager for all agent credentials — no cleartext storage anywhere", "kind": "control", "parent": null }, { "control_id": "NHI-7", "title": "Long-Lived Credentials", - "description": "Short-lived credentials � tokens expire at task completion, no long-lived agent tokens", + "description": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens", "kind": "control", "parent": null }, { "control_id": "NHI-8", "title": "Environment Isolation Failure", - "description": "Strict environment isolation � separate credentials per environment, no cross-environment reuse", + "description": "Strict environment isolation — separate credentials per environment, no cross-environment reuse", "kind": "control", "parent": null }, { "control_id": "NHI-9", "title": "NHI Reuse", - "description": "Unique identity per agent � no shared service accounts across agent deployments", + "description": "Unique identity per agent — no shared service accounts across agent deployments", "kind": "control", "parent": null }, { "control_id": "NHI-10", "title": "Human Use of NHI", - "description": "Agent credentials machine-only � human use detected and blocked", + "description": "Agent credentials machine-only — human use detected and blocked", "kind": "control", "parent": null } diff --git a/data/frameworks/owasp-samm.json b/data/frameworks/owasp-samm.json index 025e8a8..6e3ad93 100644 --- a/data/frameworks/owasp-samm.json +++ b/data/frameworks/owasp-samm.json @@ -85,19 +85,19 @@ { "control_id": "V-RT", "title": "Verification / Requirements-Driven Testing", - "description": "Automated tests verifying PII detection coverage; Tests verifying provenance metadata is preserved through pipeline; Data protection requirements verified in testing � PII patterns confirmed not to appear in LLM outputs", + "description": "Automated tests verifying PII detection coverage; Tests verifying provenance metadata is preserved through pipeline; Data protection requirements verified in testing — PII patterns confirmed not to appear in LLM outputs", "kind": "control" }, { "control_id": "I-SD", "title": "Implementation / Secure Deployment", - "description": "Infrastructure-as-code with security controls applied at provisioning; Rate limiting and resource controls deployed with every LLM deployment � not optional post-deployment hardening", + "description": "Infrastructure-as-code with security controls applied at provisioning; Rate limiting and resource controls deployed with every LLM deployment — not optional post-deployment hardening", "kind": "control" }, { "control_id": "Monitoring", "title": "Operational Management (O-OM)", - "description": "Production accuracy monitoring as operational management � drift detection, degradation alerted", + "description": "Production accuracy monitoring as operational management — drift detection, degradation alerted", "kind": "control" } ], diff --git a/data/frameworks/pci-dss.json b/data/frameworks/pci-dss.json index 5a95297..151e924 100644 --- a/data/frameworks/pci-dss.json +++ b/data/frameworks/pci-dss.json @@ -20,7 +20,7 @@ { "control_id": "Req 1.3.2", "title": "Network security", - "description": "Network controls prevent CHD flows to unapproved AI endpoints � block at network layer; Rate limiting protecting availability of CDE-facing LLM endpoints � DoS prevention; Network controls restrict inbound traffic to CDE � rate limiting at network layer for LLM applications", + "description": "Network controls prevent CHD flows to unapproved AI endpoints — block at network layer; Rate limiting protecting availability of CDE-facing LLM endpoints — DoS prevention; Network controls restrict inbound traffic to CDE — rate limiting at network layer for LLM applications", "kind": "control" }, { @@ -33,19 +33,19 @@ { "control_id": "Req 3.1.1", "title": "Account data inventory", - "description": "All CHD locations documented � derived GenAI assets (embeddings, caches) included in data inventory; Synthetic payment datasets that may be re-identifiable included in CHD inventory", + "description": "All CHD locations documented — derived GenAI assets (embeddings, caches) included in data inventory; Synthetic payment datasets that may be re-identifiable included in CHD inventory", "kind": "control" }, { "control_id": "Req 3.2.1", "title": "Data flow documentation", - "description": "Data flow diagrams include all GenAI pipeline paths � source through embedding, retrieval, generation, logging", + "description": "Data flow diagrams include all GenAI pipeline paths — source through embedding, retrieval, generation, logging", "kind": "control" }, { "control_id": "Req 3.3.1", "title": "SAD prohibition", - "description": "Synthetic data generated from SAD retains SAD classification � generation does not remove the prohibition; SAD must never appear in labelling tasks � labels cannot expose CVV or full magnetic stripe data; SAD (CVV, PIN) must never be in LLM training data or RAG � stored after authorisation is prohibited", + "description": "Synthetic data generated from SAD retains SAD classification — generation does not remove the prohibition; SAD must never appear in labelling tasks — labels cannot expose CVV or full magnetic stripe data; SAD (CVV, PIN) must never be in LLM training data or RAG — stored after authorisation is prohibited", "kind": "control" }, { @@ -58,7 +58,7 @@ { "control_id": "Req 3.4.1", "title": "PAN rendering unreadable", - "description": "PANs in GenAI outputs masked � only first six/last four digits in any response; PANs extracted from multimodal content masked in all outputs � OCR-extracted PANs are CHD requiring Req 3 treatment; Synthetic PANs that pass Luhn check treated as CHD � format-preserving synthetic PANs are in PCI scope", + "description": "PANs in GenAI outputs masked — only first six/last four digits in any response; PANs extracted from multimodal content masked in all outputs — OCR-extracted PANs are CHD requiring Req 3 treatment; Synthetic PANs that pass Luhn check treated as CHD — format-preserving synthetic PANs are in PCI scope", "kind": "control" }, { @@ -71,7 +71,7 @@ { "control_id": "Req 3.5.1", "title": "Protect stored account data", - "description": "All CHD in GenAI scope encrypted � training data, RAG stores, embeddings, prompt caches; All CHD extracted from multimodal inputs encrypted at rest � OCR output of a payment document is CHD; Per-user session CHD encrypted � KV cache isolation prevents cross-session PAN exposure", + "description": "All CHD in GenAI scope encrypted — training data, RAG stores, embeddings, prompt caches; All CHD extracted from multimodal inputs encrypted at rest — OCR output of a payment document is CHD; Per-user session CHD encrypted — KV cache isolation prevents cross-session PAN exposure", "kind": "control" }, { @@ -84,7 +84,7 @@ { "control_id": "Req 4.2.1", "title": "Encryption in transit", - "description": "All GenAI data flows carrying CHD encrypted � TLS 1.2 minimum; Multimodal extraction pipelines encrypted in transit where CHD is in scope; All LLM API calls and RAG retrieval paths carrying CHD encrypted in transit � TLS 1.2 minimum", + "description": "All GenAI data flows carrying CHD encrypted — TLS 1.2 minimum; Multimodal extraction pipelines encrypted in transit where CHD is in scope; All LLM API calls and RAG retrieval paths carrying CHD encrypted in transit — TLS 1.2 minimum", "kind": "control" }, { @@ -102,8 +102,8 @@ }, { "control_id": "Req 6.2.4", - "title": "Bespoke software � injection", - "description": "All injection vulnerability classes addressed in GenAI ingestion code � schema bypass and path traversal; LLM-to-SQL interfaces address injection as a known vulnerability class � query allowlisting, parameterised execution; All injection vulnerabilities addressed in LLM integration code � prompt injection as a known injection class", + "title": "Bespoke software — injection", + "description": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal; LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution; All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class", "kind": "control" }, { @@ -116,7 +116,7 @@ { "control_id": "Req 6.3.3", "title": "Vulnerability management", - "description": "All GenAI software components patched � CVE-2024-3584 class treated as urgent for CDE scope; Vector database CVEs patched � CVE-2024-3584 class treated as urgent for CDE-scope stores; Browser AI extensions patched and version-controlled � vulnerable extensions are Req 6.3 findings in CDE", + "description": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope; Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores; Browser AI extensions patched and version-controlled — vulnerable extensions are Req 6.3 findings in CDE", "kind": "control" }, { @@ -129,7 +129,7 @@ { "control_id": "Req 6.4.1", "title": "Public-facing application protection", - "description": "LLM-powered query interfaces in CDE scope protected � WAF or equivalent, input validation; Model extraction pattern detection as application protection � systematic API abuse detected; LLM-powered customer-facing applications protected against prompt injection � WAF or equivalent, security testing", + "description": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation; Model extraction pattern detection as application protection — systematic API abuse detected; LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing", "kind": "control" }, { @@ -141,13 +141,13 @@ { "control_id": "Req 6.5.1", "title": "Secure system changes", - "description": "Model component updates follow change management � security testing before production", + "description": "Model component updates follow change management — security testing before production", "kind": "control" }, { "control_id": "Req 6.5.6", "title": "Secure system changes", - "description": "All model promotions tested for unexpected functionality � poisoning detection as Req 6.5 testing requirement; RAG corpus updates tested for unexpected content � integrity verification before production indexing; All model promotions tested for unexpected functionality before CDE deployment � poisoning as unexpected functionality", + "description": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement; RAG corpus updates tested for unexpected content — integrity verification before production indexing; All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality", "kind": "control" }, { @@ -160,7 +160,7 @@ { "control_id": "Req 7.2.1", "title": "Restrict access", - "description": "RAG retrieval access controls � users retrieve only CHD they are authorised to access; Agent credentials scoped to minimum CDE access � least privilege, quarterly review; Context minimisation � tools receive minimum CHD-containing context required", + "description": "RAG retrieval access controls — users retrieve only CHD they are authorised to access; Agent credentials scoped to minimum CDE access — least privilege, quarterly review; Context minimisation — tools receive minimum CHD-containing context required", "kind": "control" }, { @@ -173,7 +173,7 @@ { "control_id": "Req 7.3.1", "title": "Access control system", - "description": "Access control system enforces LLM tool scope � agent cannot exceed defined CDE access without explicit authorisation", + "description": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation", "kind": "control" }, { @@ -186,7 +186,7 @@ { "control_id": "Req 8.2.1", "title": "Unique IDs for access", - "description": "Each agent has a unique service identity � no shared credentials across CDE-facing agents", + "description": "Each agent has a unique service identity — no shared credentials across CDE-facing agents", "kind": "control" }, { @@ -199,7 +199,7 @@ { "control_id": "Req 9.4.6", "title": "Media disposal", - "description": "Derived GenAI assets containing CHD disposed of securely � deletion verified per Req 9.4 requirements", + "description": "Derived GenAI assets containing CHD disposed of securely — deletion verified per Req 9.4 requirements", "kind": "control" }, { @@ -212,13 +212,13 @@ { "control_id": "Req 10.2.1", "title": "Logging of all access", - "description": "All agent credential operations in CDE logged � issuance, use, anomalous patterns; All tool call payloads containing CHD logged � Req 10 audit trail requirement; All PAN access through multimodal pipelines logged", + "description": "All agent credential operations in CDE logged — issuance, use, anomalous patterns; All tool call payloads containing CHD logged — Req 10 audit trail requirement; All PAN access through multimodal pipelines logged", "kind": "control" }, { "control_id": "Req 10.6.1", "title": "Audit log review", - "description": "Automated monitoring of GenAI outputs in CDE � systematic anomalies indicating poisoning detected; Automated monitoring for GenAI pipeline health in CDE � freshness and availability metrics reviewed; Automated monitoring for extraction patterns � unusual query diversity alerted", + "description": "Automated monitoring of GenAI outputs in CDE — systematic anomalies indicating poisoning detected; Automated monitoring for GenAI pipeline health in CDE — freshness and availability metrics reviewed; Automated monitoring for extraction patterns — unusual query diversity alerted", "kind": "control" }, { @@ -238,13 +238,13 @@ { "control_id": "Req 11.3.1", "title": "Penetration testing", - "description": "Poisoning detection in CDE penetration testing programme; Path traversal and ingestion injection in CDE penetration testing scope; Multi-tenant isolation tested in CDE penetration testing � cross-session CHD access attempted", + "description": "Poisoning detection in CDE penetration testing programme; Path traversal and ingestion injection in CDE penetration testing scope; Multi-tenant isolation tested in CDE penetration testing — cross-session CHD access attempted", "kind": "control" }, { "control_id": "Req 12.1.1", "title": "Security policy", - "description": "PCI security policy covers GenAI processing of CHD � updated to reflect AI system deployments", + "description": "PCI security policy covers GenAI processing of CHD — updated to reflect AI system deployments", "kind": "control" }, { @@ -263,19 +263,19 @@ { "control_id": "Req 12.3.2", "title": "Targeted risk analysis", - "description": "Targeted risk analysis for agent credential scope in CDE � blast radius if credentials compromised; Targeted risk analysis for ungoverned GenAI-derived assets � scope, protection, lifecycle documented; Re-identification risk in synthetic payment datasets documented in targeted risk analysis", + "description": "Targeted risk analysis for agent credential scope in CDE — blast radius if credentials compromised; Targeted risk analysis for ungoverned GenAI-derived assets — scope, protection, lifecycle documented; Re-identification risk in synthetic payment datasets documented in targeted risk analysis", "kind": "control" }, { "control_id": "Req 12.4.1", "title": "Programme oversight", - "description": "Executive accountability for GenAI PCI compliance � CISO or equivalent with oversight documented", + "description": "Executive accountability for GenAI PCI compliance — CISO or equivalent with oversight documented", "kind": "control" }, { "control_id": "Req 12.5.2", "title": "TPSP oversight", - "description": "Shadow AI discovery as part of TPSP monitoring � identify unapproved vendors receiving CHD", + "description": "Shadow AI discovery as part of TPSP monitoring — identify unapproved vendors receiving CHD", "kind": "control" }, { @@ -288,7 +288,7 @@ { "control_id": "Req 12.6.1", "title": "Security awareness", - "description": "PCI security awareness programme covers shadow AI risk � staff trained on prohibition; Security awareness covers PCI obligations in GenAI context � staff understand scope implications; PCI staff trained on LLM output limitations � advisory status of AI recommendations communicated", + "description": "PCI security awareness programme covers shadow AI risk — staff trained on prohibition; Security awareness covers PCI obligations in GenAI context — staff understand scope implications; PCI staff trained on LLM output limitations — advisory status of AI recommendations communicated", "kind": "control" }, { @@ -300,19 +300,19 @@ { "control_id": "Req 12.8.1", "title": "Third-party service providers", - "description": "Shadow AI tools processing CHD are unapproved TPSPs � not in TPSP list, no written agreements; All tool and plugin providers receiving CHD in TPSP list � even if access is indirect through agent context; Browser AI extension providers with CDE access are TPSPs � add to TPSP list, initiate compliance process", + "description": "Shadow AI tools processing CHD are unapproved TPSPs — not in TPSP list, no written agreements; All tool and plugin providers receiving CHD in TPSP list — even if access is indirect through agent context; Browser AI extension providers with CDE access are TPSPs — add to TPSP list, initiate compliance process", "kind": "control" }, { "control_id": "Req 12.8.3", "title": "TPSP agreements", - "description": "Written agreements with tool providers acknowledging CHD security responsibility; Written agreements with labelling vendors acknowledging CHD security responsibility; Written agreements with LLM vendors � acknowledge responsibility for CHD security", + "description": "Written agreements with tool providers acknowledging CHD security responsibility; Written agreements with labelling vendors acknowledging CHD security responsibility; Written agreements with LLM vendors — acknowledge responsibility for CHD security", "kind": "control" }, { "control_id": "Req 12.8.4", "title": "TPSP PCI DSS compliance", - "description": "Monitor TPSP PCI DSS compliance status � LLM component vendors with CHD access have compliant status verified", + "description": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified", "kind": "control" }, { diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index 4b37363..f236bd8 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -127,7 +127,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "2.1", "title": "Establish and maintain software inventory", - "description": "ML SBOM as software asset inventory � all agent components (tools, MCP servers, models, libraries)", + "description": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)", "kind": "control", "parent": "CIS-2" }, @@ -169,14 +169,14 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "3.10", "title": "Encrypt