[ { "control_id": "MCP-1", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "MCP endpoints SHALL require mutual TLS (mTLS) or workload identity federation. No unauthenticated endpoints permitted.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" }, { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "MCP-2", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "All MCP message traffic SHALL be inspected at semantic level for injection patterns, malicious skill payloads, or protocol tampering.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "MCP-3", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "corrective", "shall_statement": "Unregistered MCP servers SHALL be automatically quarantined upon detection; notifications sent to orchestrator and platform owner within 5 minutes.", "evidence_type": "log_record", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 300, "unit_display": "5 minutes" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "MCP-4", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "MCP server manifests SHALL be registered with the agent orchestrator before endpoints go live; unregistered servers blocked at network layer.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "A2A-1", "domain_code": "A2A", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "Inter-agent authorization SHALL enforce least-privilege action scopes. Policy-as-code enforcement mandatory.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "A2A-2", "domain_code": "A2A", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "All inter-agent messages SHALL be cryptographically signed (ECDSA) and integrity-verified before processing. Unsigned or tampered messages SHALL be rejected and logged with SIEM alert.", "evidence_type": "signed_artifact", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "A2A-3", "domain_code": "A2A", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "A2A communication SHALL enforce per-agent-pair rate limits and anomaly detection to prevent agent loop amplification attacks. Circuit-breaker SHALL trigger on >3 anomalies per hour, freezing the amplifying agent and alerting SOC.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "SAI-1", "domain_code": "SAI", "domain_name": "Shadow AI & Continuous Visibility", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "Organizations SHALL deploy instance-aware discovery across network edges, SaaS connectors, endpoints, and browser extensions.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 8" } ] }, { "control_id": "SAI-2", "domain_code": "SAI", "domain_name": "Shadow AI & Continuous Visibility", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "DLP controls SHALL inspect all AI data egress points for sensitive data exposure.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "GDPR", "article": "Art. 32" } ] }, { "control_id": "SAI-3", "domain_code": "SAI", "domain_name": "Shadow AI & Continuous Visibility", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "Shadow AI instances SHALL be automatically classified into risk tiers (sanctioned/shadow/rogue) within 1 hour of discovery and logged to CMDB.", "evidence_type": "log_record", "time_bound_sla": { "metric": "MTTD", "threshold_seconds": 3600, "unit_display": "1 hour" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "RBI AI Governance", "article": "Pillar 5" } ] }, { "control_id": "SAI-4", "domain_code": "SAI", "domain_name": "Shadow AI & Continuous Visibility", "minimum_tier": "T1+", "requirement_type": "corrective", "shall_statement": "Rogue AI instances SHALL trigger automated quarantine and incident declaration within 15 minutes of classification; AI Security Lead paged automatically.", "evidence_type": "log_record", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 900, "unit_display": "15 minutes" }, "playbook_ref": "PB-SAI-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(b)" } ] }, { "control_id": "SAI-5", "domain_code": "SAI", "domain_name": "Shadow AI & Continuous Visibility", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "Unauthorised AI deployments classified as rogue SHALL trigger automated SOC alert with risk classification within 5 minutes of rogue designation.", "evidence_type": "log_record", "time_bound_sla": { "metric": "MTTD", "threshold_seconds": 300, "unit_display": "5 minutes" }, "playbook_ref": "PB-SAI-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(b)" } ] }, { "control_id": "MSR-1", "domain_code": "MSR", "domain_name": "Adaptive Machine-Speed Response", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Response frameworks SHALL integrate LLM-as-Judge (LLM-J) metrics for real-time behavioral validation.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": "PB-MSR-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 10" } ] }, { "control_id": "MSR-2", "domain_code": "MSR", "domain_name": "Adaptive Machine-Speed Response", "minimum_tier": "T2+", "requirement_type": "corrective", "shall_statement": "Playbooks SHALL support conditional branching based on live telemetry deltas.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": "PB-MSR-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 11" } ] }, { "control_id": "MSR-3", "domain_code": "MSR", "domain_name": "Adaptive Machine-Speed Response", "minimum_tier": "T2+", "requirement_type": "corrective", "shall_statement": "Behavioral baselines SHALL trigger automated containment for high-confidence attacks (>95%) without human delay.