GAISSF to OWASP LLM Top 10 Crosswalk

Document control and source baseline

1. Executive summary

This crosswalk evaluates all 59 GAISSF v1.0 controls against the ten OWASP Top 10 for LLM Applications 2025 risk categories. It contains 59 forward mapping records and a complete ten-risk reverse coverage register.

GAISSF supplies a broader auditable control architecture across model integrity, runtime security, agents, supply chain, content safety, governance, societal harm, regulatory alignment, and physical AI. OWASP supplies a concise vulnerability-oriented prioritization resource. The two artefacts are complementary but not equivalent.

2. Purpose, scope and intended use

• Support AI application threat modelling and control selection.

• Identify reusable GAISSF evidence for OWASP-oriented reviews.

• Expose residual implementation and testing gaps.

• Support assessment planning without claiming OWASP certification or vulnerability elimination.

3. Mapping methodology

Mappings were made at GAISSF control level to OWASP risk-category level. Decisions considered shared attack surface, preventive and detective outcomes, lifecycle position, evidence expectations, and residual application-specific work. Similar terminology alone was not sufficient.

4. OWASP 2025 risk inventory

5. Reverse coverage register

6. Risk-by-risk analysis

LLM01:2025 Prompt Injection

Crafted direct or indirect inputs can alter model behavior, bypass instructions, expose data, or trigger unauthorized actions.

Primary GAISSF controls: D1-CTL-03, D1-CTL-05, D1-CTL-06, D1-CTL-08, D2-CTL-01, D2-CTL-02, D2-CTL-03, D2-CTL-04, D2-CTL-05, D2-CTL-06, D6-CTL-02, D6-CTL-03

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM02:2025 Sensitive Information Disclosure

Models and applications can reveal confidential, personal, proprietary, credential, or otherwise sensitive information.

Primary GAISSF controls: D5-CTL-05

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM03:2025 Supply Chain

Compromised models, datasets, components, services, dependencies, or provenance can undermine application security and integrity.

Primary GAISSF controls: D4-CTL-01, D4-CTL-02, D4-CTL-03, D4-CTL-04, D4-CTL-05, D4-CTL-06, D4-CTL-07, D6-CTL-06, D8-CTL-02

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM04:2025 Data and Model Poisoning

Manipulated pre-training, fine-tuning, retrieval, embedding, or model data can introduce backdoors, bias, unsafe behavior, or integrity failures.

Primary GAISSF controls: D1-CTL-01, D1-CTL-04, D1-CTL-07, D1-CTL-09, D5-CTL-01, D5-CTL-02, D5-CTL-03, D5-CTL-04, D5-CTL-06, D8-CTL-03, D9-CTL-07

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM05:2025 Improper Output Handling

Insufficient validation, sanitization, encoding, or contextual handling of model outputs can create downstream exploits.

Primary GAISSF controls:

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM06:2025 Excessive Agency

Excessive functionality, permissions, autonomy, or insufficient human approval can allow harmful or unintended actions.

Primary GAISSF controls: D3-CTL-01, D3-CTL-02, D3-CTL-03, D3-CTL-04, D3-CTL-05, D3-CTL-06, D3-CTL-07, D6-CTL-01, D9-CTL-02

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM07:2025 System Prompt Leakage

System prompts or embedded instructions may be exposed and reveal sensitive logic, controls, or operational context.

Primary GAISSF controls:

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM08:2025 Vector and Embedding Weaknesses

Weaknesses in retrieval, vector stores, embeddings, access controls, segmentation, and data provenance can cause disclosure or manipulation.

Primary GAISSF controls: D7-CTL-H01

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM09:2025 Misinformation

Incorrect, fabricated, misleading, or insufficiently verified model outputs can undermine decisions and safety.

Primary GAISSF controls: D7-CTL-H03, D7-CTL-H04

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

LLM10:2025 Unbounded Consumption

Uncontrolled model, token, tool, compute, or service consumption can cause denial of service, cost escalation, degradation, or theft-related abuse.

Primary GAISSF controls: D1-CTL-02, D6-CTL-04, D6-CTL-07, D7-CTL-H02

Assessment conclusion: Indirectly Supported; confidence Low.

Residual gap: OWASP risk exposure depends on architecture, implementation, threat context, testing depth, and operational effectiveness; documentary mapping alone cannot demonstrate mitigation.

7. Evidence reuse guidance

• Threat models and abuse-case registers

• Prompt-injection and adversarial test results

• Data classification and disclosure-control records

• Supplier, model, dataset, and component provenance records

• Poisoning and integrity validation reports

• Output-validation and downstream-execution controls

• Agent tool inventories, permission models, and human-approval records

• RAG, vector-store, embedding, and tenant-isolation tests

• Accuracy, grounding, provenance, and human-review evidence

• Rate-limit, quota, cost-monitoring, availability, and abuse-detection records

8. Limitations

• Mapping is not OWASP endorsement, certification, equivalence, or proof of secure implementation.

• OWASP Top 10 is a prioritized risk-awareness resource, not a complete security standard or exhaustive threat catalogue.

• GAISSF controls can support multiple risks; actual mitigation depends on architecture, implementation, testing, monitoring, and evidence.

• The crosswalk does not replace application threat modelling, penetration testing, red teaming, or secure software engineering.

• Revalidation is required when GAISSF or OWASP source baselines change.

9. Notably absent

• No OWASP certification or endorsement mechanism for this crosswalk was identified.

• No basis exists for claiming that documentary mapping proves a vulnerability is absent.

• No basis exists for treating the Top 10 as an exhaustive security standard.

• No universal compliance percentage, safe harbour, or automatic regulatory conclusion is asserted.

Annex A - Complete GAISSF-to-OWASP mapping register

Annex B - Change and verification record