sensitive data in transit", - "description": "All A2A messages encrypted in transit � no cleartext inter-agent communication", + "description": "All A2A messages encrypted in transit — no cleartext inter-agent communication", "kind": "control", "parent": "CIS-3" }, { "control_id": "3.11", "title": "Encrypt sensitive data at rest", - "description": "Agent credentials encrypted at rest � secret manager, no cleartext storage; Agent memory stores encrypted at rest � embeddings, long-term memory, operational knowledge; Embeddings, training data, and RAG caches containing sensitive data encrypted", + "description": "Agent credentials encrypted at rest — secret manager, no cleartext storage; Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge; Embeddings, training data, and RAG caches containing sensitive data encrypted", "kind": "control", "parent": "CIS-3" }, @@ -190,7 +190,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "4.1", "title": "Establish secure configuration process", - "description": "Secure configuration includes code execution sandbox � no defaults permitting unrestricted execution; Secure configuration includes circuit breakers and rate limits � cascade prevention as configuration requirement; Secure configuration for LLM deployments � system prompts not in cleartext config", + "description": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution; Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement; Secure configuration for LLM deployments — system prompts not in cleartext config", "kind": "control", "parent": "CIS-4" }, @@ -211,21 +211,21 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "5.4", "title": "Restrict administrator privileges", - "description": "Agent tool access managed as privileged access � minimum scope, regular review; Agent credentials managed as privileged accounts � minimum scope, regular review, JIT issuance; Approval flows independent of agent interface � sensitive approvals cannot be completed via agent chat", + "description": "Agent tool access managed as privileged access — minimum scope, regular review; Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance; Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat", "kind": "control", "parent": "CIS-5" }, { "control_id": "6.1", "title": "Establish access granting process", - "description": "Formal process for granting agent tool access � documented justification per tool; Formal process for granting LLM tool access � documented justification required", + "description": "Formal process for granting agent tool access — documented justification per tool; Formal process for granting LLM tool access — documented justification required", "kind": "control", "parent": "CIS-6" }, { "control_id": "6.2", "title": "Establish an access revoking process", - "description": "Agent credential revocation process � immediate revocation on detection, decommission procedure", + "description": "Agent credential revocation process — immediate revocation on detection, decommission procedure", "kind": "control", "parent": "CIS-6" }, @@ -252,21 +252,21 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "7.1", "title": "Establish vulnerability management process", - "description": "Agent component CVEs in vulnerability management � urgent patching for code execution risks; Vulnerability management process covers LLM component CVEs and dependency risks", + "description": "Agent component CVEs in vulnerability management — urgent patching for code execution risks; Vulnerability management process covers LLM component CVEs and dependency risks", "kind": "control", "parent": "CIS-7" }, { "control_id": "7.5", "title": "Perform automated vulnerability scanning", - "description": "Automated scanning of training pipeline components � vulnerabilities in data processing libraries", + "description": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries", "kind": "control", "parent": "CIS-7" }, { "control_id": "8.2", "title": "Collect audit logs", - "description": "All agent inputs logged � injection attempts detectable through log analysis; Memory write operations logged � who or what wrote, when, content hash; Comprehensive audit logging of all agent actions � no production deployment without full observability", + "description": "All agent inputs logged — injection attempts detectable through log analysis; Memory write operations logged — who or what wrote, when, content hash; Comprehensive audit logging of all agent actions — no production deployment without full observability", "kind": "control", "parent": "CIS-8" }, @@ -280,14 +280,14 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "8.5", "title": "Collect detailed audit logs", - "description": "All tool invocations logged � tool identity, parameters, agent identity, timestamp; All credential operations logged � issuance, use, anomalous patterns detectable; All A2A messages logged � sender identity, content hash, timestamp, schema validation results", + "description": "All tool invocations logged — tool identity, parameters, agent identity, timestamp; All credential operations logged — issuance, use, anomalous patterns detectable; All A2A messages logged — sender identity, content hash, timestamp, schema validation results", "kind": "control", "parent": "CIS-8" }, { "control_id": "8.6", "title": "Collect DNS query audit logs", - "description": "Agent traffic monitored � cascade indicators detected before physical impact", + "description": "Agent traffic monitored — cascade indicators detected before physical impact", "kind": "control", "parent": "CIS-8" }, @@ -327,7 +327,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "12.4", "title": "Establish and maintain architecture diagram", - "description": "A2A communication channels mapped in network architecture � authentication method, encryption status", + "description": "A2A communication channels mapped in network architecture — authentication method, encryption status", "kind": "control", "parent": "CIS-12" }, @@ -347,14 +347,14 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "13.1", "title": "Centralise security event alerting", - "description": "Agent behavioural anomalies centralised and alerted � rogue agent patterns detected through SIEM", + "description": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM", "kind": "control", "parent": "CIS-13" }, { "control_id": "13.3", "title": "Deploy a network-based intrusion detection system", - "description": "Memory store access monitored � bulk read, anomalous write patterns detected", + "description": "Memory store access monitored — bulk read, anomalous write patterns detected", "kind": "control", "parent": "CIS-13" }, @@ -374,7 +374,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "14.1", "title": "Establish security awareness programme", - "description": "All users of agentic tools trained on AI limitations � verification requirements, how to identify manipulation; User training on LLM data handling � what data should not be shared with LLMs; User training on LLM output limitations � verification requirements and critical evaluation", + "description": "All users of agentic tools trained on AI limitations — verification requirements, how to identify manipulation; User training on LLM data handling — what data should not be shared with LLMs; User training on LLM output limitations — verification requirements and critical evaluation", "kind": "control", "parent": "CIS-14" }, @@ -394,35 +394,35 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "15.1", "title": "Establish service provider management process", - "description": "Agent tool and MCP providers managed as service providers � security assessment before onboarding", + "description": "Agent tool and MCP providers managed as service providers — security assessment before onboarding", "kind": "control", "parent": "CIS-15" }, { "control_id": "16.1", "title": "Establish secure application development standards", - "description": "Secure development standards covering agentic integrations � input validation, goal-state verification; Secure development standards covering LLM integration � input validation, context separation", + "description": "Secure development standards covering agentic integrations — input validation, goal-state verification; Secure development standards covering LLM integration — input validation, context separation", "kind": "control", "parent": "CIS-16" }, { "control_id": "16.2", "title": "Implement code review", - "description": "Code review for all LLM integration code � prompt injection patterns reviewed", + "description": "Code review for all LLM integration code — prompt injection patterns reviewed", "kind": "control", "parent": "CIS-16" }, { "control_id": "16.6", "title": "Use only up-to-date and trusted third-party components", - "description": "Approved component list � only sourced from approved vendors, signatures verified; Only approved, verified LLM components used in production � unsigned components rejected", + "description": "Approved component list — only sourced from approved vendors, signatures verified; Only approved, verified LLM components used in production — unsigned components rejected", "kind": "control", "parent": "CIS-16" }, { "control_id": "16.7", "title": "Use standard hardening configuration templates", - "description": "Hardened training pipeline configurations � immutable infrastructure, locked data sources", + "description": "Hardened training pipeline configurations — immutable infrastructure, locked data sources", "kind": "control", "parent": "CIS-16" }, @@ -442,28 +442,28 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "17.1", "title": "Designate personnel for incident response", - "description": "Defined response for cascade events � kill switch activation, process control fallback, operations notification; Defined response for trust exploitation incidents � operator retraining, pattern audit, interface redesign; Defined response for LLM misinformation incidents � correction, notification, root cause", + "description": "Defined response for cascade events — kill switch activation, process control fallback, operations notification; Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign; Defined response for LLM misinformation incidents — correction, notification, root cause", "kind": "control", "parent": "CIS-17" }, { "control_id": "17.2", "title": "Establish incident response procedures", - "description": "Rogue agent containment as incident response procedure � kill switch, audit, state validation, forensic", + "description": "Rogue agent containment as incident response procedure — kill switch, audit, state validation, forensic", "kind": "control", "parent": "CIS-17" }, { "control_id": "18.1", "title": "Establish penetration testing programme", - "description": "Adversarial testing covering goal hijack � direct, indirect, multi-turn injection scenarios; Adversarial testing programme covering prompt injection scenarios", + "description": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios; Adversarial testing programme covering prompt injection scenarios", "kind": "control", "parent": "CIS-18" }, { "control_id": "18.3", "title": "Remediate penetration testing findings", - "description": "Poisoning scenarios in penetration testing � verify data integrity controls hold under attack", + "description": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack", "kind": "control", "parent": "CIS-18" }, @@ -932,7 +932,7 @@ window.CROSSWALK_FRAMEWORKS = [ "control_id": "CWE-20", "title": "CWE-20", "kind": "weakness", - "description": "Root cause � agent inputs not validated before entering model context; indirect injection content not treated as untrusted; Tool parameters generated by LLM not validated against safe ranges before execution; Content entering agent memory not validated before write" + "description": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted; Tool parameters generated by LLM not validated against safe ranges before execution; Content entering agent memory not validated before write" }, { "control_id": "CWE-74", @@ -992,7 +992,7 @@ window.CROSSWALK_FRAMEWORKS = [ "control_id": "CWE-200", "title": "CWE-200", "kind": "weakness", - "description": "System prompt and agent configuration not protected � extraction enables targeted trust exploitation" + "description": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation" }, { "control_id": "CWE-201", @@ -1029,7 +1029,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "CWE-276", "title": "CWE-276", - "description": "Agent deployed with broader permissions than needed � amplifies rogue blast radius", + "description": "Agent deployed with broader permissions than needed — amplifies rogue blast radius", "kind": "weakness", "parent": null }, @@ -1037,7 +1037,7 @@ window.CROSSWALK_FRAMEWORKS = [ "control_id": "CWE-284", "title": "CWE-284", "kind": "weakness", - "description": "Agent can invoke tools it should not have access to; tool parameters not range-validated; Vector store and memory databases with insufficient access controls permitting unauthorised writes; Rogue agent exceeds its permitted access scope � no scope enforcement" + "description": "Agent can invoke tools it should not have access to; tool parameters not range-validated; Vector store and memory databases with insufficient access controls permitting unauthorised writes; Rogue agent exceeds its permitted access scope — no scope enforcement" }, { "control_id": "CWE-285", @@ -1047,7 +1047,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "CWE-287", "title": "CWE-287", - "description": "A2A channels without mutual authentication � agents accept messages from any sender", + "description": "A2A channels without mutual authentication — agents accept messages from any sender", "kind": "weakness", "parent": null }, @@ -1091,7 +1091,7 @@ window.CROSSWALK_FRAMEWORKS = [ "control_id": "CWE-346", "title": "CWE-346", "kind": "weakness", - "description": "Agent does not verify that A2A messages originate from the claimed sender; User cannot determine whether advice originates from AI or human � no origin verification" + "description": "Agent does not verify that A2A messages originate from the claimed sender; User cannot determine whether advice originates from AI or human — no origin verification" }, { "control_id": "CWE-349", @@ -1109,7 +1109,7 @@ window.CROSSWALK_FRAMEWORKS = [ "control_id": "CWE-400", "title": "CWE-400", "kind": "weakness", - "description": "Agent resource consumption not bounded � enables exhaustion propagation across cluster" + "description": "Agent resource consumption not bounded — enables exhaustion propagation across cluster" }, { "control_id": "CWE-434", @@ -1176,7 +1176,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "CWE-613", "title": "CWE-613", - "description": "Long-lived agent credentials without expiry or rotation � NHI-7", + "description": "Long-lived agent credentials without expiry or rotation — NHI-7", "kind": "weakness", "parent": null }, @@ -1209,7 +1209,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "CWE-703", "title": "CWE-703", - "description": "Agent failures not caught and handled � exception propagates to downstream agents", + "description": "Agent failures not caught and handled — exception propagates to downstream agents", "kind": "weakness", "parent": null }, @@ -1266,7 +1266,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "CWE-913", "title": "CWE-913", - "description": "MCP descriptors and tool specifications are dynamically loaded code resources � modification not controlled", + "description": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled", "kind": "weakness", "parent": null }, @@ -1292,7 +1292,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "CWE-1341", "title": "CWE-1341", - "description": "Memory TTL not enforced � entries persist beyond intended lifetime", + "description": "Memory TTL not enforced — entries persist beyond intended lifetime", "kind": "weakness", "parent": null }, @@ -2241,7 +2241,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Art. 53(1)(a)", "title": "GPAI documentation", - "description": "Data governance for training data � sources, quality, privacy measures � is a GPAI documentation obligation; Data governance for GPAI training data is a binding documentation obligation from Aug 2025", + "description": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation; Data governance for GPAI training data is a binding documentation obligation from Aug 2025", "kind": "control", "parent": null }, @@ -2773,79 +2773,79 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "SR 1.9", "title": "Session lock", - "description": "Operator-accessible agent kill switch � halt all agent activity immediately without affecting process control; Agent sessions terminated and credentials revoked immediately on compromise detection; Ability to terminate LLM sessions immediately on detection of suspicious behaviour", + "description": "Operator-accessible agent kill switch — halt all agent activity immediately without affecting process control; Agent sessions terminated and credentials revoked immediately on compromise detection; Ability to terminate LLM sessions immediately on detection of suspicious behaviour", "kind": "control" }, { "control_id": "SR 6.6", "title": "Timely response to events", - "description": "Anomalous tool invocation patterns detected and responded to � alert, suspend, investigate; Cascade indicators detected and responded to before physical process impact; Shadow AI discovery triggers incident response � data impact assessment, vendor notification", + "description": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate; Cascade indicators detected and responded to before physical process impact; Shadow AI discovery triggers incident response — data impact assessment, vendor notification", "kind": "control" }, { "control_id": "SR 1.6", "title": "Authenticator management", - "description": "Agent credentials managed with defined lifecycle � issuance, rotation, revocation procedures; Agent credential lifecycle managed � issuance, rotation, revocation documented per agent; LLM interactions logged with user identity — injection attempts attributable to specific sessions", + "description": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures; Agent credential lifecycle managed — issuance, rotation, revocation documented per agent; LLM interactions logged with user identity — injection attempts