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": "PB-MSR-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(b)" } ] }, { "control_id": "MSR-4", "domain_code": "MSR", "domain_name": "Adaptive Machine-Speed Response", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "HITL SHALL be required for actions with blast radius >10 users, financial impact >$10K, or safety-critical involvement.", "evidence_type": "audit_trail", "time_bound_sla": null, "playbook_ref": "PB-MSR-001", "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 14" } ] }, { "control_id": "MSR-5", "domain_code": "MSR", "domain_name": "Adaptive Machine-Speed Response", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "MTTC (mean time to containment) for agentic threat events SHALL be 2 seconds or less.", "evidence_type": "log_record", "time_bound_sla": { "metric": "MTTC", "threshold_seconds": 2, "unit_display": "2 seconds" }, "playbook_ref": "PB-MSR-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 10" } ] }, { "control_id": "MEX-1", "domain_code": "MEX", "domain_name": "Model Extraction & Distillation Defenses", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Behavioral distillation detection SHALL analyze query patterns for systematic extraction.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": "PB-MEX-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "MEX-2", "domain_code": "MEX", "domain_name": "Model Extraction & Distillation Defenses", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Dynamic rate limiting SHALL use per-user/session quotas with semantic clustering.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": "PB-MEX-001", "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "MEX-3", "domain_code": "MEX", "domain_name": "Model Extraction & Distillation Defenses", "minimum_tier": "T3", "requirement_type": "preventive", "shall_statement": "Cryptographic output perturbation SHALL be applied for high-confidence suspected extraction (>85% similarity).", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "MEX-4", "domain_code": "MEX", "domain_name": "Model Extraction & Distillation Defenses", "minimum_tier": "T2+", "requirement_type": "corrective", "shall_statement": "API key revocation workflow SHALL execute within 5 minutes of confirmed extraction detection.", "evidence_type": "log_record", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 300, "unit_display": "5 minutes" }, "playbook_ref": "PB-MEX-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "BOM-1", "domain_code": "BOM", "domain_name": "AI-BOM & Supply Chain Integrity", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Every production AI system SHALL have a cryptographically signed manifest before deployment.", "evidence_type": "signed_artifact", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "BOM-2", "domain_code": "BOM", "domain_name": "AI-BOM & Supply Chain Integrity", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Training data and model weights SHALL be cryptographically hashed before ingestion.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 10" } ] }, { "control_id": "BOM-3", "domain_code": "BOM", "domain_name": "AI-BOM & Supply Chain Integrity", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "External data sources SHALL undergo source authenticity checks including vendor attestation.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "BOM-4", "domain_code": "BOM", "domain_name": "AI-BOM & Supply Chain Integrity", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Incident playbooks SHALL include supply chain rollback and vendor notification SLA (<=24h).", "evidence_type": "policy_document", "time_bound_sla": { "metric": "notification_sla", "threshold_seconds": 86400, "unit_display": "24 hours" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "BOM-5", "domain_code": "BOM", "domain_name": "AI-BOM & Supply Chain Integrity", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Runtime BOM validation SHALL occur on every model load; mismatch between loaded model and registered BOM blocks inference.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "GDPR", "article": "Art. 25" } ] }, { "control_id": "APA-1", "domain_code": "APA", "domain_name": "Agentic Permission Architecture", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "Pre-execution validation gates SHALL enforce policy checks before any consequential action.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": "PB-APA-001", "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 9" } ] }, { "control_id": "APA-2", "domain_code": "APA", "domain_name": "Agentic Permission Architecture", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "Agents SHALL operate under least-privilege, task-scoped permissions with auto-expiration (<=15 min).", "evidence_type": "configuration_attestation", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 900, "unit_display": "15 minutes" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "GDPR", "article": "Art. 25" } ] }, { "control_id": "APA-3", "domain_code": "APA", "domain_name": "Agentic Permission Architecture", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "HITL SHALL be required for: data export >1K records, payment initiation, production delete, PII access, safety override.", "evidence_type": "audit_trail", "time_bound_sla": null, "playbook_ref": "PB-APA-001", "regulatory_mapping": [ { "regulation": "GDPR", "article": "Art. 22" } ] }, { "control_id": "APA-4", "domain_code": "APA", "domain_name": "Agentic Permission Architecture", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "All permission grants, denials, and overrides SHALL be logged with immutable timestamps and cryptographic signing.", "evidence_type": "audit_trail", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "MAS FEAT", "article": "Accountability" } ] }, { "control_id": "APA-5", "domain_code": "APA", "domain_name": "Agentic Permission Architecture", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "Tool use SHALL require a pre-execution approval gate, separate from the general APA-1 action validation gate, specific to tool invocation.