{ "document": { "id": "GAISSF-CRO-023", "title": "GAISSF™–NIST Cybersecurity Framework 2.0 Mapping", "version": "1.0", "status": "Draft for Publication", "publisher": "ODA3 Institute", "legal_entity": "ODA3 Pvt Ltd", "candidate_date": "2026-06-29", "updated": "2026-10-05", "classification": "Informative public crosswalk" }, "source_baseline": { "gaissf": { "framework_standard": "GAISSF-NOR-001 v1.0; published 2026-07-01; updated 2026-10-04", "control_catalogue": "GAISSF-NOR-004 v1.0; published 2026-07-01; updated 2026-10-04", "applicable_control_baseline": "52 controls in D1-D8 + D9 where Physical AI or cyber-physical actuation is in scope" }, "nist": { "title": "The NIST Cybersecurity Framework (CSF) 2.0", "identifier": "NIST CSWP 29", "publication_date": "2024-02-26", "doi": "https://doi.org/10.6028/NIST.CSWP.29", "verified": "2026-10-05" }, "scope_note": "CSF Core subcategories are the primary mapping targets. CSF Implementation Examples are informative, non-exhaustive, dynamically maintained resources and are not treated as required actions." }, "controlled_vocabulary": { "relationship": { "SP": "Strong partial", "P": "Partial", "S": "Supporting", "N": "No material mapping", "O": "Outside scope", "U": "Unable to determine" }, "coverage_status": [ "Addressed", "Substantially Addressed", "Partially Addressed", "Indirectly Supported", "Not Addressed", "Outside Scope", "Unable to Determine" ], "confidence": [ "High", "Medium-High", "Medium", "Low", "Not Rated" ] }, "limitations": [ "Mapping does not establish NIST endorsement, certification, equivalence, evidence sufficiency, operating effectiveness, automatic conformance, or regulatory compliance.", "NIST CSF 2.0 is organization-wide and technology-neutral; GAISSF is AI-system-focused.", "The crosswalk does not replace CSF Organizational Profile development, independent assessment, or verification of implementation and operating effectiveness.", "D9 mappings are additional/conditional and apply only where Physical AI or cyber-physical actuation is in scope.", "Where D9 applies, PAI-SF™ v1.0 may be used alongside GAISSF; CSX-PAISF-004 is mapping only and does not establish equivalence, evidence sufficiency, or automatic conformance." ], "statistics": { "gaissf_controls": 59, "nist_subcategories": 106, "mapping_records": 182, "reverse_records": 106 }, "gaissf_controls": [ { "id": "D1-CTL-01", "title": "Dataset Provenance & Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-02", "title": "Model Extraction Resistance", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-03", "title": "Behavioral Drift Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-04", "title": "Federated Learning Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-05", "title": "Embedding Space Robustness", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-06", "title": "Post-Quantum Model Signing & Crypto Hardening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-07", "title": "Lora/Adapter Integrity Verification", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-08", "title": "Model Merge Attack Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D1-CTL-09", "title": "Quantization Backdoor Screening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D2-CTL-01", "title": "Direct Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D2-CTL-02", "title": "Indirect Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D2-CTL-03", "title": "Jailbreak Resistance Testing", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D2-CTL-04", "title": "Multi-Modal Injection Defense", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D2-CTL-05", "title": "Function Call/Tool Call Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D2-CTL-06", "title": "Cross-Context Hijacking Mitigation", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-01", "title": "Least Agency Enforcement", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-02", "title": "Inter-Agent Communication Security", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-03", "title": "Agentic Prompt Chaining Detection", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-04", "title": "Embodied Ai Safety Controls", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-05", "title": "Multi-Agent Trust Chain Attestation", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-06", "title": "Persistent Memory Exfiltration Prevention", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D3-CTL-07", "title": "Secure Memory Lifecycle Management", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-01", "title": "Ai Bill Of Materials (Ai Bom) Maintenance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-02", "title": "Model File & Artifact Scanning", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-03", "title": "Model Hub & Registry Vetting", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-04", "title": "Mcp Server Behavioral Monitoring", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-05", "title": "Third-Party Ai Api Security Assessment", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-06", "title": "Shadow Ai Discovery & Governance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D4-CTL-07", "title": "Ai Software Composition Analysis (Sca)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D5-CTL-01", "title": "Harmful Content Blocking", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D5-CTL-02", "title": "Pii Leakage Prevention", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D5-CTL-03", "title": "Copyright Detection", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D5-CTL-04", "title": "Ai Watermarking Robustness", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D5-CTL-05", "title": "Privacy-By-Design Verification", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D5-CTL-06", "title": "Privacy-Preserving Ml Validation", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-01", "title": "Human-In-The-Loop For High-Risk Actions", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-02", "title": "Audit Trail Completeness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-03", "title": "Ai Model Card Completeness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-04", "title": "Ai Incident Response Readiness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-05", "title": "Model Deprecation & Decommissioning", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-06", "title": "Third-Party Ai Vendor Governance", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D6-CTL-07", "title": "Ai Resilience & Business Continuity", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D7-CTL-H01", "title": "Ai-Generated Phishing Simulation", "domain": "D7: HUMAN & SOCIETAL HARMS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D7-CTL-H02", "title": "Deepfake Detection Training", "domain": "D7: HUMAN & SOCIETAL HARMS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D7-CTL-H03", "title": "Out-Of-Band Authentication", "domain": "D7: HUMAN & SOCIETAL HARMS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D7-CTL-H04", "title": "Ai Social Engineering Ir", "domain": "D7: HUMAN & SOCIETAL HARMS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D7-CTL-H05", "title": "Ai-Enhanced External Attack Defense", "domain": "D7: HUMAN & SOCIETAL HARMS", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D8-CTL-01", "title": "Eu Ai Act Risk Tier Mapping", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D8-CTL-02", "title": "Iso 42001 Gap Analysis", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D8-CTL-03", "title": "Gpai Technical Documentation Verification", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D8-CTL-04", "title": "Dora Ict Incident Reporting (Financial Sector)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D8-CTL-05", "title": "Nist Sp 800-218A Compliance Check", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "baseline_scope": "Canonical D1-D8 baseline", "applicability": "Included in Applicable-Control Baseline." }, { "id": "D9-CTL-01", "title": "Physical Harm Boundary Enforcement", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." }, { "id": "D9-CTL-02", "title": "Safe State And Graceful Degradation", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." }, { "id": "D9-CTL-03", "title": "Human Override And Emergency Stop", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." }, { "id": "D9-CTL-04", "title": "Cyber-Physical Attack Detection", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." }, { "id": "D9-CTL-05", "title": "Physical Environment Integrity Monitoring", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." }, { "id": "D9-CTL-06", "title": "Actuator Command Verification", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." }, { "id": "D9-CTL-07", "title": "Physical Incident Evidence Preservation", "domain": "D9: PHYSICAL AI SAFETY", "baseline_scope": "Additional / conditional", "applicability": "Determine in Applicable-Control Baseline; required where Physical AI/cyber-physical actuation is in scope." } ], "nist_csf_core_subcategories": [ { "id": "GV.OC-01", "function": "GOVERN", "category": "Organizational Context", "text": "The organizational mission is understood and informs cybersecurity risk management" }, { "id": "GV.OC-02", "function": "GOVERN", "category": "Organizational Context", "text": "Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered" }, { "id": "GV.OC-03", "function": "GOVERN", "category": "Organizational Context", "text": "Legal, regulatory, and contractual requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed" }, { "id": "GV.OC-04", "function": "GOVERN", "category": "Organizational Context", "text": "Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated" }, { "id": "GV.OC-05", "function": "GOVERN", "category": "Organizational Context", "text": "Outcomes, capabilities, and services that the organization depends on are understood and communicated" }, { "id": "GV.RM-01", "function": "GOVERN", "category": "Risk Management Strategy", "text": "Risk management objectives are established and agreed to by organizational stakeholders" }, { "id": "GV.RM-02", "function": "GOVERN", "category": "Risk