attributable to specific sessions", "kind": "control" }, { "control_id": "SR 2.6", "title": "Use control", - "description": "Only approved, verified agent components permitted in OT zones � no runtime loading of unapproved tools; Rogue agent cannot load additional tools or expand its own capability scope; Only approved, validated data sources permitted in Zone 3 GenAI ingestion � unapproved sources blocked", + "description": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools; Rogue agent cannot load additional tools or expand its own capability scope; Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked", "kind": "control" }, { "control_id": "Supplier security requirements", "title": "62443-2-4", - "description": "Security requirements applied to all agent tool and MCP server vendors with OT access; GenAI vendors handling OT-derived assets subject to 62443-2-4 programme; GenAI vendors assessed under OT supplier security programme � same requirements as OT software vendors", + "description": "Security requirements applied to all agent tool and MCP server vendors with OT access; GenAI vendors handling OT-derived assets subject to 62443-2-4 programme; GenAI vendors assessed under OT supplier security programme — same requirements as OT software vendors", "kind": "control" }, { "control_id": "SR 2.3", "title": "Use control", - "description": "Agent code execution restricted to specific, defined operations � no shell access, no network programming; LLM advisory outputs clearly distinguished from authoritative documentation � source always visible; LLM output restricted to authorised actions — no raw output directly to control interfaces", + "description": "Agent code execution restricted to specific, defined operations — no shell access, no network programming; LLM advisory outputs clearly distinguished from authoritative documentation — source always visible; LLM output restricted to authorised actions — no raw output directly to control interfaces", "kind": "control" }, { "control_id": "SR 3.7", "title": "Software and information integrity (monitoring)", - "description": "Runtime monitoring of agent code execution � anomalous system calls detected and blocked; Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications; Continuous behavioural monitoring of all OT agents � deviation from established baseline detected", + "description": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked; Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications; Continuous behavioural monitoring of all OT agents — deviation from established baseline detected", "kind": "control" }, { "control_id": "SR 4.4", "title": "Communication integrity", - "description": "Message integrity enforced � replay protection, nonces, sequence numbers on A2A channels; GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ; OT-specific data masking before telemetry capture � tag IDs, equipment identifiers masked before logging", + "description": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels; GenAI outputs containing sensitive OT identifiers (tag names, IPs, device types) masked before leaving DMZ; OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging", "kind": "control" }, { "control_id": "SR 7.6", "title": "Denial of service protection", - "description": "Circuit breakers preventing cascade propagation � agent failure contained within defined blast radius; Poisoned model availability impact contained � fallback procedure prevents physical process disruption; Circuit breakers preventing OT GenAI service degradation from affecting process control", + "description": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius; Poisoned model availability impact contained — fallback procedure prevents physical process disruption; Circuit breakers preventing OT GenAI service degradation from affecting process control", "kind": "control" }, { "control_id": "SR 7.7", "title": "Control system backup", - "description": "Agent system failures cannot affect backup and recovery of OT process control; OT GenAI failures cannot affect backup and recovery of process control � independence verified; LLM resource exhaustion cannot affect backup and recovery of OT control systems", + "description": "Agent system failures cannot affect backup and recovery of OT process control; OT GenAI failures cannot affect backup and recovery of process control — independence verified; LLM resource exhaustion cannot affect backup and recovery of OT control systems", "kind": "control" }, { "control_id": "SR 5.3", "title": "Information flow restriction", - "description": "OT-sensitive context minimised before tool API calls � tools receive minimum required, not full OT context", + "description": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context", "kind": "control" }, { "control_id": "Security management system", "title": "62443-2-1", - "description": "OT security management system updated to cover GenAI deployments � policy, roles, assessment", + "description": "OT security management system updated to cover GenAI deployments — policy, roles, assessment", "kind": "control" }, { "control_id": "Security management", "title": "62443-2-1", - "description": "OT synthetic data governance policy � when synthetic data removes OT classification obligation", + "description": "OT synthetic data governance policy — when synthetic data removes OT classification obligation", "kind": "control" }, { @@ -3213,61 +3213,61 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.8.29", "title": "Security testing", - "description": "Adversarial testing programme covering goal hijack � direct, indirect, multi-turn injection before each release; Sandbox escape and code injection scenarios in security testing � adversarial testing before each deployment; Adversarial testing of model outputs for poisoning indicators before deployment", + "description": "Adversarial testing programme covering goal hijack — direct, indirect, multi-turn injection before each release; Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment; Adversarial testing of model outputs for poisoning indicators before deployment", "kind": "control" }, { "control_id": "A.5.15", "title": "Identity management", - "description": "Agent tool access governed through identity management � tool permissions scoped per agent identity; LLM tool access governed through identity management � tool permissions scoped per deployment", + "description": "Agent tool access governed through identity management — tool permissions scoped per agent identity; LLM tool access governed through identity management — tool permissions scoped per deployment", "kind": "control" }, { "control_id": "A.5.16", "title": "Identity management", - "description": "NHI lifecycle management � all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process; All agent identities inventoried and lifecycle-managed as non-human identities", + "description": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process; All agent identities inventoried and lifecycle-managed as non-human identities", "kind": "control" }, { "control_id": "A.5.20", "title": "Supplier agreements", - "description": "Contractual security requirements for all agent component suppliers � integrity guarantees, vulnerability notification SLA; Contractual requirements covering data minimisation, retention, and training use for tool providers; Contractual data handling requirements for labelling vendors and HITL service providers", + "description": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA; Contractual requirements covering data minimisation, retention, and training use for tool providers; Contractual data handling requirements for labelling vendors and HITL service providers", "kind": "control" }, { "control_id": "A.5.21", "title": "Supply chain security", - "description": "Managing ICT supply chain risks � agent tool and MCP server ecosystem explicitly in scope; Managing ICT supply chain risks � LLM model and library supply chain explicitly in scope", + "description": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope; Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope", "kind": "control" }, { "control_id": "A.8.26", "title": "Application security requirements", - "description": "Security requirements for agent code execution capability specified before development � sandbox spec, permitted operations; Input validation requirements specified for all GenAI data ingestion interfaces; Security requirements for LLM-to-SQL interfaces � read-only by default, parameterisation mandatory", + "description": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations; Input validation requirements specified for all GenAI data ingestion interfaces; Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory", "kind": "control" }, { "control_id": "A.8.13", "title": "Backup", - "description": "Agent state and configuration backed up � recovery to known-good state after cascade incident; Backup and recovery for all AI data assets � vector stores, embedding indexes, RAG corpora; Backup and recovery for LLM service infrastructure � failover capability tested", + "description": "Agent state and configuration backed up — recovery to known-good state after cascade incident; Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora; Backup and recovery for LLM service infrastructure — failover capability tested", "kind": "control" }, { "control_id": "A.5.17", "title": "Authentication information", - "description": "Secure management of agent credentials � no hardcoding, rotation enforced", + "description": "Secure management of agent credentials — no hardcoding, rotation enforced", "kind": "control" }, { "control_id": "A.8.27", "title": "Secure system architecture", - "description": "Training pipeline designed with integrity controls and supply chain verification; RAG pipeline designed with source trust verification and integrity controls; Training pipeline designed with integrity controls � data validation, source allowlisting, lineage tracking", + "description": "Training pipeline designed with integrity controls and supply chain verification; RAG pipeline designed with source trust verification and integrity controls; Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking", "kind": "control" }, { "control_id": "A.8.10", "title": "Information deletion", - "description": "Deletion and erasure obligations enforced across all derived assets � embeddings, caches, backups", + "description": "Deletion and erasure obligations enforced across all derived assets — embeddings, caches, backups", "kind": "control" }, { @@ -3358,7 +3358,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "5", "title": "Policy", - "description": "Leadership commitment to AI transparency � AI disclosure and advisory labelling requirements in AI policy; Leadership commitment to human oversight � autonomous action scope defined in AI policy, signed off at executive level", + "description": "Leadership commitment to AI transparency — AI disclosure and advisory labelling requirements in AI policy; Leadership commitment to human oversight — autonomous action scope defined in AI policy, signed off at executive level", "kind": "control", "parent": null }, @@ -3429,7 +3429,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "7", "title": "Support", - "description": "Resources for AI systems include NHIs � agent identities inventoried and managed as AIMS resources; Documented information controls � system prompts managed as AIMS documented information with appropriate access controls", + "description": "Resources for AI systems include NHIs — agent identities inventoried and managed as AIMS resources; Documented information controls — system prompts managed as AIMS documented information with appropriate access controls", "kind": "control", "parent": null }, @@ -3468,7 +3468,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "8", "title": "Operation", - "description": "A2A communication documented as AIMS operational control � authentication requirements, encryption standards; Operational controls for LLM deployment � output handling requirements documented as AIMS operational procedures", + "description": "A2A communication documented as AIMS operational control — authentication requirements, encryption standards; Operational controls for LLM deployment — output handling requirements documented as AIMS operational procedures", "kind": "control", "parent": null }, @@ -3507,7 +3507,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "9", "title": "Performance evaluation", - "description": "Cascade incidents in AIMS performance evaluation � circuit breaker effectiveness, recovery times in management review; Rogue agent detection rates and containment times in AIMS management review; Resource consumption metrics in AIMS performance evaluation � consumption trends in management review", + "description": "Cascade incidents in AIMS performance evaluation — circuit breaker effectiveness, recovery times in management review; Rogue agent detection rates and containment times in AIMS management review; Resource consumption metrics in AIMS performance evaluation — consumption trends in management review", "kind": "control", "parent": null }, @@ -3607,7 +3607,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.5.2", "title": "Impact assessment", - "description": "Impact assessment covers goal hijack risk � what autonomous actions are possible if goal is redirected, who is affected; Tool misuse impact assessed � what harm is possible if each tool is misused autonomously; Impact of code execution capability formally assessed � RCE impact on persons and systems documented", + "description": "Impact assessment covers goal hijack risk — what autonomous actions are possible if goal is redirected, who is affected; Tool misuse impact assessed — what harm is possible if each tool is misused autonomously; Impact of code execution capability formally assessed — RCE impact on persons and systems documented", "kind": "control" }, { @@ -3621,25 +3621,25 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.6.1.2", "title": "Responsible AI system management", - "description": "Tool access managed responsibly throughout agent lifecycle � permission review, irreversibility classification, human oversight requirements; Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation; LLM components managed responsibly through lifecycle � acquisition, testing, deployment, decommission", + "description": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements; Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation; LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission", "kind": "control" }, { "control_id": "A.6.2.3", "title": "AI system security", - "description": "Goal-state verification and input validation as AIMS security design requirements � structural controls enforced at orchestration layer; Per-tool permission manifests and parameter validation as AIMS security controls; Credential security as AIMS design requirement � short-lived JIT credentials, no cleartext storage, least privilege", + "description": "Goal-state verification and input validation as AIMS security design requirements — structural controls enforced at orchestration layer; Per-tool permission manifests and parameter validation as AIMS security controls; Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege", "kind": "control" }, { "control_id": "A.6.2.6", "title": "Testing of AI systems", - "description": "Goal hijack scenarios in AIMS testing � direct, indirect, multi-turn injection tested before each production release; Sandbox escape and code injection scenarios in AIMS testing � adversarial testing before each deployment; A2A security scenarios in AIMS testing � spoofing, replay, schema violations before deployment", + "description": "Goal hijack scenarios in AIMS testing — direct, indirect, multi-turn injection tested before each production release; Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment; A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment", "kind": "control" }, { "control_id": "A.6.2.8", "title": "Monitoring of AI systems", - "description": "Memory integrity monitored in operation � anomalous write patterns, content integrity checks as AIMS monitoring; Cascade indicators monitored in operation � correlated failure patterns detected as AIMS monitoring; Behavioural monitoring as AIMS operational control � baseline deviation detection is the primary rogue agent control", + "description": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring; Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring; Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control", "kind": "control" }, { @@ -3653,13 +3653,13 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.7.2", "title": "Data quality", - "description": "Training data from third-party sources assessed � same data quality criteria as internal data; Agent memory content quality requirements � access controls, integrity verification, TTL as data quality controls; Training data and RAG content quality requirements � sensitivity, completeness, appropriateness assessed before use", + "description": "Training data from third-party sources assessed — same data quality criteria as internal data; Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls; Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use", "kind": "control" }, { "control_id": "A.7.3", "title": "Data provenance and characteristics", - "description": "Agent credentials tracked as AI system data � issuance, scope, expiry, rotation documented; Memory provenance tracked � source, write access controls, TTL, modification history in AIMS; Data provenance documented � source, classification, handling requirements tracked from ingestion through all derived forms", + "description": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented; Memory provenance tracked — source, write access controls, TTL, modification history in AIMS; Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms", "kind": "control" }, { @@ -3673,7 +3673,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.8.1", "title": "Information for interested parties", - "description": "AI system transparency obligations � users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment; Transparency obligations balanced with operational security � what must be disclosed vs what may be kept confidential; Transparency about AI system limitations � users