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "REG-1", "domain_code": "REG", "domain_name": "Regulatory & Compliance Operations", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "Incident playbooks SHALL include a regulatory notification decision tree.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 6" } ] }, { "control_id": "REG-2", "domain_code": "REG", "domain_name": "Regulatory & Compliance Operations", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "Legal and Compliance SHALL be embedded as Consulted/Accountable roles in initial triage within 1 hour.", "evidence_type": "audit_trail", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 3600, "unit_display": "1 hour" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 6" } ] }, { "control_id": "REG-3", "domain_code": "REG", "domain_name": "Regulatory & Compliance Operations", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Organizations SHALL maintain incident-to-regulation mapping tables reviewed quarterly.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 6" } ] }, { "control_id": "REG-4", "domain_code": "REG", "domain_name": "Regulatory & Compliance Operations", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Audit-ready documentation SHALL be preserved with cryptographic integrity for minimum 3 years.", "evidence_type": "audit_trail", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 6" } ] }, { "control_id": "PHY-1", "domain_code": "PHY", "domain_name": "Physical AI & Safety Integration", "minimum_tier": "T3", "requirement_type": "governance", "shall_statement": "Separate incident playbooks SHALL exist for physical-harm scenarios.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(c)" } ] }, { "control_id": "PHY-2", "domain_code": "PHY", "domain_name": "Physical AI & Safety Integration", "minimum_tier": "T3", "requirement_type": "governance", "shall_statement": "Safety and cybersecurity teams SHALL operate in integrated incident command structures.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": "PB-PHY-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(c)" } ] }, { "control_id": "PHY-3", "domain_code": "PHY", "domain_name": "Physical AI & Safety Integration", "minimum_tier": "T3", "requirement_type": "preventive", "shall_statement": "Systems SHALL mandate fail-safe fallback modes upon cyber anomaly detection.", "evidence_type": "test_report", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 2, "unit_display": "2 seconds" }, "playbook_ref": "PB-PHY-001", "regulatory_mapping": [ { "regulation": "IEC 62443", "article": "FR 7" } ] }, { "control_id": "PHY-4", "domain_code": "PHY", "domain_name": "Physical AI & Safety Integration", "minimum_tier": "T3", "requirement_type": "preventive", "shall_statement": "Hardware-rooted trust SHALL default to human oversight if cryptographic attestation fails.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "IEC 62443", "article": "FR 1" } ] }, { "control_id": "MLC-1", "domain_code": "MLC", "domain_name": "Model Lifecycle Security", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Every production model SHALL have a unique immutable identifier and cryptographic signature.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 8" } ] }, { "control_id": "MLC-2", "domain_code": "MLC", "domain_name": "Model Lifecycle Security", "minimum_tier": "T3", "requirement_type": "corrective", "shall_statement": "Automated rollback capability SHALL execute within 15 minutes of compromise detection.", "evidence_type": "log_record", "time_bound_sla": { "metric": "rollback_sla", "threshold_seconds": 900, "unit_display": "15 minutes" }, "playbook_ref": "PB-MLC-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 11" } ] }, { "control_id": "MLC-3", "domain_code": "MLC", "domain_name": "Model Lifecycle Security", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Recovery playbooks SHALL include rollback validation gates confirming integrity, performance, and adversarial robustness.", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "FDA SaMD", "article": "TPLC" } ] }, { "control_id": "MLC-4", "domain_code": "MLC", "domain_name": "Model Lifecycle Security", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Model version changes SHALL be logged in immutable audit trail with dual approval.", "evidence_type": "audit_trail", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "MLC-5", "domain_code": "MLC", "domain_name": "Model Lifecycle Security", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Drift detection thresholds SHALL trigger a dual-approval retraining workflow; retraining without dual approval is blocked.", "evidence_type": "audit_trail", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "RBI AI Governance", "article": "Pillar 5" } ] }, { "control_id": "ZTA-1", "domain_code": "ZTA", "domain_name": "Zero Trust Architecture for AI (ZTAI)", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "AI infrastructure SHALL adopt explicit zero-trust design with documented architecture reviewed at least annually.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" } ] }, { "control_id": "ZTA-2", "domain_code": "ZTA", "domain_name": "Zero Trust Architecture for AI (ZTAI)", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Continuous verification SHALL require re-authentication every 15 minutes or per high-risk action; no persistent sessions permitted.", "evidence_type": "configuration_attestation", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 900, "unit_display": "15 minutes" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "HIPAA", "article": "Security Rule" } ] }, { "control_id": "ZTA-3", "domain_code": "ZTA", "domain_name": "Zero Trust Architecture for AI (ZTAI)", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Micro-segmentation SHALL isolate inference, vector storage, and orchestration layers with explicit allow-lists enforced in policy-as-code.