Management Strategy", "text": "Risk appetite and risk tolerance statements are established, communicated, and maintained" }, { "id": "GV.RM-03", "function": "GOVERN", "category": "Risk Management Strategy", "text": "Cybersecurity risk management activities and outcomes are included in enterprise risk management processes" }, { "id": "GV.RM-04", "function": "GOVERN", "category": "Risk Management Strategy", "text": "Strategic direction that describes appropriate risk response options is established and communicated" }, { "id": "GV.RM-05", "function": "GOVERN", "category": "Risk Management Strategy", "text": "Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties" }, { "id": "GV.RM-06", "function": "GOVERN", "category": "Risk Management Strategy", "text": "A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated" }, { "id": "GV.RM-07", "function": "GOVERN", "category": "Risk Management Strategy", "text": "Strategic opportunities, or positive risks, are characterized and included in organizational cybersecurity risk discussions" }, { "id": "GV.RR-01", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "text": "Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving" }, { "id": "GV.RR-02", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "text": "Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced" }, { "id": "GV.RR-03", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "text": "Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies" }, { "id": "GV.RR-04", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "text": "Cybersecurity is included in human resources practices" }, { "id": "GV.PO-01", "function": "GOVERN", "category": "Policy", "text": "Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced" }, { "id": "GV.PO-02", "function": "GOVERN", "category": "Policy", "text": "Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission" }, { "id": "GV.OV-01", "function": "GOVERN", "category": "Oversight", "text": "Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction" }, { "id": "GV.OV-02", "function": "GOVERN", "category": "Oversight", "text": "The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks" }, { "id": "GV.OV-03", "function": "GOVERN", "category": "Oversight", "text": "Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed" }, { "id": "GV.SC-01", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders" }, { "id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally" }, { "id": "GV.SC-03", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes" }, { "id": "GV.SC-04", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Suppliers are known and prioritized by criticality" }, { "id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties" }, { "id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships" }, { "id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship" }, { "id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities" }, { "id": "GV.SC-09", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and performance is monitored throughout the technology product and service life cycle" }, { "id": "GV.SC-10", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "text": "Cybersecurity supply chain risk management plans include provisions for activities after the conclusion of a partnership or service agreement" }, { "id": "ID.AM-01", "function": "IDENTIFY", "category": "Asset Management", "text": "Inventories of hardware managed by the organization are maintained" }, { "id": "ID.AM-02", "function": "IDENTIFY", "category": "Asset Management", "text": "Inventories of software, services, and systems managed by the organization are maintained" }, { "id": "ID.AM-03", "function": "IDENTIFY", "category": "Asset Management", "text": "Representations of the organization's authorized network communication and internal and external network data flows are maintained" }, { "id": "ID.AM-04", "function": "IDENTIFY", "category": "Asset Management", "text": "Inventories of services provided by suppliers are maintained" }, { "id": "ID.AM-05", "function": "IDENTIFY", "category": "Asset Management", "text": "Assets are prioritized based on classification, criticality, resources, and impact on the mission" }, { "id": "ID.AM-07", "function": "IDENTIFY", "category": "Asset Management", "text": "Inventories of data and corresponding metadata for designated data types are maintained" }, { "id": "ID.AM-08", "function": "IDENTIFY", "category": "Asset Management", "text": "Systems, hardware, software, services, and data are managed throughout their life cycles" }, { "id": "ID.RA-01", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Vulnerabilities in assets are identified, validated, and recorded" }, { "id": "ID.RA-02", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Cyber threat intelligence is received from information sharing forums and sources" }, { "id": "ID.RA-03", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Internal and external threats to the organization are identified and recorded" }, { "id": "ID.RA-04", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded" }, { "id": "ID.RA-05", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization" }, { "id": "ID.RA-06", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Risk responses are chosen, prioritized, planned, tracked, and communicated" }, { "id": "ID.RA-07", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked" }, { "id": "ID.RA-08", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Processes for receiving, analyzing, and responding to vulnerability disclosures are established" }, { "id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "text": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use" }, { "id": "ID.RA-10", "function": "IDENTIFY", "category": "Risk Assessment", "text": "Critical suppliers are assessed prior to acquisition" }, { "id": "ID.IM-01", "function": "IDENTIFY", "category": "Improvement", "text": "Improvements are identified from evaluations" }, { "id": "ID.IM-02", "function": "IDENTIFY", "category": "Improvement", "text": "Improvements are identified from security tests and exercises, including those coordinated with suppliers and relevant third parties" }, { "id": "ID.IM-03", "function": "IDENTIFY", "category": "Improvement", "text": "Improvements are identified from execution of operational processes, procedures, and activities" }, { "id": "ID.IM-04", "function": "IDENTIFY", "category": "Improvement", "text": "Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved" }, { "id": "PR.AA-01", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "text": "Identities and credentials for authorized users, services, and hardware are managed by the organization" }, { "id": "PR.AA-02", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "text": "Identities are proofed and bound to credentials based on the context of interactions" }, { "id": "PR.AA-03", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "text": "Users, services, and hardware are authenticated" }, { "id": "PR.AA-04", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "text": "Identity assertions are protected, conveyed, and verified" }, { "id": "PR.AA-05", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "text": "Access permissions, entitlements, and authorizations are defined in policy, managed, enforced, and reviewed, incorporating least privilege and separation of duties" }, { "id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "text": "Physical access to assets is managed, monitored, and enforced commensurate with risk" }, { "id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "text": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind" }, { "id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "text": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind" }, { "id": "PR.DS-01", "function": "PROTECT", "category": "Data Security", "text": "The confidentiality, integrity, and availability of data at rest are protected" }, { "id": "PR.DS-02", "function": "PROTECT", "category": "Data Security", "text": "The confidentiality, integrity, and availability of data in transit are protected" }, { "id": "PR.DS-10", "function": "PROTECT", "category": "Data Security", "text": "The confidentiality, integrity, and availability of data in use are protected" }, { "id": "PR.DS-11", "function": "PROTECT", "category": "Data Security", "text": "Backups of data are created, protected, maintained, and tested" }, { "id": "PR.PS-01", "function": "PROTECT", "category": "Platform Security", "text": "Configuration management practices are established and applied" }, { "id": "PR.PS-02", "function": "PROTECT", "category": "Platform Security", "text": "Software is maintained, replaced, and removed commensurate with risk" }, { "id": "PR.PS-03", "function": "PROTECT", "category": "Platform Security", "text": "Hardware is maintained, replaced, and removed commensurate with risk" }, { "id": "PR.PS-04", "function": "PROTECT", "category": "Platform Security", "text": "Log records are generated and made available for continuous monitoring" }, { "id": "PR.PS-05", "function": "PROTECT", "category": "Platform Security", "text": "Installation and execution of unauthorized software are prevented" }, { "id": "PR.PS-06", "function": "PROTECT", "category": "Platform Security", "text": "Secure software development practices are integrated, and performance is monitored throughout the software development life cycle" }, { "id": "PR.IR-01", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "text": "Networks and environments are protected from unauthorized logical access and usage" }, { "id": "PR.IR-02", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "text": "Technology assets are protected from environmental threats" }, { "id": "PR.IR-03", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "text": "Mechanisms are implemented to achieve resilience requirements in normal and adverse situations" }, { "id": "PR.IR-04", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "text": "Adequate resource capacity to ensure availability is maintained" }, { "id": "DE.CM-01", "function": "DETECT", "category": "Continuous Monitoring", "text": "Networks and