informed of advisory status, accuracy limitations, verification requirements", + "description": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment; Transparency obligations balanced with operational security — what must be disclosed vs what may be kept confidential; Transparency about AI system limitations — users informed of advisory status, accuracy limitations, verification requirements", "kind": "control" }, { @@ -3687,7 +3687,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.9.1", "title": "Use of AI systems", - "description": "Guidance on appropriate use � domains requiring human verification, how to distinguish AI advisory from authoritative content; Guidance on AI system use � downstream consumers informed that LLM output must be validated before use; Guidance on appropriate AI system use � domains requiring human verification documented as AIMS use guidance", + "description": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content; Guidance on AI system use — downstream consumers informed that LLM output must be validated before use; Guidance on appropriate AI system use — domains requiring human verification documented as AIMS use guidance", "kind": "control" }, { @@ -3701,13 +3701,13 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "A.10.1", "title": "Third-party AI system acquisition", - "description": "Tool and MCP server providers assessed as third-party AI components � security obligations in contracts; Third-party services accessed via agent credentials assessed � security obligations in access arrangements; All agent tool and MCP server providers assessed � security obligations, integrity guarantees, disclosure SLA in contracts", + "description": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts; Third-party services accessed via agent credentials assessed — security obligations in access arrangements; All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts", "kind": "control" }, { "control_id": "A.10.2", "title": "Customer relationships", - "description": "Obligations to downstream consumers of agentic systems � what supply chain security is guaranteed; LLM deployment obligations to downstream customers � what security properties are guaranteed", + "description": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed; LLM deployment obligations to downstream customers — what security properties are guaranteed", "kind": "control" }, { @@ -5142,7 +5142,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "MP-3.5", "title": "AI system impact", - "description": "Impact assessment of shadow AI on organisational data security posture � ungoverned data flows quantified; Impact assessment of endpoint AI agents � data access scope, exfiltration paths, user risk", + "description": "Impact assessment of shadow AI on organisational data security posture — ungoverned data flows quantified; Impact assessment of endpoint AI agents — data access scope, exfiltration paths, user risk", "kind": "control" } ], @@ -5352,133 +5352,133 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "GV.OC-01", "title": "Organisational Context", - "description": "Policy defines permissible agent autonomy � agents cannot change stated goals without human confirmation; Policy defines permissible tool invocations � which tools require human confirmation; Policy requires AI disclosure and advisory labelling � agent transparency as a governance requirement", + "description": "Policy defines permissible agent autonomy — agents cannot change stated goals without human confirmation; Policy defines permissible tool invocations — which tools require human confirmation; Policy requires AI disclosure and advisory labelling — agent transparency as a governance requirement", "kind": "control" }, { "control_id": "PR.PS-04", "title": "Platform Security", - "description": "Secure software development � input validation and goal-state verification as platform security controls; Secure software development � static analysis, sandbox, allowlist as code execution platform security controls; Secure software development � multi-stage validation, path traversal prevention in ingestion code", + "description": "Secure software development — input validation and goal-state verification as platform security controls; Secure software development — static analysis, sandbox, allowlist as code execution platform security controls; Secure software development — multi-stage validation, path traversal prevention in ingestion code", "kind": "control" }, { "control_id": "DE.CM-01", "title": "Continuous Monitoring", - "description": "Networks and assets monitored � injection indicators detected across all agent input channels; All tool invocations logged and monitored � anomalous parameters, unusual sequences, high frequency detected; Credential usage monitored � anomalous access patterns detected", + "description": "Networks and assets monitored — injection indicators detected across all agent input channels; All tool invocations logged and monitored — anomalous parameters, unusual sequences, high frequency detected; Credential usage monitored — anomalous access patterns detected", "kind": "control" }, { "control_id": "RS.MI-01", "title": "Incident Mitigation", - "description": "Incidents contained � agent suspended, actions reversed, kill switch activated; Code execution incidents contained � sandbox isolated, forensic capture initiated; Incidents contained � kill switch activated, process control fallback initiated", + "description": "Incidents contained — agent suspended, actions reversed, kill switch activated; Code execution incidents contained — sandbox isolated, forensic capture initiated; Incidents contained — kill switch activated, process control fallback initiated", "kind": "control" }, { "control_id": "PR.AA-05", "title": "Identity Management, Authentication & Access Control", - "description": "Access permissions managed � per-tool permission manifests, least privilege per tool, irreversibility classification; Access permissions managed � agent credential scope enforced, least privilege per agent role; Access permissions managed � rogue agent cannot exceed its permission envelope regardless of internal goal state", + "description": "Access permissions managed — per-tool permission manifests, least privilege per tool, irreversibility classification; Access permissions managed — agent credential scope enforced, least privilege per agent role; Access permissions managed — rogue agent cannot exceed its permission envelope regardless of internal goal state", "kind": "control" }, { "control_id": "RS.AN-03", "title": "Incident Analysis", - "description": "Root cause analysis � which tool was misused, what downstream impact occurred, what parameters were used; Memory poisoning incidents analysed � affected sessions identified, operational decisions influenced reviewed; Root cause analysis � what caused rogue behaviour, which sessions were affected, what was the blast radius", + "description": "Root cause analysis — which tool was misused, what downstream impact occurred, what parameters were used; Memory poisoning incidents analysed — affected sessions identified, operational decisions influenced reviewed; Root cause analysis — what caused rogue behaviour, which sessions were affected, what was the blast radius", "kind": "control" }, { "control_id": "PR.AA-01", "title": "Identity Management, Authentication & Access Control", - "description": "Identities and credentials managed � NHI inventory, lifecycle management, unique identity per agent; Agent identities managed � each agent has a unique, verifiable identity for A2A authentication; Identities and credentials managed � NHI inventory, lifecycle, short-lived JIT issuance", + "description": "Identities and credentials managed — NHI inventory, lifecycle management, unique identity per agent; Agent identities managed — each agent has a unique, verifiable identity for A2A authentication; Identities and credentials managed — NHI inventory, lifecycle, short-lived JIT issuance", "kind": "control" }, { "control_id": "PR.DS-01", "title": "Data Security", - "description": "Sensitive data protected at rest � agent credentials encrypted, not stored in cleartext; Agent memory stores protected at rest � access controls, encryption, integrity verification; Sensitive data at rest protected � training data, embeddings, RAG stores, prompt caches encrypted", + "description": "Sensitive data protected at rest — agent credentials encrypted, not stored in cleartext; Agent memory stores protected at rest — access controls, encryption, integrity verification; Sensitive data at rest protected — training data, embeddings, RAG stores, prompt caches encrypted", "kind": "control" }, { "control_id": "GV.SC-01", "title": "Supply Chain Risk Management", - "description": "Cybersecurity supply chain risk management programme � all agent component vendors in scope; Inter-agent communication infrastructure treated as internal supply chain � authentication requirements documented; All approved AI tools managed as suppliers � TPSP assessment, contractual obligations", + "description": "Cybersecurity supply chain risk management programme — all agent component vendors in scope; Inter-agent communication infrastructure treated as internal supply chain — authentication requirements documented; All approved AI tools managed as suppliers — TPSP assessment, contractual obligations", "kind": "control" }, { "control_id": "GV.SC-06", "title": "Supply Chain Risk Management", - "description": "Cybersecurity requirements in supplier contracts � integrity guarantees, vulnerability disclosure SLA; Cybersecurity requirements included in contracts with suppliers � LLM model and data vendors", + "description": "Cybersecurity requirements in supplier contracts — integrity guarantees, vulnerability disclosure SLA; Cybersecurity requirements included in contracts with suppliers — LLM model and data vendors", "kind": "control" }, { "control_id": "ID.AM-08", "title": "Asset Management", - "description": "Agent components inventoried � ML SBOM for all tools, MCP servers, model weights, libraries; Agent memory stores inventoried as data assets � content classification, access controls, TTL documented; All tool integrations inventoried � data received, retained, training use, security assessment status", + "description": "Agent components inventoried — ML SBOM for all tools, MCP servers, model weights, libraries; Agent memory stores inventoried as data assets — content classification, access controls, TTL documented; All tool integrations inventoried — data received, retained, training use, security assessment status", "kind": "control" }, { "control_id": "PR.PS-02", "title": "Platform Security", - "description": "Software managed to reduce risk � component integrity verification, change management; Software managed to reduce risk � vector database CVEs patched promptly; Software managed to reduce risk � browser AI extensions version-controlled, patched, approved before deployment", + "description": "Software managed to reduce risk — component integrity verification, change management; Software managed to reduce risk — vector database CVEs patched promptly; Software managed to reduce risk — browser AI extensions version-controlled, patched, approved before deployment", "kind": "control" }, { "control_id": "PR.IR-01", "title": "Infrastructure Resilience", - "description": "Networks and environments protected � sandbox isolated from production infrastructure; Networks and environments protected for resilience � circuit breakers, blast radius limits, fail-safe defaults; Networks and environments protected for resilience � circuit breakers, freshness monitoring, redundancy", + "description": "Networks and environments protected — sandbox isolated from production infrastructure; Networks and environments protected for resilience — circuit breakers, blast radius limits, fail-safe defaults; Networks and environments protected for resilience — circuit breakers, freshness monitoring, redundancy", "kind": "control" }, { "control_id": "DE.CM-09", "title": "Continuous Monitoring", - "description": "Monitoring for anomalous data � memory content integrity checks, unusual write patterns detected; Monitoring for aggregate over-trust patterns � systematic operator acceptance without verification detected; Monitoring for anomalous data and software use � behavioural baseline deviation detected", + "description": "Monitoring for anomalous data — memory content integrity checks, unusual write patterns detected; Monitoring for aggregate over-trust patterns — systematic operator acceptance without verification detected; Monitoring for anomalous data and software use — behavioural baseline deviation detected", "kind": "control" }, { "control_id": "PR.DS-02", "title": "Data Security", - "description": "Data in transit protected � all A2A communication encrypted, integrity verified; Sensitive data in transit protected � all GenAI API calls and RAG retrieval paths encrypted; Extracted sensitive content encrypted in transit � multimodal extraction pipelines covered", + "description": "Data in transit protected — all A2A communication encrypted, integrity verified; Sensitive data in transit protected — all GenAI API calls and RAG retrieval paths encrypted; Extracted sensitive content encrypted in transit — multimodal extraction pipelines covered", "kind": "control" }, { "control_id": "RC.RP-01", "title": "Incident Recovery", - "description": "Recovery plan includes agent cluster failures � BCP covers AI system availability, RTO/RPO defined; Recovery plan includes GenAI pipeline failures � BCP covers AI availability, RTO/RPO defined", + "description": "Recovery plan includes agent cluster failures — BCP covers AI system availability, RTO/RPO defined; Recovery plan includes GenAI pipeline failures — BCP covers AI availability, RTO/RPO defined", "kind": "control" }, { "control_id": "PR.AT-01", "title": "Awareness and Training", - "description": "Users trained on AI limitations � operators understand agent advisory status and verification requirements; Users trained on shadow AI risk � policy awareness, prohibited tool use, reporting obligations; Labelling staff trained on data handling � classification, prohibited use, incident reporting", + "description": "Users trained on AI limitations — operators understand agent advisory status and verification requirements; Users trained on shadow AI risk — policy awareness, prohibited tool use, reporting obligations; Labelling staff trained on data handling — classification, prohibited use, incident reporting", "kind": "control" }, { "control_id": "RS.CO-03", "title": "Communication", - "description": "Information shared following incidents � trust exploitation incidents reported to affected users; Regulatory incident communication � breach notification, regulatory reporting, authority contact procedures", + "description": "Information shared following incidents — trust exploitation incidents reported to affected users; Regulatory incident communication — breach notification, regulatory reporting, authority contact procedures", "kind": "control" }, { "control_id": "DE.AE-02", "title": "Adverse Event Analysis", - "description": "Detected events analysed to understand attack targets � rogue agent patterns correlated across sessions", + "description": "Detected events analysed to understand attack targets — rogue agent patterns correlated across sessions", "kind": "control" }, { "control_id": "GV.RM-06", "title": "Risk Management Strategy", - "description": "Risk tolerance established � acceptable sensitive data disclosure risk defined per GenAI use case; Agent credential exposure in risk register � blast radius per deployment documented; Risk tolerance defined for re-identification risk in synthetic datasets � legal standard, not technical checkbox", + "description": "Risk tolerance established — acceptable sensitive data disclosure risk defined per GenAI use case; Agent credential exposure in risk register — blast radius per deployment documented; Risk tolerance defined for re-identification risk in synthetic datasets — legal standard, not technical checkbox", "kind": "control" }, { "control_id": "ID.RA-01", "title": "Risk Assessment", - "description": "Ingestion interface vulnerabilities documented in risk assessment � CVE-2024-3584 class; Compliance risks identified per GenAI deployment � applicable regulations, triggered obligations, controls gaps; Re-identification risk assessed for all synthetic datasets before use or distribution", + "description": "Ingestion interface vulnerabilities documented in risk assessment — CVE-2024-3584 class; Compliance risks identified per GenAI deployment — applicable regulations, triggered obligations, controls gaps; Re-identification risk assessed for all synthetic datasets before use or distribution", "kind": "control" }, { "control_id": "GV.RM-01", "title": "Risk Management Strategy", - "description": "Risk management strategy includes regulatory compliance risk � GenAI-specific obligations in risk programme; Risk management strategy established � LLM availability requirements and acceptable consumption risk defined", + "description": "Risk management strategy includes regulatory compliance risk — GenAI-specific obligations in risk programme; Risk management strategy established — LLM availability requirements and acceptable consumption risk defined", "kind": "control" } ], @@ -5689,35 +5689,35 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "AC-3", "title": "AC-3", - "description": "LLM access to OT systems enforced by policy � injection cannot escalate LLM access beyond defined scope; LLM access to OT data enforced by classification � sensitive process and network data requires elevated access tier; LLM access to OT systems enforced by policy � scope cannot be exceeded regardless of model instruction", + "description": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope; LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier; LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction", "kind": "control", "parent": null }, { "control_id": "AC-6", "title": "AC-6", - "description": "LLM granted minimum necessary OT access � read-only to historian, no write access without documented justification", + "description": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification", "kind": "control", "parent": null }, { "control_id": "AT-3", "title": "AT-3", - "description": "Operator