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "ZTA-4", "domain_code": "ZTA", "domain_name": "Zero Trust Architecture for AI (ZTAI)", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Runtime least-privilege enforcement SHALL include per-request authorization for tool execution with full audit trail.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "REL-1", "domain_code": "REL", "domain_name": "Detection Reliability", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Auto-containment SHALL require >=3 ensemble signals, agreement >=0.7", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU", "article": "AI Act Art. 15 (accuracy, robustness, cybersecurity)" }, { "regulation": "DORA", "article": "Art. 10 (detection capability)" } ] }, { "control_id": "REL-2", "domain_code": "REL", "domain_name": "Detection Reliability", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Confidence scores SHALL decay 10% per consecutive similar alert", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 10 (detection quality)" } ] }, { "control_id": "REL-3", "domain_code": "REL", "domain_name": "Detection Reliability", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Circuit-breaker SHALL disable automation after 3 FP within 1h", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 10 (detection reliability)" } ] }, { "control_id": "APT-1", "domain_code": "APT", "domain_name": "Agentic Threat Detection", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Prompt injection detection >=90% across all channels", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": "PB-APT-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(b) (incident handling)" }, { "regulation": "NCSC", "article": "AI Security Principle 2" } ] }, { "control_id": "APT-2", "domain_code": "APT", "domain_name": "Agentic Threat Detection", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "Tool abuse prevention via pre-execution gate on every tool call", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": "PB-APT-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(b)" } ] }, { "control_id": "APT-3", "domain_code": "APT", "domain_name": "Agentic Threat Detection", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Memory poisoning detection with automated quarantine <=60s", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": "PB-APT-001", "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(b)" } ] }, { "control_id": "SEV-CLS", "domain_code": "SEV", "domain_name": "Severity Classification", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "Deterministic severity scoring algorithm implemented and versioned", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 10 (incident classification)" }, { "regulation": "NIS2", "article": "Art. 23 (significant incident determination)" } ] }, { "control_id": "SEV-RPT", "domain_code": "SEV", "domain_name": "Severity Classification", "minimum_tier": "T1+", "requirement_type": "governance", "shall_statement": "Reportability thresholds evaluated deterministically", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 19 (major incident reporting)" }, { "regulation": "GDPR", "article": "Art. 33 (breach notification)" }, { "regulation": "NIS2", "article": "Art. 23 (incident reporting)" } ] }, { "control_id": "CSS-1", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "Harmful content detection pipeline SHALL achieve >99.9% block rate for CSAM (zero-tolerance); alert and log all blocked outputs.", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 5" } ] }, { "control_id": "CSS-2", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Maintain a sufficiently detailed summary of content used to train the GPAI model, published per EU AI Act Art. 53(1)(c) template requirements. Implement output filtering to detect verbatim or near-ver", "evidence_type": "policy_document", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 53(1)(c)" } ] }, { "control_id": "CSS-3", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "AI-generated synthetic media SHALL carry machine-readable provenance marker (C2PA recommended) and human-facing disclosure label.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 50" } ] }, { "control_id": "CSS-4", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Design review SHALL confirm the AI system does not employ subliminal techniques (content presented below the threshold of conscious perception) or techniques designed to exploit known vulnerabilities of specific groups to materially distort behaviour.", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 5(1)(b)" } ] }, { "control_id": "CSS-5", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "Monthly statistical analysis of AI outputs across protected demographic groups", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 10(2)(f)" } ] }, { "control_id": "CSS-6", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Conduct a quarterly Demographic Impact Assessment (DIA) for all high-risk AI systems. The DIA", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 9(7)" } ] }, { "control_id": "CSS-7", "domain_code": "CSS", "domain_name": "Content Safety", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "Tier 1 + documented vulnerable population impact assessment, conducted alongside CSS-6's DIA, specifically evaluating outcomes for identified vulnerable groups rather than aggregate demographic catego", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 5(1)(b)" } ] }, { "control_id": "FL-1", "domain_code": "FL", "domain_name": "Federated Learning Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Federated clients authenticated via mutual TLS with client-specific certificates; unregistered/revoked clients rejected.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "GDPR", "article": "Art. 25" } ] }, { "control_id": "FL-2", "domain_code": "FL", "domain_name": "Federated Learning Security", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Byzantine-robust aggregation (FedAvg with clipping; Krum/Bulyan for high-threat); gradients >3 sigma from epoch mean flagged; clients with anomaly rate >5% rejected.