network services are monitored to find potentially adverse events" }, { "id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "text": "The physical environment is monitored to find potentially adverse events" }, { "id": "DE.CM-03", "function": "DETECT", "category": "Continuous Monitoring", "text": "Personnel activity and technology usage are monitored to find potentially adverse events" }, { "id": "DE.CM-06", "function": "DETECT", "category": "Continuous Monitoring", "text": "External service provider activities and services are monitored to find potentially adverse events" }, { "id": "DE.CM-09", "function": "DETECT", "category": "Continuous Monitoring", "text": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events" }, { "id": "DE.AE-02", "function": "DETECT", "category": "Adverse Event Analysis", "text": "Potentially adverse events are analyzed to better understand associated activities" }, { "id": "DE.AE-03", "function": "DETECT", "category": "Adverse Event Analysis", "text": "Information is correlated from multiple sources" }, { "id": "DE.AE-04", "function": "DETECT", "category": "Adverse Event Analysis", "text": "The estimated impact and scope of adverse events are understood" }, { "id": "DE.AE-06", "function": "DETECT", "category": "Adverse Event Analysis", "text": "Information on adverse events is provided to authorized staff and tools" }, { "id": "DE.AE-07", "function": "DETECT", "category": "Adverse Event Analysis", "text": "Cyber threat intelligence and other contextual information are integrated into analysis" }, { "id": "DE.AE-08", "function": "DETECT", "category": "Adverse Event Analysis", "text": "Incidents are declared when adverse events meet defined incident criteria" }, { "id": "RS.MA-01", "function": "RESPOND", "category": "Incident Management", "text": "The incident response plan is executed in coordination with relevant third parties once an incident is declared" }, { "id": "RS.MA-02", "function": "RESPOND", "category": "Incident Management", "text": "Incident reports are triaged and validated" }, { "id": "RS.MA-03", "function": "RESPOND", "category": "Incident Management", "text": "Incidents are categorized and prioritized" }, { "id": "RS.MA-04", "function": "RESPOND", "category": "Incident Management", "text": "Incidents are escalated or elevated as needed" }, { "id": "RS.MA-05", "function": "RESPOND", "category": "Incident Management", "text": "Criteria for initiating incident recovery are applied" }, { "id": "RS.AN-03", "function": "RESPOND", "category": "Incident Analysis", "text": "Analysis is performed to establish what occurred during an incident and its root cause" }, { "id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "text": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved" }, { "id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "text": "Incident data and metadata are collected, and their integrity and provenance are preserved" }, { "id": "RS.AN-08", "function": "RESPOND", "category": "Incident Analysis", "text": "An incident's magnitude is estimated and validated" }, { "id": "RS.CO-02", "function": "RESPOND", "category": "Incident Response Reporting and Communication", "text": "Internal and external stakeholders are notified of incidents" }, { "id": "RS.CO-03", "function": "RESPOND", "category": "Incident Response Reporting and Communication", "text": "Information is shared with designated internal and external stakeholders" }, { "id": "RS.MI-01", "function": "RESPOND", "category": "Incident Mitigation", "text": "Incidents are contained" }, { "id": "RS.MI-02", "function": "RESPOND", "category": "Incident Mitigation", "text": "Incidents are eradicated" }, { "id": "RC.RP-01", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "text": "The recovery portion of the incident response plan is executed once initiated from the incident response process" }, { "id": "RC.RP-02", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "text": "Recovery actions are selected, scoped, prioritized, and performed" }, { "id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "text": "The integrity of backups and other restoration assets is verified before use" }, { "id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "text": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms" }, { "id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "text": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed" }, { "id": "RC.RP-06", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "text": "The end of incident recovery is declared based on criteria, and incident-related documentation is completed" }, { "id": "RC.CO-03", "function": "RECOVER", "category": "Incident Recovery Communication", "text": "Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders" }, { "id": "RC.CO-04", "function": "RECOVER", "category": "Incident Recovery Communication", "text": "Public updates on incident recovery are shared using approved methods and messaging" } ], "gaissf_to_nist_csf_mappings": [ { "record": "GAISSF-CRO-023-MAP-0001", "gaissf_id": "D1-CTL-01", "gaissf_title": "Dataset Provenance & Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "SP", "coverage": "Substantially Addressed", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0002", "gaissf_id": "D1-CTL-01", "gaissf_title": "Dataset Provenance & Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D1-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0003", "gaissf_id": "D1-CTL-01", "gaissf_title": "Dataset Provenance & Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D1-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0004", "gaissf_id": "D1-CTL-01", "gaissf_title": "Dataset Provenance & Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D1-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0005", "gaissf_id": "D1-CTL-01", "gaissf_title": "Dataset Provenance & Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0006", "gaissf_id": "D1-CTL-02", "gaissf_title": "Model Extraction Resistance", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0007", "gaissf_id": "D1-CTL-02", "gaissf_title": "Model Extraction Resistance", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0008", "gaissf_id": "D1-CTL-03", "gaissf_title": "Behavioral Drift Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0009", "gaissf_id": "D1-CTL-03", "gaissf_title": "Behavioral Drift Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0010", "gaissf_id": "D1-CTL-03", "gaissf_title": "Behavioral Drift Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0011", "gaissf_id": "D1-CTL-03", "gaissf_title": "Behavioral Drift Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0012", "gaissf_id": "D1-CTL-03", "gaissf_title": "Behavioral Drift Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0013", "gaissf_id": "D1-CTL-04", "gaissf_title": "Federated Learning Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0014", "gaissf_id": "D1-CTL-04", "gaissf_title": "Federated Learning Poisoning Prevention", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0015", "gaissf_id": "D1-CTL-05", "gaissf_title": "Embedding Space Robustness", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0016", "gaissf_id": "D1-CTL-05", "gaissf_title": "Embedding Space Robustness", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0017", "gaissf_id": "D1-CTL-05", "gaissf_title": "Embedding Space Robustness", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0018", "gaissf_id": "D1-CTL-05", "gaissf_title": "Embedding Space Robustness", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0019", "gaissf_id": "D1-CTL-05", "gaissf_title": "Embedding Space Robustness", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0020", "gaissf_id": "D1-CTL-06", "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0021", "gaissf_id": "D1-CTL-06", "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-04", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Suppliers are known and prioritized by criticality", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0022", "gaissf_id": "D1-CTL-06", "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0023", "gaissf_id": "D1-CTL-06", "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0024", "gaissf_id": "D1-CTL-06", "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0025", "gaissf_id": "D1-CTL-07", "gaissf_title": "Lora/Adapter Integrity Verification", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0026", "gaissf_id": "D1-CTL-07", "gaissf_title": "Lora/Adapter Integrity Verification", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-04", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Suppliers are known and prioritized by criticality", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0027", "gaissf_id": "D1-CTL-07", "gaissf_title": "Lora/Adapter Integrity Verification", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0028", "gaissf_id": "D1-CTL-07", "gaissf_title": "Lora/Adapter Integrity Verification", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0029", "gaissf_id": "D1-CTL-07", "gaissf_title": "Lora/Adapter Integrity Verification", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0030", "gaissf_id": "D1-CTL-08", "gaissf_title": "Model Merge Attack Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-08 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0031", "gaissf_id": "D1-CTL-08", "gaissf_title": "Model Merge Attack Detection", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-08 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0032", "gaissf_id": "D1-CTL-09", "gaissf_title": "Quantization Backdoor Screening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-09 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0033", "gaissf_id": "D1-CTL-09", "gaissf_title": "Quantization Backdoor Screening", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D1-CTL-09 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0034", "gaissf_id": "D2-CTL-01", "gaissf_title": "Direct Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0035", "gaissf_id": "D2-CTL-01", "gaissf_title": "Direct Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0036", "gaissf_id": "D2-CTL-01", "gaissf_title": "Direct Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0037", "gaissf_id": "D2-CTL-01", "gaissf_title": "Direct Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0038", "gaissf_id": "D2-CTL-01", "gaissf_title": "Direct Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "RS.AN-08", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "An incident's magnitude is estimated and validated", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0039", "gaissf_id": "D2-CTL-02", "gaissf_title": "Indirect Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0040", "gaissf_id": "D2-CTL-02", "gaissf_title": "Indirect Prompt Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "ID.AM-03", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Representations of the organization's authorized network communication and internal and external network data flows are maintained", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.AM-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0041", "gaissf_id": "D2-CTL-03", "gaissf_title": "Jailbreak Resistance Testing", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0042", "gaissf_id": "D2-CTL-03", "gaissf_title": "Jailbreak Resistance Testing", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0043", "gaissf_id": "D2-CTL-04", "gaissf_title": "Multi-Modal Injection Defense", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "GV.SC-09", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and performance is monitored throughout the technology product and service life cycle", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0044", "gaissf_id": "D2-CTL-04", "gaissf_title": "Multi-Modal Injection Defense", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "PR.PS-04", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Log records are generated and made available for continuous monitoring", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.PS-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0045", "gaissf_id": "D2-CTL-05", "gaissf_title": "Function Call/Tool Call Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "PR.DS-01", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data at rest are protected", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.DS-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0046", "gaissf_id": "D2-CTL-05", "gaissf_title": "Function Call/Tool Call Injection Prevention", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "PR.DS-02", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data in transit are protected", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.DS-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0047", "gaissf_id": "D2-CTL-06", "gaissf_title": "Cross-Context Hijacking Mitigation", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "GV.OC-01", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "The organizational mission is understood and informs cybersecurity risk management", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.OC-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0048", "gaissf_id": "D2-CTL-06", "gaissf_title": "Cross-Context Hijacking Mitigation", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "nist_id": "GV.OC-02", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D2-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.OC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0049", "gaissf_id": "D3-CTL-01", "gaissf_title": "Least Agency Enforcement", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0050", "gaissf_id": "D3-CTL-01", "gaissf_title": "Least Agency Enforcement", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-05", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Access permissions, entitlements, and authorizations are defined in policy, managed, enforced, and reviewed, incorporating least privilege and separation of duties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0051", "gaissf_id": "D3-CTL-02", "gaissf_title": "Inter-Agent Communication Security", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0052", "gaissf_id": "D3-CTL-02", "gaissf_title": "Inter-Agent Communication Security", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.IR-02", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "nist_outcome": "Technology assets are protected from environmental threats", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.IR-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0053", "gaissf_id": "D3-CTL-03", "gaissf_title": "Agentic Prompt Chaining Detection", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0054", "gaissf_id": "D3-CTL-03", "gaissf_title": "Agentic Prompt Chaining Detection", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "GV.SC-09", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and performance is monitored throughout the technology product and service life cycle", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0055", "gaissf_id": "D3-CTL-04", "gaissf_title": "Embodied Ai Safety Controls", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0056", "gaissf_id": "D3-CTL-04", "gaissf_title": "Embodied Ai Safety Controls", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0057", "gaissf_id": "D3-CTL-05", "gaissf_title": "Multi-Agent Trust Chain Attestation", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0058", "gaissf_id": "D3-CTL-05", "gaissf_title": "Multi-Agent Trust Chain Attestation", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0059", "gaissf_id": "D3-CTL-06", "gaissf_title": "Persistent Memory Exfiltration Prevention", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0060", "gaissf_id": "D3-CTL-06", "gaissf_title": "Persistent Memory Exfiltration Prevention", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0061", "gaissf_id": "D3-CTL-07", "gaissf_title": "Secure Memory Lifecycle Management", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0062", "gaissf_id": "D3-CTL-07", "gaissf_title": "Secure Memory Lifecycle Management", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D3-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0063", "gaissf_id": "D4-CTL-01", "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "SP", "coverage": "Substantially Addressed", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0064", "gaissf_id": "D4-CTL-01", "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0065", "gaissf_id": "D4-CTL-01", "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0066", "gaissf_id": "D4-CTL-01", "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0067", "gaissf_id": "D4-CTL-01", "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0068", "gaissf_id": "D4-CTL-02", "gaissf_title": "Model File & Artifact Scanning", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0069", "gaissf_id": "D4-CTL-02", "gaissf_title": "Model File & Artifact Scanning", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0070", "gaissf_id": "D4-CTL-02", "gaissf_title": "Model File & Artifact Scanning", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0071", "gaissf_id": "D4-CTL-02", "gaissf_title": "Model File & Artifact Scanning", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0072", "gaissf_id": "D4-CTL-02", "gaissf_title": "Model File & Artifact Scanning", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0073", "gaissf_id": "D4-CTL-03", "gaissf_title": "Model Hub & Registry Vetting", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0074", "gaissf_id": "D4-CTL-03", "gaissf_title": "Model Hub & Registry Vetting", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0075", "gaissf_id": "D4-CTL-03", "gaissf_title": "Model Hub & Registry Vetting", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0076", "gaissf_id": "D4-CTL-03", "gaissf_title": "Model Hub & Registry Vetting", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D4-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0077", "gaissf_id": "D4-CTL-03", "gaissf_title": "Model Hub & Registry Vetting", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0078", "gaissf_id": "D4-CTL-04", "gaissf_title": "Mcp Server Behavioral Monitoring", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0079", "gaissf_id": "D4-CTL-04", "gaissf_title": "Mcp Server Behavioral Monitoring", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0080", "gaissf_id": "D4-CTL-04", "gaissf_title": "Mcp Server Behavioral Monitoring", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0081", "gaissf_id": "D4-CTL-04", "gaissf_title": "Mcp Server Behavioral Monitoring", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0082", "gaissf_id": "D4-CTL-04", "gaissf_title": "Mcp Server Behavioral Monitoring", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0083", "gaissf_id": "D4-CTL-05", "gaissf_title": "Third-Party Ai Api Security Assessment", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0084", "gaissf_id": "D4-CTL-05", "gaissf_title": "Third-Party Ai Api Security Assessment", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0085", "gaissf_id": "D4-CTL-05", "gaissf_title": "Third-Party Ai Api Security Assessment", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0086", "gaissf_id": "D4-CTL-05", "gaissf_title": "Third-Party Ai Api Security Assessment", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0087", "gaissf_id": "D4-CTL-05", "gaissf_title": "Third-Party Ai Api Security Assessment", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0088", "gaissf_id": "D4-CTL-06", "gaissf_title": "Shadow Ai Discovery & Governance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0089", "gaissf_id": "D4-CTL-06", "gaissf_title": "Shadow Ai Discovery & Governance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0090", "gaissf_id": "D4-CTL-06", "gaissf_title": "Shadow Ai Discovery & Governance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0091", "gaissf_id": "D4-CTL-06", "gaissf_title": "Shadow Ai Discovery & Governance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0092", "gaissf_id": "D4-CTL-06", "gaissf_title": "Shadow Ai Discovery & Governance", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0093", "gaissf_id": "D4-CTL-07", "gaissf_title": "Ai Software Composition Analysis (Sca)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0094", "gaissf_id": "D4-CTL-07", "gaissf_title": "Ai Software Composition Analysis (Sca)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0095", "gaissf_id": "D4-CTL-07", "gaissf_title": "Ai Software Composition Analysis (Sca)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0096", "gaissf_id": "D4-CTL-07", "gaissf_title": "Ai Software Composition Analysis (Sca)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0097", "gaissf_id": "D4-CTL-07", "gaissf_title": "Ai Software Composition Analysis (Sca)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D4-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0098", "gaissf_id": "D5-CTL-01", "gaissf_title": "Harmful Content Blocking", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in ID.RA-09. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0099", "gaissf_id": "D5-CTL-01", "gaissf_title": "Harmful Content Blocking", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0100", "gaissf_id": "D5-CTL-02", "gaissf_title": "Pii Leakage Prevention", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0101", "gaissf_id": "D5-CTL-02", "gaissf_title": "Pii Leakage Prevention", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0102", "gaissf_id": "D5-CTL-03", "gaissf_title": "Copyright Detection", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0103", "gaissf_id": "D5-CTL-03", "gaissf_title": "Copyright Detection", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0104", "gaissf_id": "D5-CTL-04", "gaissf_title": "Ai Watermarking Robustness", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0105", "gaissf_id": "D5-CTL-04", "gaissf_title": "Ai Watermarking Robustness", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0106", "gaissf_id": "D5-CTL-04", "gaissf_title": "Ai Watermarking Robustness", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0107", "gaissf_id": "D5-CTL-04", "gaissf_title": "Ai Watermarking Robustness", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0108", "gaissf_id": "D5-CTL-04", "gaissf_title": "Ai Watermarking Robustness", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "RS.AN-08", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "An incident's magnitude is estimated and validated", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0109", "gaissf_id": "D5-CTL-05", "gaissf_title": "Privacy-By-Design Verification", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "GV.OC-03", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Legal, regulatory, and contractual requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.OC-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0110", "gaissf_id": "D5-CTL-05", "gaissf_title": "Privacy-By-Design Verification", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "PR.DS-01", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data at rest are protected", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.DS-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0111", "gaissf_id": "D5-CTL-06", "gaissf_title": "Privacy-Preserving Ml Validation", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0112", "gaissf_id": "D5-CTL-06", "gaissf_title": "Privacy-Preserving Ml Validation", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "nist_id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D5-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0113", "gaissf_id": "D6-CTL-01", "gaissf_title": "Human-In-The-Loop For High-Risk Actions", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0114", "gaissf_id": "D6-CTL-01", "gaissf_title": "Human-In-The-Loop For High-Risk Actions", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0115", "gaissf_id": "D6-CTL-01", "gaissf_title": "Human-In-The-Loop For High-Risk Actions", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0116", "gaissf_id": "D6-CTL-01", "gaissf_title": "Human-In-The-Loop For High-Risk Actions", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0117", "gaissf_id": "D6-CTL-01", "gaissf_title": "Human-In-The-Loop For High-Risk Actions", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0118", "gaissf_id": "D6-CTL-02", "gaissf_title": "Audit Trail Completeness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0119", "gaissf_id": "D6-CTL-03", "gaissf_title": "Ai Model Card Completeness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.PO-02", "function": "GOVERN", "category": "Policy", "nist_outcome": "Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.PO-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0120", "gaissf_id": "D6-CTL-03", "gaissf_title": "Ai Model Card Completeness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0121", "gaissf_id": "D6-CTL-04", "gaissf_title": "Ai Incident Response Readiness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0122", "gaissf_id": "D6-CTL-04", "gaissf_title": "Ai Incident Response Readiness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0123", "gaissf_id": "D6-CTL-04", "gaissf_title": "Ai Incident Response Readiness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0124", "gaissf_id": "D6-CTL-04", "gaissf_title": "Ai Incident Response Readiness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0125", "gaissf_id": "D6-CTL-04", "gaissf_title": "Ai Incident Response Readiness", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0126", "gaissf_id": "D6-CTL-05", "gaissf_title": "Model Deprecation & Decommissioning", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "PR.AA-05", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Access permissions, entitlements, and authorizations are defined in policy, managed, enforced, and reviewed, incorporating least privilege and separation of duties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0127", "gaissf_id": "D6-CTL-05", "gaissf_title": "Model Deprecation & Decommissioning", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0128", "gaissf_id": "D6-CTL-06", "gaissf_title": "Third-Party Ai Vendor Governance", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "SP", "coverage": "Substantially Addressed", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0129", "gaissf_id": "D6-CTL-06", "gaissf_title": "Third-Party Ai Vendor Governance", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D6-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0130", "gaissf_id": "D6-CTL-06", "gaissf_title": "Third-Party Ai Vendor Governance", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D6-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0131", "gaissf_id": "D6-CTL-06", "gaissf_title": "Third-Party Ai Vendor Governance", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D6-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0132", "gaissf_id": "D6-CTL-06", "gaissf_title": "Third-Party Ai Vendor Governance", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D6-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0133", "gaissf_id": "D6-CTL-07", "gaissf_title": "Ai Resilience & Business Continuity", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "PR.IR-04", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "nist_outcome": "Adequate resource capacity to ensure availability is maintained", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.IR-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0134", "gaissf_id": "D6-CTL-07", "gaissf_title": "Ai Resilience & Business Continuity", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "nist_id": "PR.DS-01", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data at rest are protected", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D6-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.DS-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0135", "gaissf_id": "D7-CTL-H01", "gaissf_title": "Ai-Generated Phishing Simulation", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0136", "gaissf_id": "D7-CTL-H01", "gaissf_title": "Ai-Generated Phishing Simulation", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0137", "gaissf_id": "D7-CTL-H02", "gaissf_title": "Deepfake Detection Training", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0138", "gaissf_id": "D7-CTL-H02", "gaissf_title": "Deepfake Detection Training", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0139", "gaissf_id": "D7-CTL-H02", "gaissf_title": "Deepfake Detection Training", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0140", "gaissf_id": "D7-CTL-H02", "gaissf_title": "Deepfake Detection Training", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0141", "gaissf_id": "D7-CTL-H03", "gaissf_title": "Out-Of-Band Authentication", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "PR.AA-05", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Access permissions, entitlements, and authorizations are defined in policy, managed, enforced, and reviewed, incorporating least privilege and separation of duties", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0142", "gaissf_id": "D7-CTL-H03", "gaissf_title": "Out-Of-Band Authentication", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "PR.AA-01", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0143", "gaissf_id": "D7-CTL-H04", "gaissf_title": "Ai Social Engineering Ir", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "RS.MA-01", "function": "RESPOND", "category": "Incident Management", "nist_outcome": "The incident response plan is executed in coordination with relevant third parties once an incident is declared", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.MA-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0144", "gaissf_id": "D7-CTL-H04", "gaissf_title": "Ai Social Engineering Ir", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "RC.RP-01", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The recovery portion of the incident response plan is executed once initiated from the incident response process", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0145", "gaissf_id": "D7-CTL-H05", "gaissf_title": "Ai-Enhanced External Attack Defense", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "GV.RM-04", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Strategic direction that describes appropriate risk response options is established and communicated", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.RM-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0146", "gaissf_id": "D7-CTL-H05", "gaissf_title": "Ai-Enhanced External Attack Defense", "domain": "D7: HUMAN & SOCIETAL HARMS", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D7-CTL-H05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0147", "gaissf_id": "D8-CTL-01", "gaissf_title": "Eu Ai Act Risk Tier Mapping", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "GV.OV-02", "function": "GOVERN", "category": "Oversight", "nist_outcome": "The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.OV-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0148", "gaissf_id": "D8-CTL-01", "gaissf_title": "Eu Ai Act Risk Tier Mapping", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "GV.SC-03", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0149", "gaissf_id": "D8-CTL-02", "gaissf_title": "Iso 42001 Gap Analysis", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0150", "gaissf_id": "D8-CTL-02", "gaissf_title": "Iso 42001 Gap Analysis", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0151", "gaissf_id": "D8-CTL-03", "gaissf_title": "Gpai Technical Documentation Verification", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-01. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0152", "gaissf_id": "D8-CTL-03", "gaissf_title": "Gpai Technical Documentation Verification", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AT-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0153", "gaissf_id": "D8-CTL-04", "gaissf_title": "Dora Ict Incident Reporting (Financial Sector)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "RS.CO-02", "function": "RESPOND", "category": "Incident Response Reporting and Communication", "nist_outcome": "Internal and external stakeholders are notified of incidents", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.CO-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0154", "gaissf_id": "D8-CTL-04", "gaissf_title": "Dora Ict Incident Reporting (Financial Sector)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "RS.CO-03", "function": "RESPOND", "category": "Incident Response Reporting and Communication", "nist_outcome": "Information is shared with designated internal and external stakeholders", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.CO-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0155", "gaissf_id": "D8-CTL-05", "gaissf_title": "Nist Sp 800-218A Compliance Check", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "PR.PS-06", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Secure software development practices are integrated, and performance is monitored throughout the software development life cycle", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.PS-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0156", "gaissf_id": "D8-CTL-05", "gaissf_title": "Nist Sp 800-218A Compliance Check", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "nist_id": "GV.OC-03", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Legal, regulatory, and contractual requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D8-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.OC-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05" }, { "record": "GAISSF-CRO-023-MAP-0157", "gaissf_id": "D9-CTL-01", "gaissf_title": "Physical Harm Boundary Enforcement", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0158", "gaissf_id": "D9-CTL-01", "gaissf_title": "Physical Harm Boundary Enforcement", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0159", "gaissf_id": "D9-CTL-01", "gaissf_title": "Physical Harm Boundary Enforcement", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0160", "gaissf_id": "D9-CTL-01", "gaissf_title": "Physical Harm Boundary Enforcement", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0161", "gaissf_id": "D9-CTL-01", "gaissf_title": "Physical Harm Boundary Enforcement", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-01 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0162", "gaissf_id": "D9-CTL-02", "gaissf_title": "Safe State And Graceful Degradation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0163", "gaissf_id": "D9-CTL-02", "gaissf_title": "Safe State And Graceful Degradation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-02 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0164", "gaissf_id": "D9-CTL-03", "gaissf_title": "Human Override And Emergency Stop", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0165", "gaissf_id": "D9-CTL-03", "gaissf_title": "Human Override And Emergency Stop", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-03 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0166", "gaissf_id": "D9-CTL-04", "gaissf_title": "Cyber-Physical Attack Detection", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0167", "gaissf_id": "D9-CTL-04", "gaissf_title": "Cyber-Physical Attack Detection", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0168", "gaissf_id": "D9-CTL-04", "gaissf_title": "Cyber-Physical Attack Detection", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0169", "gaissf_id": "D9-CTL-04", "gaissf_title": "Cyber-Physical Attack Detection", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0170", "gaissf_id": "D9-CTL-04", "gaissf_title": "Cyber-Physical Attack Detection", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RS.AN-03", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Analysis is performed to establish what occurred during an incident and its root cause", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-04 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-03. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0171", "gaissf_id": "D9-CTL-05", "gaissf_title": "Physical Environment Integrity Monitoring", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0172", "gaissf_id": "D9-CTL-05", "gaissf_title": "Physical Environment Integrity Monitoring", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0173", "gaissf_id": "D9-CTL-05", "gaissf_title": "Physical Environment Integrity Monitoring", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-05. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0174", "gaissf_id": "D9-CTL-05", "gaissf_title": "Physical Environment Integrity Monitoring", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0175", "gaissf_id": "D9-CTL-05", "gaissf_title": "Physical Environment Integrity Monitoring", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-05 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-07. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0176", "gaissf_id": "D9-CTL-06", "gaissf_title": "Actuator Command Verification", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0177", "gaissf_id": "D9-CTL-06", "gaissf_title": "Actuator Command Verification", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-06 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0178", "gaissf_id": "D9-CTL-07", "gaissf_title": "Physical Incident Evidence Preservation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in PR.AA-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0179", "gaissf_id": "D9-CTL-07", "gaissf_title": "Physical Incident Evidence Preservation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RS.AN-06. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0180", "gaissf_id": "D9-CTL-07", "gaissf_title": "Physical Incident Evidence Preservation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in DE.CM-02. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0181", "gaissf_id": "D9-CTL-07", "gaissf_title": "Physical Incident Evidence Preservation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "relationship": "P", "coverage": "Partially Addressed", "confidence": "Medium", "rationale": "GAISSF D9-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in RC.RP-04. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." }, { "record": "GAISSF-CRO-023-MAP-0182", "gaissf_id": "D9-CTL-07", "gaissf_title": "Physical Incident Evidence Preservation", "domain": "D9: PHYSICAL AI SAFETY", "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "relationship": "S", "coverage": "Indirectly Supported", "confidence": "Low", "rationale": "GAISSF D9-CTL-07 provides AI-system-specific controls and evidence that support the cybersecurity outcome in GV.SC-08. The relationship is outcome-based; NIST CSF 2.0 remains broader and technology-neutral.", "residual_gap": "Organization-wide ICT scope, enterprise context, and non-AI assets remain outside the direct GAISSF control scope and require separate implementation evidence.", "gaissf_evidence": "", "source_gaissf": "GAISSF-NOR-004 v1.0", "source_nist": "NIST CSWP 29, Appendix A", "verification_date": "2026-10-05", "applicability_note": "Additional / conditional D9 mapping; relevant only where D9 is in the Applicable-Control Baseline." } ], "nist_csf_to_gaissf_reverse_coverage": [ { "nist_id": "GV.OC-01", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "The organizational mission is understood and informs cybersecurity risk management", "gaissf_ids": "D2-CTL-06", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OC-02", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered", "gaissf_ids": "D2-CTL-06", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OC-03", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Legal, regulatory, and contractual requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed", "gaissf_ids": "D5-CTL-05, D8-CTL-05", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OC-04", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OC-05", "function": "GOVERN", "category": "Organizational Context", "nist_outcome": "Outcomes, capabilities, and services that the organization depends on are understood and communicated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-01", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Risk management objectives are established and agreed to by organizational stakeholders", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-02", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Risk appetite and risk tolerance statements