training on LLM advisory limitations � mandatory for all operators using LLM decision-support tools", + "description": "Operator training on LLM advisory limitations — mandatory for all operators using LLM decision-support tools", "kind": "control", "parent": null }, { "control_id": "AU-9", "title": "AU-9", - "description": "LLM access logs to OT data protected � audit trail of all OT data accessed by LLM; System prompt access logs protected � unauthorised access attempts detectable", + "description": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM; System prompt access logs protected — unauthorised access attempts detectable", "kind": "control", "parent": null }, { "control_id": "AU-12", "title": "AU-12", - "description": "Full audit trail of LLM outputs � poisoning indicators detectable through output analysis; All LLM actions in OT context logged � full accountability for every OT data access and any recommended action; LLM resource consumption logged � patterns indicating exhaustion attacks detectable", + "description": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis; All LLM actions in OT context logged — full accountability for every OT data access and any recommended action; LLM resource consumption logged — patterns indicating exhaustion attacks detectable", "kind": "control", "parent": null }, @@ -5731,7 +5731,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "SA-12", "title": "SA-12", - "description": "Security requirements applied to all LLM component vendors � provenance, integrity, vulnerability disclosure", + "description": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure", "kind": "control", "parent": null }, @@ -5745,35 +5745,35 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "SC-28", "title": "SC-28", - "description": "OT data used in LLM context encrypted at rest � historian exports, embedding stores, prompt caches; System prompts encrypted at rest � not stored in cleartext configuration files; OT vector store content encrypted at rest", + "description": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches; System prompts encrypted at rest — not stored in cleartext configuration files; OT vector store content encrypted at rest", "kind": "control", "parent": null }, { "control_id": "SI-3", "title": "SI-3", - "description": "Treat prompt injection as a malicious code analog � detection and response controls required; LLM output scanning for malicious content before OT system ingestion; Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs", + "description": "Treat prompt injection as a malicious code analog — detection and response controls required; LLM output scanning for malicious content before OT system ingestion; Analogy: LLM misinformation detection controls as an integrity assurance layer on advisory outputs", "kind": "control", "parent": null }, { "control_id": "SI-7", "title": "SI-7", - "description": "Model integrity verification before each OT deployment � hash-based integrity check; Vector store integrity monitoring � alert on anomalous content or unexpected modifications", + "description": "Model integrity verification before each OT deployment — hash-based integrity check; Vector store integrity monitoring — alert on anomalous content or unexpected modifications", "kind": "control", "parent": null }, { "control_id": "SI-10", "title": "SI-10", - "description": "Validate all inputs to LLMs connected to OT systems � reject inputs containing injection indicators; Training data validation � adversarial content detected and rejected before training; LLM outputs validated before passing to OT systems � schema validation, allowlist enforcement", + "description": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators; Training data validation — adversarial content detected and rejected before training; LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement", "kind": "control", "parent": null }, { "control_id": "SI-17", "title": "SI-17", - "description": "LLM service degradation has defined fail-safe behaviour � process control continues without LLM", + "description": "LLM service degradation has defined fail-safe behaviour — process control continues without LLM", "kind": "control", "parent": null }, @@ -5829,7 +5829,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "AST", "title": "Agent-Specific", - "description": "Attempt to redirect agent goal through indirect injection paths specific to your deployment � historian data, vendor communications, web results", + "description": "Attempt to redirect agent goal through indirect injection paths specific to your deployment — historian data, vendor communications, web results", "kind": "control", "parent": null }, @@ -5864,7 +5864,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "MBT", "title": "Model Behaviour", - "description": "Verify the agent's stated goal at session start matches its actions at session end � test divergence after indirect injection; Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection", + "description": "Verify the agent's stated goal at session start matches its actions at session end — test divergence after indirect injection; Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection", "kind": "control", "parent": null }, @@ -7921,13 +7921,13 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "V5.1.1", "title": "Verify all user input validated against allowlist", - "description": "All inputs to agents validated � indirect injection through processed content equally in scope; All content entering agent memory validated � injection patterns rejected at write boundary; All inputs to LLMs validated � indirect injection through processed content equally in scope", + "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", "kind": "control" }, { "control_id": "V5.2.1", "title": "Verify output encoding prevents injection", - "description": "Agent responses encoded before passing to downstream renderers � outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled � users cannot mistake AI output for authoritative content", + "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", "kind": "control" }, { @@ -7939,73 +7939,73 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "V1.1.2", "title": "Threat modelling of all data flows", - "description": "All agent input sources threat-modelled � every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled � all injection paths identified and documented", + "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", "kind": "control" }, { "control_id": "V11.1.2", "title": "Verify business logic limits prevent function abuse", - "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model � mitigations implemented and verified; Code execution capability in agents subject to business logic controls � sandbox, allowlist, static analysis", + "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", "kind": "control" }, { "control_id": "V4.1.3", "title": "Verify access control enforces least privilege", - "description": "Agent tool access scoped to minimum required operations � read-only by default, write access formally approved; Agent credential scope minimum required � no over-privileged NHIs; Memory write access restricted to minimum required sources � only agent and authorised administrators can write", + "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", "kind": "control" }, { "control_id": "V4.1.1", "title": "Verify all sensitive functions have access control", - "description": "All destructive tool operations require explicit authorisation � not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", "kind": "control" }, { "control_id": "V7.2.2", "title": "Verify all business logic decisions logged", - "description": "All tool invocations logged � tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged � systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context � every tool call auditable", + "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", "kind": "control" }, { "control_id": "V13.1.1", "title": "Verify API rate limiting", - "description": "Tool API endpoints rate-limited � anomalous invocation frequency detected; Rate limiting on all agent API endpoints � cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", "kind": "control" }, { "control_id": "V2.1.1", "title": "Verify credentials not in source code", - "description": "Agent credentials not hardcoded � secret manager required", + "description": "Agent credentials not hardcoded — secret manager required", "kind": "control" }, { "control_id": "V6.1.1", "title": "Verify sensitive data encrypted at rest", - "description": "Agent credentials encrypted at rest � no cleartext in config or agent memory; Agent memory stores encrypted at rest � embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", "kind": "control" }, { "control_id": "V7.2.1", "title": "Verify access control decisions logged", - "description": "All credential usage logged � issuance, access, expiry detectable; All A2A messages logged � sender identity, content hash, schema validation results; All agent actions logged � no production deployment without complete observability", + "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", "kind": "control" }, { "control_id": "V14.2.3", "title": "Verify secrets not in source code", - "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code � stored in secret management system", + "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", "kind": "control" }, { "control_id": "V10.2.1", "title": "Verify third-party components current and free of vulnerabilities", - "description": "All agent component libraries scanned for CVEs � ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs � ML SBOM maintained; Training pipeline components scanned � compromised dependencies rejected", + "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected", "kind": "control" }, { "control_id": "V10.2.2", "title": "Verify only minimal approved external libraries", - "description": "Approved component list � unsigned or unverified agent components rejected; Approved component list for LLM deployments � unsigned or unverified components rejected", + "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected", "kind": "control" }, { @@ -8017,49 +8017,49 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "V5.2.4", "title": "Verify application does not use eval or dynamic code", - "description": "No eval or exec of agent-generated code � absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", + "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", "kind": "control" }, { "control_id": "V5.3.5", "title": "Verify output encoding in SQL context", - "description": "No raw agent output in SQL context � parameterised execution only; LLM-generated SQL parameterised � never raw LLM output in SQL context", + "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", "kind": "control" }, { "control_id": "V12.1.1", "title": "Verify file upload malware scanning", - "description": "Content entering agent memory scanned � adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion � adversarial content detected; Content validation on all vector store ingestion � adversarial content detected", + "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", "kind": "control" }, { "control_id": "V9.1.1", "title": "Verify TLS used for all client connectivity", - "description": "All A2A communication encrypted � mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit � TLS 1.2 minimum", + "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", "kind": "control" }, { "control_id": "V3.3.1", "title": "Verify anti-replay tokens in state-changing operations", - "description": "Replay protection on all A2A messages � nonces, timestamps, sequence numbers", + "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", "kind": "control" }, { "control_id": "V11.1.1", "title": "Verify business logic assumptions documented", - "description": "Cascade blast radius documented as business logic assumption � maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions � verification requirements per domain; LLM accuracy limitations documented as business logic assumptions � verification requirements defined", + "description": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions — verification requirements per domain; LLM accuracy limitations documented as business logic assumptions — verification requirements defined", "kind": "control" }, { "control_id": "V7.4.1", "title": "Verify error handling does not expose sensitive data", - "description": "Cascade errors handled gracefully � no sensitive system information in error responses; Agent-influenced operator decisions logged � aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged � production monitoring for output quality", + "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", "kind": "control" }, { "control_id": "V13.1.3", "title": "Verify API rejects large unexpected payloads", - "description": "Approval flows independent of agent interface � no state-changing approvals via agent chat; Token limits on LLM API inputs � requests exceeding limits rejected at the gateway", + "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", "kind": "control" }, { @@ -8135,7 +8135,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "V5.1.2", "title": "Verify that HTTP request parts are validated, sanitised, or rejected", - "description": "LLM API request validation � prompt structure, content type, and character set enforced", + "description": "LLM API request validation — prompt structure, content type, and character set enforced", "kind": "control" }, { @@ -8159,7 +8159,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "V11.1.4", "title": "Verify business logic rate limits", - "description": "Business logic controls on LLM usage � per-tenant cost budgets, rate limit policies", + "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", "kind": "control" } ], @@ -8193,70 +8193,70 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "NHI-1", "title": "Improper Offboarding", - "description": "Formal agent offboarding � all credentials revoked, tokens invalidated, access removed", + "description": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed", "kind": "control", "parent": null }, { "control_id": "NHI-2", "title": "Secret Leakage", - "description": "No credentials in agent context, logs, or tool payloads � secret manager only", + "description": "No credentials in agent context, logs, or tool payloads — secret manager only", "kind": "control", "parent": null }, { "control_id": "NHI-3", "title": "Vulnerable Third-Party NHI", - "description": "Validate all third-party tool identities � reject tokens from unregistered issuers", + "description": "Validate all third-party tool identities — reject tokens from unregistered issuers", "kind": "control", "parent": null }, { "control_id": "NHI-4", "title": "Insecure Authentication", - "description": "Strong authentication for all agent-to-system connections � mTLS, short-lived tokens", + "description": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens", "kind": "control", "parent": null }, { "control_id": "NHI-5", "title": "Over-Privileged NHI", - "description": "Scope all agent credentials to minimum required � least privilege enforced", + "description": "Scope all agent credentials to minimum required — least privilege enforced", "kind": "control", "parent": null }, { "control_id": "NHI-6", "title": "Insecure Credential Storage", - "description": "Secret manager for all agent credentials � no cleartext storage anywhere", + "description": "Secret manager for all agent credentials — no cleartext storage anywhere", "kind": "control", "parent": null }, { "control_id": "NHI-7", "title": "Long-Lived Credentials", - "description": "Short-lived credentials � tokens expire at task completion, no long-lived agent tokens", + "description": "Short-lived credentials — tokens expire at task completion, no long-lived agent tokens", "kind": "control", "parent": null }, { "control_id": "NHI-8", "title": "Environment Isolation Failure", - "description": "Strict environment isolation � separate credentials per environment, no cross-environment reuse", + "description": "Strict environment isolation — separate credentials per environment, no cross-environment reuse", "kind": "control", "parent": null }, { "control_id": "NHI-9", "title": "NHI Reuse", - "description": "Unique identity per agent � no shared service accounts across agent deployments", + "description": "Unique identity per agent — no shared service accounts across agent deployments", "kind": "control", "parent": null }, { "control_id": "NHI-10", "title": "Human Use of NHI", - "description": "Agent credentials machine-only � human use detected and blocked", + "description": "Agent credentials machine-only — human use detected and blocked", "kind": "control", "parent": null } @@ -8368,19 +8368,19 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "V-RT", "title": "Verification / Requirements-Driven Testing", - "description": "Automated tests verifying PII detection coverage; Tests verifying provenance metadata is preserved through pipeline; Data protection requirements verified in testing � PII patterns confirmed not to appear in LLM outputs", + "description": "Automated tests verifying PII detection coverage; Tests verifying provenance metadata is preserved through pipeline; Data protection requirements verified in testing — PII patterns confirmed not to appear in LLM outputs", "kind": "control" }, { "control_id": "I-SD", "title": "Implementation / Secure Deployment", - "description": "Infrastructure-as-code with security controls applied at provisioning; Rate limiting and resource controls deployed with every LLM deployment � not optional post-deployment hardening", + "description": "Infrastructure-as-code with security controls applied at provisioning; Rate limiting and resource controls deployed with every LLM deployment — not optional post-deployment hardening", "kind": "control" }, { "control_id": "Monitoring", "title": "Operational Management (O-OM)", - "description": "Production accuracy monitoring as operational management � drift detection, degradation alerted", + "description": "Production accuracy monitoring as operational management — drift detection, degradation alerted", "kind": "control" } ], @@ -8414,7 +8414,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 1.3.2", "title": "Network