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" }, { "regulation": "GDPR", "article": "Art. 32" } ] }, { "control_id": "FL-3", "domain_code": "FL", "domain_name": "Federated Learning Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Differential privacy (DP-SGD) applied; epsilon <=1 for high-sensitivity data, epsilon <=8 maximum ceiling for lower-sensitivity data; epsilon=10 not recommended for production.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "India DPDP", "article": "Sec. 4" } ] }, { "control_id": "FL-4", "domain_code": "FL", "domain_name": "Federated Learning Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Global model signed with ECDSA (or CRYSTALS-Dilithium per PQC-1) after each aggregation round; signed checkpoint stored in AI-BOM registry.", "evidence_type": "signed_artifact", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "GDPR", "article": "Art. 32" } ] }, { "control_id": "MMD-1", "domain_code": "MMD", "domain_name": "Model Merge Defense", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Pre-merge source model vetting: AI-BOM provenance, absence of known malicious fine-tuning datasets, training data manifest completeness verified; incomplete provenance rejected.", "evidence_type": "signed_artifact", "time_bound_sla": null, "playbook_ref": "PB-MMD-001", "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "MMD-2", "domain_code": "MMD", "domain_name": "Model Merge Defense", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Post-merge backdoor scan (Neural Cleanse or ABS); semantic consistency testing across 500+ prompt templates; embedding space anomaly analysis.", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": "PB-MMD-001", "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "MMD-3", "domain_code": "MMD", "domain_name": "Model Merge Defense", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Model merge operations performed in isolated compute environment with no internet access; all artifacts hash-verified entering and leaving.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "QBS-1", "domain_code": "QBS", "domain_name": "Quantization Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Pre-quantization behavioural baseline established on 1,000+ representative inputs; stored as signed artefact in AI-BOM.", "evidence_type": "signed_artifact", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "QBS-2", "domain_code": "QBS", "domain_name": "Quantization Security", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "Post-quantization differential analysis against baseline; divergence >5% flagged; divergence >10% rejects model.", "evidence_type": "test_report", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "QBS-3", "domain_code": "QBS", "domain_name": "Quantization Security", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "Only trusted, audited quantization toolchains used (ONNX Runtime, TensorRT, PyTorch quantization); toolchain integrity hash-verified; third-party pre-quantized models screened via QBS-1/QBS-2.", "evidence_type": "signed_artifact", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 28" } ] }, { "control_id": "HAL-1", "domain_code": "HAL", "domain_name": "Hallucination Detection", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "RAG factual grounding verification: all factual claims grounded in retrieved source documents; citation extraction and source verification; ungrounded claims flagged for human review.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 13" } ] }, { "control_id": "HAL-2", "domain_code": "HAL", "domain_name": "Hallucination Detection", "minimum_tier": "T2+", "requirement_type": "governance", "shall_statement": "Model confidence scoring implemented; outputs below 0.7 confidence for consequential decisions require human review before action; uncertainty surfaced to end users.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "HAL-3", "domain_code": "HAL", "domain_name": "Hallucination Detection", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "For high-stakes outputs (medical, legal, financial, safety-critical): parallel inference with second model or rule-based verifier; inconsistencies >10% divergence flagged for human review.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "HAL-4", "domain_code": "HAL", "domain_name": "Hallucination Detection", "minimum_tier": "T1+", "requirement_type": "detective", "shall_statement": "Hallucination rate tracked via human correction feedback loop; alert at >3% of evaluated outputs; escalate to AI-IRF corrective action at >5% (trust_erosion_rate threshold).", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "RBI AI Governance", "article": "Pillar 3" } ] }, { "control_id": "HAL-5", "domain_code": "HAL", "domain_name": "Hallucination Detection", "minimum_tier": "T2+", "requirement_type": "preventive", "shall_statement": "For regulated domains (medical diagnosis, legal analysis, financial advice): external fact-checking API or knowledge graph verification integrated for domain-specific claims.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "FDA SaMD", "article": "GMLP" } ] }, { "control_id": "PQC-1", "domain_code": "PQC", "domain_name": "Post-Quantum Cryptography", "minimum_tier": "T3+", "requirement_type": "preventive", "shall_statement": "PQC readiness assessment SHALL be completed covering BOM-4, MCP-1, A2A-2, and REG-4 cryptographic use cases. Migration to CRYSTALS-Dilithium (BOM-4, A2A-2) at Tier 3 from Q1 2027; hybrid Kyber-1024 (MCP-1) from Q3 2027; hybrid ECDSA+Dilithium (REG-4, all tiers) from Q3 2027.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" }, { "regulation": "DORA", "article": "Art. 9" } ] } ]