security", - "description": "Network controls prevent CHD flows to unapproved AI endpoints � block at network layer; Rate limiting protecting availability of CDE-facing LLM endpoints � DoS prevention; Network controls restrict inbound traffic to CDE � rate limiting at network layer for LLM applications", + "description": "Network controls prevent CHD flows to unapproved AI endpoints — block at network layer; Rate limiting protecting availability of CDE-facing LLM endpoints — DoS prevention; Network controls restrict inbound traffic to CDE — rate limiting at network layer for LLM applications", "kind": "control" }, { @@ -8427,19 +8427,19 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 3.1.1", "title": "Account data inventory", - "description": "All CHD locations documented � derived GenAI assets (embeddings, caches) included in data inventory; Synthetic payment datasets that may be re-identifiable included in CHD inventory", + "description": "All CHD locations documented — derived GenAI assets (embeddings, caches) included in data inventory; Synthetic payment datasets that may be re-identifiable included in CHD inventory", "kind": "control" }, { "control_id": "Req 3.2.1", "title": "Data flow documentation", - "description": "Data flow diagrams include all GenAI pipeline paths � source through embedding, retrieval, generation, logging", + "description": "Data flow diagrams include all GenAI pipeline paths — source through embedding, retrieval, generation, logging", "kind": "control" }, { "control_id": "Req 3.3.1", "title": "SAD prohibition", - "description": "Synthetic data generated from SAD retains SAD classification � generation does not remove the prohibition; SAD must never appear in labelling tasks � labels cannot expose CVV or full magnetic stripe data; SAD (CVV, PIN) must never be in LLM training data or RAG � stored after authorisation is prohibited", + "description": "Synthetic data generated from SAD retains SAD classification — generation does not remove the prohibition; SAD must never appear in labelling tasks — labels cannot expose CVV or full magnetic stripe data; SAD (CVV, PIN) must never be in LLM training data or RAG — stored after authorisation is prohibited", "kind": "control" }, { @@ -8452,7 +8452,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 3.4.1", "title": "PAN rendering unreadable", - "description": "PANs in GenAI outputs masked � only first six/last four digits in any response; PANs extracted from multimodal content masked in all outputs � OCR-extracted PANs are CHD requiring Req 3 treatment; Synthetic PANs that pass Luhn check treated as CHD � format-preserving synthetic PANs are in PCI scope", + "description": "PANs in GenAI outputs masked — only first six/last four digits in any response; PANs extracted from multimodal content masked in all outputs — OCR-extracted PANs are CHD requiring Req 3 treatment; Synthetic PANs that pass Luhn check treated as CHD — format-preserving synthetic PANs are in PCI scope", "kind": "control" }, { @@ -8465,7 +8465,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 3.5.1", "title": "Protect stored account data", - "description": "All CHD in GenAI scope encrypted � training data, RAG stores, embeddings, prompt caches; All CHD extracted from multimodal inputs encrypted at rest � OCR output of a payment document is CHD; Per-user session CHD encrypted � KV cache isolation prevents cross-session PAN exposure", + "description": "All CHD in GenAI scope encrypted — training data, RAG stores, embeddings, prompt caches; All CHD extracted from multimodal inputs encrypted at rest — OCR output of a payment document is CHD; Per-user session CHD encrypted — KV cache isolation prevents cross-session PAN exposure", "kind": "control" }, { @@ -8478,7 +8478,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 4.2.1", "title": "Encryption in transit", - "description": "All GenAI data flows carrying CHD encrypted � TLS 1.2 minimum; Multimodal extraction pipelines encrypted in transit where CHD is in scope; All LLM API calls and RAG retrieval paths carrying CHD encrypted in transit � TLS 1.2 minimum", + "description": "All GenAI data flows carrying CHD encrypted — TLS 1.2 minimum; Multimodal extraction pipelines encrypted in transit where CHD is in scope; All LLM API calls and RAG retrieval paths carrying CHD encrypted in transit — TLS 1.2 minimum", "kind": "control" }, { @@ -8496,8 +8496,8 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 6.2.4", - "title": "Bespoke software � injection", - "description": "All injection vulnerability classes addressed in GenAI ingestion code � schema bypass and path traversal; LLM-to-SQL interfaces address injection as a known vulnerability class � query allowlisting, parameterised execution; All injection vulnerabilities addressed in LLM integration code � prompt injection as a known injection class", + "title": "Bespoke software — injection", + "description": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal; LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution; All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class", "kind": "control" }, { @@ -8510,7 +8510,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 6.3.3", "title": "Vulnerability management", - "description": "All GenAI software components patched � CVE-2024-3584 class treated as urgent for CDE scope; Vector database CVEs patched � CVE-2024-3584 class treated as urgent for CDE-scope stores; Browser AI extensions patched and version-controlled � vulnerable extensions are Req 6.3 findings in CDE", + "description": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope; Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores; Browser AI extensions patched and version-controlled — vulnerable extensions are Req 6.3 findings in CDE", "kind": "control" }, { @@ -8523,7 +8523,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 6.4.1", "title": "Public-facing application protection", - "description": "LLM-powered query interfaces in CDE scope protected � WAF or equivalent, input validation; Model extraction pattern detection as application protection � systematic API abuse detected; LLM-powered customer-facing applications protected against prompt injection � WAF or equivalent, security testing", + "description": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation; Model extraction pattern detection as application protection — systematic API abuse detected; LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing", "kind": "control" }, { @@ -8535,13 +8535,13 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 6.5.1", "title": "Secure system changes", - "description": "Model component updates follow change management � security testing before production", + "description": "Model component updates follow change management — security testing before production", "kind": "control" }, { "control_id": "Req 6.5.6", "title": "Secure system changes", - "description": "All model promotions tested for unexpected functionality � poisoning detection as Req 6.5 testing requirement; RAG corpus updates tested for unexpected content � integrity verification before production indexing; All model promotions tested for unexpected functionality before CDE deployment � poisoning as unexpected functionality", + "description": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement; RAG corpus updates tested for unexpected content — integrity verification before production indexing; All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality", "kind": "control" }, { @@ -8554,7 +8554,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 7.2.1", "title": "Restrict access", - "description": "RAG retrieval access controls � users retrieve only CHD they are authorised to access; Agent credentials scoped to minimum CDE access � least privilege, quarterly review; Context minimisation � tools receive minimum CHD-containing context required", + "description": "RAG retrieval access controls — users retrieve only CHD they are authorised to access; Agent credentials scoped to minimum CDE access — least privilege, quarterly review; Context minimisation — tools receive minimum CHD-containing context required", "kind": "control" }, { @@ -8567,7 +8567,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 7.3.1", "title": "Access control system", - "description": "Access control system enforces LLM tool scope � agent cannot exceed defined CDE access without explicit authorisation", + "description": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation", "kind": "control" }, { @@ -8580,7 +8580,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 8.2.1", "title": "Unique IDs for access", - "description": "Each agent has a unique service identity � no shared credentials across CDE-facing agents", + "description": "Each agent has a unique service identity — no shared credentials across CDE-facing agents", "kind": "control" }, { @@ -8593,7 +8593,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 9.4.6", "title": "Media disposal", - "description": "Derived GenAI assets containing CHD disposed of securely � deletion verified per Req 9.4 requirements", + "description": "Derived GenAI assets containing CHD disposed of securely — deletion verified per Req 9.4 requirements", "kind": "control" }, { @@ -8606,13 +8606,13 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 10.2.1", "title": "Logging of all access", - "description": "All agent credential operations in CDE logged � issuance, use, anomalous patterns; All tool call payloads containing CHD logged � Req 10 audit trail requirement; All PAN access through multimodal pipelines logged", + "description": "All agent credential operations in CDE logged — issuance, use, anomalous patterns; All tool call payloads containing CHD logged — Req 10 audit trail requirement; All PAN access through multimodal pipelines logged", "kind": "control" }, { "control_id": "Req 10.6.1", "title": "Audit log review", - "description": "Automated monitoring of GenAI outputs in CDE � systematic anomalies indicating poisoning detected; Automated monitoring for GenAI pipeline health in CDE � freshness and availability metrics reviewed; Automated monitoring for extraction patterns � unusual query diversity alerted", + "description": "Automated monitoring of GenAI outputs in CDE — systematic anomalies indicating poisoning detected; Automated monitoring for GenAI pipeline health in CDE — freshness and availability metrics reviewed; Automated monitoring for extraction patterns — unusual query diversity alerted", "kind": "control" }, { @@ -8632,13 +8632,13 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 11.3.1", "title": "Penetration testing", - "description": "Poisoning detection in CDE penetration testing programme; Path traversal and ingestion injection in CDE penetration testing scope; Multi-tenant isolation tested in CDE penetration testing � cross-session CHD access attempted", + "description": "Poisoning detection in CDE penetration testing programme; Path traversal and ingestion injection in CDE penetration testing scope; Multi-tenant isolation tested in CDE penetration testing — cross-session CHD access attempted", "kind": "control" }, { "control_id": "Req 12.1.1", "title": "Security policy", - "description": "PCI security policy covers GenAI processing of CHD � updated to reflect AI system deployments", + "description": "PCI security policy covers GenAI processing of CHD — updated to reflect AI system deployments", "kind": "control" }, { @@ -8657,19 +8657,19 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 12.3.2", "title": "Targeted risk analysis", - "description": "Targeted risk analysis for agent credential scope in CDE � blast radius if credentials compromised; Targeted risk analysis for ungoverned GenAI-derived assets � scope, protection, lifecycle documented; Re-identification risk in synthetic payment datasets documented in targeted risk analysis", + "description": "Targeted risk analysis for agent credential scope in CDE — blast radius if credentials compromised; Targeted risk analysis for ungoverned GenAI-derived assets — scope, protection, lifecycle documented; Re-identification risk in synthetic payment datasets documented in targeted risk analysis", "kind": "control" }, { "control_id": "Req 12.4.1", "title": "Programme oversight", - "description": "Executive accountability for GenAI PCI compliance � CISO or equivalent with oversight documented", + "description": "Executive accountability for GenAI PCI compliance — CISO or equivalent with oversight documented", "kind": "control" }, { "control_id": "Req 12.5.2", "title": "TPSP oversight", - "description": "Shadow AI discovery as part of TPSP monitoring � identify unapproved vendors receiving CHD", + "description": "Shadow AI discovery as part of TPSP monitoring — identify unapproved vendors receiving CHD", "kind": "control" }, { @@ -8682,7 +8682,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 12.6.1", "title": "Security awareness", - "description": "PCI security awareness programme covers shadow AI risk � staff trained on prohibition; Security awareness covers PCI obligations in GenAI context � staff understand scope implications; PCI staff trained on LLM output limitations � advisory status of AI recommendations communicated", + "description": "PCI security awareness programme covers shadow AI risk — staff trained on prohibition; Security awareness covers PCI obligations in GenAI context — staff understand scope implications; PCI staff trained on LLM output limitations — advisory status of AI recommendations communicated", "kind": "control" }, { @@ -8694,19 +8694,19 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "Req 12.8.1", "title": "Third-party service providers", - "description": "Shadow AI tools processing CHD are unapproved TPSPs � not in TPSP list, no written agreements; All tool and plugin providers receiving CHD in TPSP list � even if access is indirect through agent context; Browser AI extension providers with CDE access are TPSPs � add to TPSP list, initiate compliance process", + "description": "Shadow AI tools processing CHD are unapproved TPSPs — not in TPSP list, no written agreements; All tool and plugin providers receiving CHD in TPSP list — even if access is indirect through agent context; Browser AI extension providers with CDE access are TPSPs — add to TPSP list, initiate compliance process", "kind": "control" }, { "control_id": "Req 12.8.3", "title": "TPSP agreements", - "description": "Written agreements with tool providers acknowledging CHD security responsibility; Written agreements with labelling vendors acknowledging CHD security responsibility; Written agreements with LLM vendors � acknowledge responsibility for CHD security", + "description": "Written agreements with tool providers acknowledging CHD security responsibility; Written agreements with labelling vendors acknowledging CHD security responsibility; Written agreements with LLM vendors — acknowledge responsibility for CHD security", "kind": "control" }, { "control_id": "Req 12.8.4", "title": "TPSP PCI DSS compliance", - "description": "Monitor TPSP PCI DSS compliance status � LLM component vendors with CHD access have compliant status verified", + "description": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified", "kind": "control" }, { diff --git a/scripts/validate.js b/scripts/validate.js index 3ae3255..3d4d50d 100644 --- a/scripts/validate.js +++ b/scripts/validate.js @@ -602,7 +602,7 @@ function checkSchemaV2() { */ const MOJIBAKE_FILES = ['**/*.md']; -function checkEncoding(allFiles) { +function checkEncoding(allFiles, { arrows = true, label = 'markdown content' } = {}) { let violations = 0; for (const fp of allFiles) { @@ -617,6 +617,7 @@ function checkEncoding(allFiles) { violations++; return; } + if (!arrows) return; // An arrow flattened to '?': in a heading, at the start of a diagram // line, or between two terms. const arrowish = @@ -630,7 +631,7 @@ function checkEncoding(allFiles) { }); } - if (!violations) pass('Encoding', 'No mojibake found in markdown content'); + if (!violations) pass('Encoding', `No mojibake found in ${label}`); return violations === 0; } @@ -1136,6 +1137,21 @@ function run() { encodingFiles.push(path.join(ROOT, 'shared', f)); } checkEncoding(encodingFiles); + + // The registries and the entry files ship in the npm package, in + // docs/*.js and in the OSCAL/STIX exports, but this guard only ever read + // Markdown — so 328 replacement characters sat in data/frameworks + // unnoticed (issue #112). JSON is checked for U+FFFD only: the arrow + // heuristic is tuned for prose and diagrams. + const dataFiles = []; + for (const sub of ['frameworks', 'entries', '.']) { + const dir = path.join(ROOT, 'data', sub); + if (!fs.existsSync(dir)) continue; + for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.json'))) { + dataFiles.push(path.join(dir, f)); + } + } + checkEncoding(dataFiles, { arrows: false, label: `${dataFiles.length} data files` }); } // Attribution guard (C1) — repo-wide, so only in a full run From 181ebccc14c3bd9b77ad9cba52f1b86f6115802c Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Fri, 18 Sep 2026 09:58:07 -0400 Subject: [PATCH 2/2] Title the 19 registry entries that carried only their identifier, from the published standards MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After #110 and #111, 35 mapping rows still named themselves after their id — "Req 11.3 | Req 11.3" — because neither the mapping table nor the registry held a title for those 19 ids. The text now comes from the standards themselves, transcribed rather than written. PCI DSS, 17 requirements: the headings as printed in PCI SSC's own "PCI DSS v4.0 SAQ D for Merchants", extracted with pdftotext from the published PDF so the wording is the document's, not a paraphrase. Req 11.3 reads "External and internal vulnerabilities are regularly identified, prioritized, and addressed." SOC 2, PI1.3 and P7.1: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022). The AICPA download needs a session, so the wording was taken from two independent copies of that document and compared; both agree character for character. Only entries whose title was empty or equal to their own id were filled, so no curated title is overwritten. Rows with no published title available were left alone — there are none left. Mapping rows whose control_name is merely their control_id: 35 -> 0. Co-Authored-By: Claude Opus 5 (1M context) --- data/backlinks.json | 38 ++++++++++---------- data/entries/ASI01.json | 6 ++-- data/entries/ASI02.json | 6 ++-- data/entries/ASI03.json | 8 ++--- data/entries/ASI04.json | 6 ++-- data/entries/ASI05.json | 6 ++-- data/entries/ASI06.json | 6 ++-- data/entries/ASI07.json | 6 ++-- data/entries/ASI08.json | 8 ++--- data/entries/ASI09.json | 10 +++--- data/entries/ASI10.json | 8 ++--- data/frameworks/pci-dss.json | 39 +++++++++++--------- data/frameworks/soc2.json | 9 +++-- docs/backlinks.js | 38 ++++++++++---------- docs/data.js | 70 ++++++++++++++++++------------------ docs/frameworks-registry.js | 48 +++++++++++++++---------- 16 files changed, 166 insertions(+), 146 deletions(-) diff --git a/data/backlinks.json b/data/backlinks.json index 897fde5..f87b6f1 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -34918,7 +34918,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 1.3", - "control_name": "Req 1.3", + "control_name": "Network access to and from the cardholder data environment is restricted.", "entries": [ { "id": "ASI08", @@ -34968,7 +34968,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "entries": [ { "id": "ASI01", @@ -35223,7 +35223,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.7", - "control_name": "Req 10.7", + "control_name": "Failures of critical security control systems are detected, reported, and responded to promptly.", "entries": [ { "id": "ASI08", @@ -35239,7 +35239,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "entries": [ { "id": "ASI01", @@ -35411,7 +35411,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "entries": [ { "id": "ASI01", @@ -35617,7 +35617,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.6", - "control_name": "Req 12.6", + "control_name": "Security awareness education is an ongoing activity.", "entries": [ { "id": "ASI09", @@ -35803,7 +35803,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 2.2", - "control_name": "Req 2.2", + "control_name": "System components are configured and managed securely.", "entries": [ { "id": "ASI04", @@ -35903,7 +35903,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 3.4", - "control_name": "Req 3.4", + "control_name": "Access to displays of full PAN and ability to copy PAN is restricted.", "entries": [ { "id": "ASI06", @@ -35998,7 +35998,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 3.5", - "control_name": "Req 3.5", + "control_name": "Primary account number (PAN) is secured wherever it is stored.", "entries": [ { "id": "ASI06", @@ -36102,7 +36102,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 4.2", - "control_name": "Req 4.2", + "control_name": "PAN is protected with strong cryptography during transmission.", "entries": [ { "id": "ASI07", @@ -36152,7 +36152,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 5.2", - "control_name": "Req 5.2", + "control_name": "Malicious software (malware) is prevented, or detected and addressed.", "entries": [ { "id": "ASI04", @@ -36281,7 +36281,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 6.3", - "control_name": "Req 6.3", + "control_name": "Security vulnerabilities are identified and addressed.", "entries": [ { "id": "ASI04", @@ -36340,7 +36340,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 6.4", - "control_name": "Req 6.4", + "control_name": "Public-facing web applications are protected against attacks.", "entries": [ { "id": "ASI05", @@ -36483,7 +36483,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "entries": [ { "id": "ASI02", @@ -36650,7 +36650,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 7.3", - "control_name": "Req 7.3", + "control_name": "Access to system components and data is managed via an access control system(s).", "entries": [ { "id": "ASI02", @@ -36682,7 +36682,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 8.2", - "control_name": "Req 8.2", + "control_name": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "entries": [ { "id": "ASI03", @@ -36723,7 +36723,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 8.3", - "control_name": "Req 8.3", + "control_name": "Strong authentication for users and administrators is established and managed.", "entries": [ { "id": "ASI03", @@ -38295,7 +38295,7 @@ { "framework": "SOC 2", "control_id": "P7.1", - "control_name": "P7.1", + "control_name": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.", "entries": [ { "id": "ASI09", @@ -38415,7 +38415,7 @@ { "framework": "SOC 2", "control_id": "PI1.3", - "control_name": "PI1.3", + "control_name": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.", "entries": [ { "id": "ASI09", diff --git a/data/entries/ASI01.json b/data/entries/ASI01.json index a456b63..2028810 100644 --- a/data/entries/ASI01.json +++ b/data/entries/ASI01.json @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Foundational", "scope": "Both", "notes": "Pen test report with goal hijack test cases", @@ -542,7 +542,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Audit log configuration, sample log entries", @@ -552,7 +552,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Foundational", "scope": "Both", "notes": "Risk analysis for agentic AI in PCI scope", diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 53b35f9..4680dc4 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "tier": "Foundational", "scope": "Both", "notes": "Access control matrix for agent tools, privilege review records", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 7.3", - "control_name": "Req 7.3", + "control_name": "Access to system components and data is managed via an access control system(s).", "tier": "Foundational", "scope": "Both", "notes": "Periodic access review records", @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Tool invocation audit log", diff --git a/data/entries/ASI03.json b/data/entries/ASI03.json index a9d1f3a..726ffae 100644 --- a/data/entries/ASI03.json +++ b/data/entries/ASI03.json @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 8.2", - "control_name": "Req 8.2", + "control_name": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "tier": "Foundational", "scope": "Both", "notes": "Account inventory, unique account evidence", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 8.3", - "control_name": "Req 8.3", + "control_name": "Strong authentication for users and administrators is established and managed.", "tier": "Foundational", "scope": "Both", "notes": "Credential management policy, rotation records", @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "tier": "Foundational", "scope": "Both", "notes": "Access control matrix, need-to-know justification", @@ -542,7 +542,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Authentication audit log", diff --git a/data/entries/ASI04.json b/data/entries/ASI04.json index 19e6fad..97e4c7a 100644 --- a/data/entries/ASI04.json +++ b/data/entries/ASI04.json @@ -523,7 +523,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 6.3", - "control_name": "Req 6.3", + "control_name": "Security vulnerabilities are identified and addressed.", "tier": "Foundational", "scope": "Both", "notes": "Vulnerability scan results, patch records", @@ -533,7 +533,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 5.2", - "control_name": "Req 5.2", + "control_name": "Malicious software (malware) is prevented, or detected and addressed.", "tier": "Foundational", "scope": "Both", "notes": "Integrity check configuration, verification records", @@ -543,7 +543,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 2.2", - "control_name": "Req 2.2", + "control_name": "System components are configured and managed securely.", "tier": "Foundational", "scope": "Both", "notes": "Hardening baseline documentation", diff --git a/data/entries/ASI05.json b/data/entries/ASI05.json index 6498a58..ee9f6ef 100644 --- a/data/entries/ASI05.json +++ b/data/entries/ASI05.json @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 6.4", - "control_name": "Req 6.4", + "control_name": "Public-facing web applications are protected against attacks.", "tier": "Hardening", "scope": "Both", "notes": "WAF configuration, protection evidence", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Hardening", "scope": "Both", "notes": "Pen test report with code execution test cases", @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Hardening", "scope": "Both", "notes": "Code execution audit log", diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json index b219647..268297a 100644 --- a/data/entries/ASI06.json +++ b/data/entries/ASI06.json @@ -502,7 +502,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 3.4", - "control_name": "Req 3.4", + "control_name": "Access to displays of full PAN and ability to copy PAN is restricted.", "tier": "Hardening", "scope": "Both", "notes": "Memory store review, PAN protection evidence", @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 3.5", - "control_name": "Req 3.5", + "control_name": "Primary account number (PAN) is secured wherever it is stored.", "tier": "Hardening", "scope": "Both", "notes": "Encryption configuration, key management records", @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Hardening", "scope": "Both", "notes": "Pen test report", diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json index 7a415a2..c112955 100644 --- a/data/entries/ASI07.json +++ b/data/entries/ASI07.json @@ -502,7 +502,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 4.2", - "control_name": "Req 4.2", + "control_name": "PAN is protected with strong cryptography during transmission.", "tier": "Hardening", "scope": "Both", "notes": "TLS configuration, protocol verification", @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 8.2", - "control_name": "Req 8.2", + "control_name": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "tier": "Hardening", "scope": "Both", "notes": "Certificate configuration, authentication evidence", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent communication audit log", diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json index 4743572..310a894 100644 --- a/data/entries/ASI08.json +++ b/data/entries/ASI08.json @@ -502,7 +502,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.7", - "control_name": "Req 10.7", + "control_name": "Failures of critical security control systems are detected, reported, and responded to promptly.", "tier": "Foundational", "scope": "Both", "notes": "Monitoring configuration, alert records, detection evidence", @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Foundational", "scope": "Both", "notes": "Risk analysis documentation", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 1.3", - "control_name": "Req 1.3", + "control_name": "Network access to and from the cardholder data environment is restricted.", "tier": "Foundational", "scope": "Both", "notes": "Network diagram, segmentation evidence", @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 2.2", - "control_name": "Req 2.2", + "control_name": "System components are configured and managed securely.", "tier": "Foundational", "scope": "Both", "notes": "Hardening baseline documentation", diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json index 4eb1cca..4bbc9d3 100644 --- a/data/entries/ASI09.json +++ b/data/entries/ASI09.json @@ -472,7 +472,7 @@ { "framework": "SOC 2", "control_id": "PI1.3", - "control_name": "PI1.3", + "control_name": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.", "tier": "Foundational", "scope": "Both", "notes": "Output quality controls, factual accuracy testing", @@ -482,7 +482,7 @@ { "framework": "SOC 2", "control_id": "P7.1", - "control_name": "P7.1", + "control_name": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.", "tier": "Foundational", "scope": "Both", "notes": "Accuracy review procedures", @@ -492,7 +492,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.6", - "control_name": "Req 12.6", + "control_name": "Security awareness education is an ongoing activity.", "tier": "Foundational", "scope": "Both", "notes": "Training curriculum, completion records", @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Interaction audit log", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Foundational", "scope": "Both", "notes": "Risk analysis documentation", diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json index 334f991..e037a42 100644 --- a/data/entries/ASI10.json +++ b/data/entries/ASI10.json @@ -512,7 +512,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "tier": "Hardening", "scope": "Both", "notes": "Access control matrix, technical enforcement evidence", @@ -522,7 +522,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Hardening", "scope": "Both", "notes": "Action audit log, out-of-scope alert records", @@ -532,7 +532,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Hardening", "scope": "Both", "notes": "Pen test report with rogue agent test cases", @@ -542,7 +542,7 @@ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Hardening", "scope": "Both", "notes": "Risk analysis documentation", diff --git a/data/frameworks/pci-dss.json b/data/frameworks/pci-dss.json index 151e924..a0e3e82 100644 --- a/data/frameworks/pci-dss.json +++ b/data/frameworks/pci-dss.json @@ -12,7 +12,7 @@ "controls": [ { "control_id": "Req 1.3", - "title": "Req 1.3", + "title": "Network access to and from the cardholder data environment is restricted.", "description": "Network diagram, segmentation evidence", "kind": "control", "parent": null @@ -25,7 +25,7 @@ }, { "control_id": "Req 2.2", - "title": "Req 2.2", + "title": "System components are configured and managed securely.", "description": "Hardening baseline documentation", "kind": "control", "parent": null @@ -50,7 +50,7 @@ }, { "control_id": "Req 3.4", - "title": "Req 3.4", + "title": "Access to displays of full PAN and ability to copy PAN is restricted.", "description": "Memory store review, PAN protection evidence", "kind": "control", "parent": null @@ -63,7 +63,7 @@ }, { "control_id": "Req 3.5", - "title": "Req 3.5", + "title": "Primary account number (PAN) is secured wherever it is stored.", "description": "Encryption configuration, key management records", "kind": "control", "parent": null @@ -76,7 +76,7 @@ }, { "control_id": "Req 4.2", - "title": "Req 4.2", + "title": "PAN is protected with strong cryptography during transmission.", "description": "TLS configuration, protocol verification", "kind": "control", "parent": null @@ -89,7 +89,7 @@ }, { "control_id": "Req 5.2", - "title": "Req 5.2", + "title": "Malicious software (malware) is prevented, or detected and addressed.", "description": "Integrity check configuration, verification records", "kind": "control", "parent": null @@ -108,7 +108,7 @@ }, { "control_id": "Req 6.3", - "title": "Req 6.3", + "title": "Security vulnerabilities are identified and addressed.", "description": "Vulnerability scan results, patch records", "kind": "control", "parent": null @@ -121,7 +121,7 @@ }, { "control_id": "Req 6.4", - "title": "Req 6.4", + "title": "Public-facing web applications are protected against attacks.", "description": "WAF configuration, protection evidence", "kind": "control", "parent": null @@ -152,7 +152,7 @@ }, { "control_id": "Req 7.2", - "title": "Req 7.2", + "title": "Access to system components and data is appropriately defined and assigned.", "description": "Access control matrix for agent tools, privilege review records", "kind": "control", "parent": null @@ -165,7 +165,7 @@ }, { "control_id": "Req 7.3", - "title": "Req 7.3", + "title": "Access to system components and data is managed via an access control system(s).", "description": "Periodic access review records", "kind": "control", "parent": null @@ -178,7 +178,7 @@ }, { "control_id": "Req 8.2", - "title": "Req 8.2", + "title": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "description": "Account inventory, unique account evidence", "kind": "control", "parent": null @@ -191,7 +191,7 @@ }, { "control_id": "Req 8.3", - "title": "Req 8.3", + "title": "Strong authentication for users and administrators is established and managed.", "description": "Credential management policy, rotation records", "kind": "control", "parent": null @@ -204,7 +204,7 @@ }, { "control_id": "Req 10.2", - "title": "Req 10.2", + "title": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "description": "Audit log configuration, sample log entries", "kind": "control", "parent": null @@ -223,14 +223,14 @@ }, { "control_id": "Req 10.7", - "title": "Req 10.7", + "title": "Failures of critical security control systems are detected, reported, and responded to promptly.", "description": "Monitoring configuration, alert records, detection evidence", "kind": "control", "parent": null }, { "control_id": "Req 11.3", - "title": "Req 11.3", + "title": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "description": "Pen test report with goal hijack test cases", "kind": "control", "parent": null @@ -249,7 +249,7 @@ }, { "control_id": "Req 12.3", - "title": "Req 12.3", + "title": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "description": "Risk analysis for agentic AI in PCI scope", "kind": "control", "parent": null @@ -280,7 +280,7 @@ }, { "control_id": "Req 12.6", - "title": "Req 12.6", + "title": "Security awareness education is an ongoing activity.", "description": "Training curriculum, completion records", "kind": "control", "parent": null @@ -334,6 +334,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 72 items -> 49", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Titled 17 entries that had carried only their identifier, from the published text: PCI DSS v4.0 requirement headings, transcribed from PCI SSC \"PCI DSS v4.0 SAQ D for Merchants\" — Req 1.3, Req 2.2, Req 3.4, Req 3.5, Req 4.2, Req 5.2, Req 6.3, Req 6.4, Req 7.2, Req 7.3, Req 8.2, Req 8.3, Req 10.2, Req 10.7, Req 11.3, Req 12.3, Req 12.6", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/soc2.json b/data/frameworks/soc2.json index 1a5ae87..6b2c4ac 100644 --- a/data/frameworks/soc2.json +++ b/data/frameworks/soc2.json @@ -342,7 +342,7 @@ }, { "control_id": "P7.1", - "title": "P7.1", + "title": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.", "description": "Accuracy review procedures", "kind": "control", "parent": null @@ -365,7 +365,7 @@ }, { "control_id": "PI1.3", - "title": "PI1.3", + "title": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.", "description": "Output quality controls, factual accuracy testing", "kind": "control", "parent": null @@ -381,6 +381,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 209 items -> 46", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Titled 2 entries that had carried only their identifier, from the published text: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022) — P7.1, PI1.3", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/docs/backlinks.js b/docs/backlinks.js index 04d8c80..4209206 100644 --- a/docs/backlinks.js +++ b/docs/backlinks.js @@ -34920,7 +34920,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 1.3", - "control_name": "Req 1.3", + "control_name": "Network access to and from the cardholder data environment is restricted.", "entries": [ { "id": "ASI08", @@ -34970,7 +34970,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "entries": [ { "id": "ASI01", @@ -35225,7 +35225,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.7", - "control_name": "Req 10.7", + "control_name": "Failures of critical security control systems are detected, reported, and responded to promptly.", "entries": [ { "id": "ASI08", @@ -35241,7 +35241,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "entries": [ { "id": "ASI01", @@ -35413,7 +35413,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "entries": [ { "id": "ASI01", @@ -35619,7 +35619,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.6", - "control_name": "Req 12.6", + "control_name": "Security awareness education is an ongoing activity.", "entries": [ { "id": "ASI09", @@ -35805,7 +35805,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 2.2", - "control_name": "Req 2.2", + "control_name": "System components are configured and managed securely.", "entries": [ { "id": "ASI04", @@ -35905,7 +35905,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 3.4", - "control_name": "Req 3.4", + "control_name": "Access to displays of full PAN and ability to copy PAN is restricted.", "entries": [ { "id": "ASI06", @@ -36000,7 +36000,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 3.5", - "control_name": "Req 3.5", + "control_name": "Primary account number (PAN) is secured wherever it is stored.", "entries": [ { "id": "ASI06", @@ -36104,7 +36104,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 4.2", - "control_name": "Req 4.2", + "control_name": "PAN is protected with strong cryptography during transmission.", "entries": [ { "id": "ASI07", @@ -36154,7 +36154,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 5.2", - "control_name": "Req 5.2", + "control_name": "Malicious software (malware) is prevented, or detected and addressed.", "entries": [ { "id": "ASI04", @@ -36283,7 +36283,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 6.3", - "control_name": "Req 6.3", + "control_name": "Security vulnerabilities are identified and addressed.", "entries": [ { "id": "ASI04", @@ -36342,7 +36342,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 6.4", - "control_name": "Req 6.4", + "control_name": "Public-facing web applications are protected against attacks.", "entries": [ { "id": "ASI05", @@ -36485,7 +36485,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "entries": [ { "id": "ASI02", @@ -36652,7 +36652,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 7.3", - "control_name": "Req 7.3", + "control_name": "Access to system components and data is managed via an access control system(s).", "entries": [ { "id": "ASI02", @@ -36684,7 +36684,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 8.2", - "control_name": "Req 8.2", + "control_name": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "entries": [ { "id": "ASI03", @@ -36725,7 +36725,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "PCI DSS v4.0", "control_id": "Req 8.3", - "control_name": "Req 8.3", + "control_name": "Strong authentication for users and administrators is established and managed.", "entries": [ { "id": "ASI03", @@ -38297,7 +38297,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "SOC 2", "control_id": "P7.1", - "control_name": "P7.1", + "control_name": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.", "entries": [ { "id": "ASI09", @@ -38417,7 +38417,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "SOC 2", "control_id": "PI1.3", - "control_name": "PI1.3", + "control_name": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.", "entries": [ { "id": "ASI09", diff --git a/docs/data.js b/docs/data.js index e265859..3d58538 100644 --- a/docs/data.js +++ b/docs/data.js @@ -13344,7 +13344,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Foundational", "scope": "Both", "notes": "Pen test report with goal hijack test cases", @@ -13354,7 +13354,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Audit log configuration, sample log entries", @@ -13364,7 +13364,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Foundational", "scope": "Both", "notes": "Risk analysis for agentic AI in PCI scope", @@ -14675,7 +14675,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "tier": "Foundational", "scope": "Both", "notes": "Access control matrix for agent tools, privilege review records", @@ -14685,7 +14685,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 7.3", - "control_name": "Req 7.3", + "control_name": "Access to system components and data is managed via an access control system(s).", "tier": "Foundational", "scope": "Both", "notes": "Periodic access review records", @@ -14695,7 +14695,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Tool invocation audit log", @@ -15949,7 +15949,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 8.2", - "control_name": "Req 8.2", + "control_name": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "tier": "Foundational", "scope": "Both", "notes": "Account inventory, unique account evidence", @@ -15959,7 +15959,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 8.3", - "control_name": "Req 8.3", + "control_name": "Strong authentication for users and administrators is established and managed.", "tier": "Foundational", "scope": "Both", "notes": "Credential management policy, rotation records", @@ -15969,7 +15969,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "tier": "Foundational", "scope": "Both", "notes": "Access control matrix, need-to-know justification", @@ -15979,7 +15979,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Authentication audit log", @@ -17291,7 +17291,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 6.3", - "control_name": "Req 6.3", + "control_name": "Security vulnerabilities are identified and addressed.", "tier": "Foundational", "scope": "Both", "notes": "Vulnerability scan results, patch records", @@ -17301,7 +17301,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 5.2", - "control_name": "Req 5.2", + "control_name": "Malicious software (malware) is prevented, or detected and addressed.", "tier": "Foundational", "scope": "Both", "notes": "Integrity check configuration, verification records", @@ -17311,7 +17311,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 2.2", - "control_name": "Req 2.2", + "control_name": "System components are configured and managed securely.", "tier": "Foundational", "scope": "Both", "notes": "Hardening baseline documentation", @@ -18478,7 +18478,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 6.4", - "control_name": "Req 6.4", + "control_name": "Public-facing web applications are protected against attacks.", "tier": "Hardening", "scope": "Both", "notes": "WAF configuration, protection evidence", @@ -18488,7 +18488,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Hardening", "scope": "Both", "notes": "Pen test report with code execution test cases", @@ -18498,7 +18498,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Hardening", "scope": "Both", "notes": "Code execution audit log", @@ -19660,7 +19660,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 3.4", - "control_name": "Req 3.4", + "control_name": "Access to displays of full PAN and ability to copy PAN is restricted.", "tier": "Hardening", "scope": "Both", "notes": "Memory store review, PAN protection evidence", @@ -19670,7 +19670,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 3.5", - "control_name": "Req 3.5", + "control_name": "Primary account number (PAN) is secured wherever it is stored.", "tier": "Hardening", "scope": "Both", "notes": "Encryption configuration, key management records", @@ -19690,7 +19690,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Hardening", "scope": "Both", "notes": "Pen test report", @@ -20831,7 +20831,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 4.2", - "control_name": "Req 4.2", + "control_name": "PAN is protected with strong cryptography during transmission.", "tier": "Hardening", "scope": "Both", "notes": "TLS configuration, protocol verification", @@ -20841,7 +20841,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 8.2", - "control_name": "Req 8.2", + "control_name": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "tier": "Hardening", "scope": "Both", "notes": "Certificate configuration, authentication evidence", @@ -20851,7 +20851,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Hardening", "scope": "Both", "notes": "Inter-agent communication audit log", @@ -21962,7 +21962,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.7", - "control_name": "Req 10.7", + "control_name": "Failures of critical security control systems are detected, reported, and responded to promptly.", "tier": "Foundational", "scope": "Both", "notes": "Monitoring configuration, alert records, detection evidence", @@ -21972,7 +21972,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Foundational", "scope": "Both", "notes": "Risk analysis documentation", @@ -21982,7 +21982,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 1.3", - "control_name": "Req 1.3", + "control_name": "Network access to and from the cardholder data environment is restricted.", "tier": "Foundational", "scope": "Both", "notes": "Network diagram, segmentation evidence", @@ -21992,7 +21992,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 2.2", - "control_name": "Req 2.2", + "control_name": "System components are configured and managed securely.", "tier": "Foundational", "scope": "Both", "notes": "Hardening baseline documentation", @@ -23062,7 +23062,7 @@ window.CROSSWALK_DATA = [ { "framework": "SOC 2", "control_id": "PI1.3", - "control_name": "PI1.3", + "control_name": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.", "tier": "Foundational", "scope": "Both", "notes": "Output quality controls, factual accuracy testing", @@ -23072,7 +23072,7 @@ window.CROSSWALK_DATA = [ { "framework": "SOC 2", "control_id": "P7.1", - "control_name": "P7.1", + "control_name": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.", "tier": "Foundational", "scope": "Both", "notes": "Accuracy review procedures", @@ -23082,7 +23082,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.6", - "control_name": "Req 12.6", + "control_name": "Security awareness education is an ongoing activity.", "tier": "Foundational", "scope": "Both", "notes": "Training curriculum, completion records", @@ -23102,7 +23102,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Foundational", "scope": "Both", "notes": "Interaction audit log", @@ -23112,7 +23112,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Foundational", "scope": "Both", "notes": "Risk analysis documentation", @@ -24251,7 +24251,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 7.2", - "control_name": "Req 7.2", + "control_name": "Access to system components and data is appropriately defined and assigned.", "tier": "Hardening", "scope": "Both", "notes": "Access control matrix, technical enforcement evidence", @@ -24261,7 +24261,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 10.2", - "control_name": "Req 10.2", + "control_name": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "tier": "Hardening", "scope": "Both", "notes": "Action audit log, out-of-scope alert records", @@ -24271,7 +24271,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 11.3", - "control_name": "Req 11.3", + "control_name": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "tier": "Hardening", "scope": "Both", "notes": "Pen test report with rogue agent test cases", @@ -24281,7 +24281,7 @@ window.CROSSWALK_DATA = [ { "framework": "PCI DSS v4.0", "control_id": "Req 12.3", - "control_name": "Req 12.3", + "control_name": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "tier": "Hardening", "scope": "Both", "notes": "Risk analysis documentation", diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index f236bd8..06d6880 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -8406,7 +8406,7 @@ window.CROSSWALK_FRAMEWORKS = [ "controls": [ { "control_id": "Req 1.3", - "title": "Req 1.3", + "title": "Network access to and from the cardholder data environment is restricted.", "description": "Network diagram, segmentation evidence", "kind": "control", "parent": null @@ -8419,7 +8419,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 2.2", - "title": "Req 2.2", + "title": "System components are configured and managed securely.", "description": "Hardening baseline documentation", "kind": "control", "parent": null @@ -8444,7 +8444,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 3.4", - "title": "Req 3.4", + "title": "Access to displays of full PAN and ability to copy PAN is restricted.", "description": "Memory store review, PAN protection evidence", "kind": "control", "parent": null @@ -8457,7 +8457,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 3.5", - "title": "Req 3.5", + "title": "Primary account number (PAN) is secured wherever it is stored.", "description": "Encryption configuration, key management records", "kind": "control", "parent": null @@ -8470,7 +8470,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 4.2", - "title": "Req 4.2", + "title": "PAN is protected with strong cryptography during transmission.", "description": "TLS configuration, protocol verification", "kind": "control", "parent": null @@ -8483,7 +8483,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 5.2", - "title": "Req 5.2", + "title": "Malicious software (malware) is prevented, or detected and addressed.", "description": "Integrity check configuration, verification records", "kind": "control", "parent": null @@ -8502,7 +8502,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 6.3", - "title": "Req 6.3", + "title": "Security vulnerabilities are identified and addressed.", "description": "Vulnerability scan results, patch records", "kind": "control", "parent": null @@ -8515,7 +8515,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 6.4", - "title": "Req 6.4", + "title": "Public-facing web applications are protected against attacks.", "description": "WAF configuration, protection evidence", "kind": "control", "parent": null @@ -8546,7 +8546,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 7.2", - "title": "Req 7.2", + "title": "Access to system components and data is appropriately defined and assigned.", "description": "Access control matrix for agent tools, privilege review records", "kind": "control", "parent": null @@ -8559,7 +8559,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 7.3", - "title": "Req 7.3", + "title": "Access to system components and data is managed via an access control system(s).", "description": "Periodic access review records", "kind": "control", "parent": null @@ -8572,7 +8572,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 8.2", - "title": "Req 8.2", + "title": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "description": "Account inventory, unique account evidence", "kind": "control", "parent": null @@ -8585,7 +8585,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 8.3", - "title": "Req 8.3", + "title": "Strong authentication for users and administrators is established and managed.", "description": "Credential management policy, rotation records", "kind": "control", "parent": null @@ -8598,7 +8598,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 10.2", - "title": "Req 10.2", + "title": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "description": "Audit log configuration, sample log entries", "kind": "control", "parent": null @@ -8617,14 +8617,14 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 10.7", - "title": "Req 10.7", + "title": "Failures of critical security control systems are detected, reported, and responded to promptly.", "description": "Monitoring configuration, alert records, detection evidence", "kind": "control", "parent": null }, { "control_id": "Req 11.3", - "title": "Req 11.3", + "title": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "description": "Pen test report with goal hijack test cases", "kind": "control", "parent": null @@ -8643,7 +8643,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 12.3", - "title": "Req 12.3", + "title": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "description": "Risk analysis for agentic AI in PCI scope", "kind": "control", "parent": null @@ -8674,7 +8674,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "Req 12.6", - "title": "Req 12.6", + "title": "Security awareness education is an ongoing activity.", "description": "Training curriculum, completion records", "kind": "control", "parent": null @@ -8728,6 +8728,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 72 items -> 49", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Titled 17 entries that had carried only their identifier, from the published text: PCI DSS v4.0 requirement headings, transcribed from PCI SSC \"PCI DSS v4.0 SAQ D for Merchants\" — Req 1.3, Req 2.2, Req 3.4, Req 3.5, Req 4.2, Req 5.2, Req 6.3, Req 6.4, Req 7.2, Req 7.3, Req 8.2, Req 8.3, Req 10.2, Req 10.7, Req 11.3, Req 12.3, Req 12.6", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -9075,7 +9080,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "P7.1", - "title": "P7.1", + "title": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.", "description": "Accuracy review procedures", "kind": "control", "parent": null @@ -9098,7 +9103,7 @@ window.CROSSWALK_FRAMEWORKS = [ }, { "control_id": "PI1.3", - "title": "PI1.3", + "title": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.", "description": "Output quality controls, factual accuracy testing", "kind": "control", "parent": null @@ -9114,6 +9119,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 209 items -> 46", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Titled 2 entries that had carried only their identifier, from the published text: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022) — P7.1, PI1.3", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": {