are established, communicated, and maintained", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-03", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Cybersecurity risk management activities and outcomes are included in enterprise risk management processes", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-04", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Strategic direction that describes appropriate risk response options is established and communicated", "gaissf_ids": "D7-CTL-H05", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-05", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-06", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RM-07", "function": "GOVERN", "category": "Risk Management Strategy", "nist_outcome": "Strategic opportunities, or positive risks, are characterized and included in organizational cybersecurity risk discussions", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RR-01", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "nist_outcome": "Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RR-02", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "nist_outcome": "Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RR-03", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "nist_outcome": "Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.RR-04", "function": "GOVERN", "category": "Roles, Responsibilities, and Authorities", "nist_outcome": "Cybersecurity is included in human resources practices", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.PO-01", "function": "GOVERN", "category": "Policy", "nist_outcome": "Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.PO-02", "function": "GOVERN", "category": "Policy", "nist_outcome": "Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission", "gaissf_ids": "D6-CTL-03", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OV-01", "function": "GOVERN", "category": "Oversight", "nist_outcome": "Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OV-02", "function": "GOVERN", "category": "Oversight", "nist_outcome": "The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks", "gaissf_ids": "D8-CTL-01", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.OV-03", "function": "GOVERN", "category": "Oversight", "nist_outcome": "Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-01", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-02", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally", "gaissf_ids": "D6-CTL-06, D1-CTL-01, D1-CTL-06, D1-CTL-07, D4-CTL-02, D4-CTL-03, D4-CTL-04, D4-CTL-05", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-03", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes", "gaissf_ids": "D8-CTL-01", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-04", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Suppliers are known and prioritized by criticality", "gaissf_ids": "D1-CTL-06, D1-CTL-07", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-05", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and agreements with suppliers and other relevant third parties", "gaissf_ids": "D4-CTL-03, D6-CTL-06, D1-CTL-06, D1-CTL-07, D4-CTL-02, D4-CTL-04, D4-CTL-05, D4-CTL-06", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-06", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "gaissf_ids": "D4-CTL-03, D6-CTL-06, D1-CTL-06, D1-CTL-07, D3-CTL-05, D4-CTL-02, D4-CTL-04, D4-CTL-05", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-07", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "The risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the relationship", "gaissf_ids": "D1-CTL-01, D4-CTL-03, D6-CTL-06, D1-CTL-06, D1-CTL-07, D4-CTL-02, D4-CTL-04, D4-CTL-05", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-08", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Relevant suppliers and other third parties are included in incident planning, response, and recovery activities", "gaissf_ids": "D1-CTL-01, D4-CTL-01, D6-CTL-06, D4-CTL-03, D9-CTL-04, D1-CTL-03, D1-CTL-05, D3-CTL-07", "coverage": "Substantially Addressed", "relationship": "SP", "confidence": "Medium-High", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-09", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and performance is monitored throughout the technology product and service life cycle", "gaissf_ids": "D2-CTL-04, D3-CTL-03", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "GV.SC-10", "function": "GOVERN", "category": "Cybersecurity Supply Chain Risk Management", "nist_outcome": "Cybersecurity supply chain risk management plans include provisions for activities after the conclusion of a partnership or service agreement", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-01", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Inventories of hardware managed by the organization are maintained", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-02", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Inventories of software, services, and systems managed by the organization are maintained", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-03", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Representations of the organization's authorized network communication and internal and external network data flows are maintained", "gaissf_ids": "D2-CTL-02", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-04", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Inventories of services provided by suppliers are maintained", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-05", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-07", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Inventories of data and corresponding metadata for designated data types are maintained", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.AM-08", "function": "IDENTIFY", "category": "Asset Management", "nist_outcome": "Systems, hardware, software, services, and data are managed throughout their life cycles", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-01", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Vulnerabilities in assets are identified, validated, and recorded", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-02", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Cyber threat intelligence is received from information sharing forums and sources", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-03", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Internal and external threats to the organization are identified and recorded", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-04", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-05", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-06", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Risk responses are chosen, prioritized, planned, tracked, and communicated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-07", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-08", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Processes for receiving, analyzing, and responding to vulnerability disclosures are established", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-09", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "gaissf_ids": "D1-CTL-04, D1-CTL-08, D1-CTL-09, D2-CTL-02, D3-CTL-04, D3-CTL-06, D5-CTL-01", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "ID.RA-10", "function": "IDENTIFY", "category": "Risk Assessment", "nist_outcome": "Critical suppliers are assessed prior to acquisition", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.IM-01", "function": "IDENTIFY", "category": "Improvement", "nist_outcome": "Improvements are identified from evaluations", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.IM-02", "function": "IDENTIFY", "category": "Improvement", "nist_outcome": "Improvements are identified from security tests and exercises, including those coordinated with suppliers and relevant third parties", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.IM-03", "function": "IDENTIFY", "category": "Improvement", "nist_outcome": "Improvements are identified from execution of operational processes, procedures, and activities", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "ID.IM-04", "function": "IDENTIFY", "category": "Improvement", "nist_outcome": "Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AA-01", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "gaissf_ids": "D7-CTL-H03", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AA-02", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Identities are proofed and bound to credentials based on the context of interactions", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AA-03", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Users, services, and hardware are authenticated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AA-04", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Identity assertions are protected, conveyed, and verified", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AA-05", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Access permissions, entitlements, and authorizations are defined in policy, managed, enforced, and reviewed, incorporating least privilege and separation of duties", "gaissf_ids": "D3-CTL-01, D6-CTL-05, D7-CTL-H03", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AA-06", "function": "PROTECT", "category": "Identity Management, Authentication, and Access Control", "nist_outcome": "Physical access to assets is managed, monitored, and enforced commensurate with risk", "gaissf_ids": "D9-CTL-01, D9-CTL-02, D9-CTL-03, D9-CTL-04, D9-CTL-05, D9-CTL-07, D1-CTL-04, D1-CTL-08", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AT-01", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Personnel receive awareness and training to possess the knowledge and skills to perform general tasks with cybersecurity risks in mind", "gaissf_ids": "D1-CTL-02, D2-CTL-03, D5-CTL-06, D7-CTL-H01, D8-CTL-03", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.AT-02", "function": "PROTECT", "category": "Awareness and Training", "nist_outcome": "Individuals in specialized roles receive awareness and training to possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind", "gaissf_ids": "D1-CTL-02, D2-CTL-03, D5-CTL-06, D7-CTL-H01, D8-CTL-03", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.DS-01", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data at rest are protected", "gaissf_ids": "D2-CTL-05, D5-CTL-05, D6-CTL-07", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.DS-02", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data in transit are protected", "gaissf_ids": "D2-CTL-05", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.DS-10", "function": "PROTECT", "category": "Data Security", "nist_outcome": "The confidentiality, integrity, and availability of data in use are protected", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.DS-11", "function": "PROTECT", "category": "Data Security", "nist_outcome": "Backups of data are created, protected, maintained, and tested", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.PS-01", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Configuration management practices are established and applied", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.PS-02", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Software is maintained, replaced, and removed commensurate with risk", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.PS-03", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Hardware is maintained, replaced, and removed commensurate with risk", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.PS-04", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Log records are generated and made available for continuous monitoring", "gaissf_ids": "D2-CTL-04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.PS-05", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Installation and execution of unauthorized software are prevented", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.PS-06", "function": "PROTECT", "category": "Platform Security", "nist_outcome": "Secure software development practices are integrated, and performance is monitored throughout the software development life cycle", "gaissf_ids": "D8-CTL-05", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.IR-01", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "nist_outcome": "Networks and environments are protected from unauthorized logical access and usage", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.IR-02", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "nist_outcome": "Technology assets are protected from environmental threats", "gaissf_ids": "D3-CTL-02", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "PR.IR-03", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "nist_outcome": "Mechanisms are implemented to achieve resilience requirements in normal and adverse situations", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "PR.IR-04", "function": "PROTECT", "category": "Technology Infrastructure Resilience", "nist_outcome": "Adequate resource capacity to ensure availability is maintained", "gaissf_ids": "D6-CTL-07", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "DE.CM-01", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "Networks and network services are monitored to find potentially adverse events", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.CM-02", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "The physical environment is monitored to find potentially adverse events", "gaissf_ids": "D9-CTL-05, D9-CTL-07, D5-CTL-02, D5-CTL-03, D9-CTL-01, D9-CTL-02, D9-CTL-03, D9-CTL-04", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "DE.CM-03", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "Personnel activity and technology usage are monitored to find potentially adverse events", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.CM-06", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "External service provider activities and services are monitored to find potentially adverse events", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.CM-09", "function": "DETECT", "category": "Continuous Monitoring", "nist_outcome": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.AE-02", "function": "DETECT", "category": "Adverse Event Analysis", "nist_outcome": "Potentially adverse events are analyzed to better understand associated activities", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.AE-03", "function": "DETECT", "category": "Adverse Event Analysis", "nist_outcome": "Information is correlated from multiple sources", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.AE-04", "function": "DETECT", "category": "Adverse Event Analysis", "nist_outcome": "The estimated impact and scope of adverse events are understood", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.AE-06", "function": "DETECT", "category": "Adverse Event Analysis", "nist_outcome": "Information on adverse events is provided to authorized staff and tools", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.AE-07", "function": "DETECT", "category": "Adverse Event Analysis", "nist_outcome": "Cyber threat intelligence and other contextual information are integrated into analysis", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "DE.AE-08", "function": "DETECT", "category": "Adverse Event Analysis", "nist_outcome": "Incidents are declared when adverse events meet defined incident criteria", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MA-01", "function": "RESPOND", "category": "Incident Management", "nist_outcome": "The incident response plan is executed in coordination with relevant third parties once an incident is declared", "gaissf_ids": "D7-CTL-H04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MA-02", "function": "RESPOND", "category": "Incident Management", "nist_outcome": "Incident reports are triaged and validated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MA-03", "function": "RESPOND", "category": "Incident Management", "nist_outcome": "Incidents are categorized and prioritized", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MA-04", "function": "RESPOND", "category": "Incident Management", "nist_outcome": "Incidents are escalated or elevated as needed", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MA-05", "function": "RESPOND", "category": "Incident Management", "nist_outcome": "Criteria for initiating incident recovery are applied", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RS.AN-03", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Analysis is performed to establish what occurred during an incident and its root cause", "gaissf_ids": "D9-CTL-04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.AN-06", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Actions performed during an investigation are recorded, and record integrity and provenance are preserved", "gaissf_ids": "D1-CTL-01, D4-CTL-01, D9-CTL-07, D1-CTL-03, D1-CTL-05, D2-CTL-01, D5-CTL-04, D6-CTL-01", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.AN-07", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "Incident data and metadata are collected, and their integrity and provenance are preserved", "gaissf_ids": "D1-CTL-01, D4-CTL-01, D1-CTL-03, D1-CTL-05, D2-CTL-01, D5-CTL-04, D6-CTL-01, D6-CTL-04", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.AN-08", "function": "RESPOND", "category": "Incident Analysis", "nist_outcome": "An incident's magnitude is estimated and validated", "gaissf_ids": "D2-CTL-01, D5-CTL-04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.CO-02", "function": "RESPOND", "category": "Incident Response Reporting and Communication", "nist_outcome": "Internal and external stakeholders are notified of incidents", "gaissf_ids": "D8-CTL-04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.CO-03", "function": "RESPOND", "category": "Incident Response Reporting and Communication", "nist_outcome": "Information is shared with designated internal and external stakeholders", "gaissf_ids": "D8-CTL-04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MI-01", "function": "RESPOND", "category": "Incident Mitigation", "nist_outcome": "Incidents are contained", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RS.MI-02", "function": "RESPOND", "category": "Incident Mitigation", "nist_outcome": "Incidents are eradicated", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RC.RP-01", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The recovery portion of the incident response plan is executed once initiated from the incident response process", "gaissf_ids": "D7-CTL-H04", "coverage": "Indirectly Supported", "relationship": "S", "confidence": "Low", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RC.RP-02", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Recovery actions are selected, scoped, prioritized, and performed", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RC.RP-03", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of backups and other restoration assets is verified before use", "gaissf_ids": "D4-CTL-01, D1-CTL-03, D1-CTL-05, D2-CTL-01, D5-CTL-04, D6-CTL-01, D6-CTL-04, D7-CTL-H02", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RC.RP-04", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms", "gaissf_ids": "D9-CTL-04, D9-CTL-07, D1-CTL-03, D3-CTL-07, D6-CTL-01, D6-CTL-04, D9-CTL-01", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RC.RP-05", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed", "gaissf_ids": "D4-CTL-01, D1-CTL-05, D2-CTL-01, D5-CTL-04, D7-CTL-H02, D9-CTL-01, D9-CTL-05", "coverage": "Partially Addressed", "relationship": "P", "confidence": "Medium", "gap": "GAISSF is AI-system-focused; organization-wide cybersecurity outcomes and non-AI ICT assets require additional controls.", "verification_date": "2026-10-05" }, { "nist_id": "RC.RP-06", "function": "RECOVER", "category": "Incident Recovery Plan Execution", "nist_outcome": "The end of incident recovery is declared based on criteria, and incident-related documentation is completed", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RC.CO-03", "function": "RECOVER", "category": "Incident Recovery Communication", "nist_outcome": "Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" }, { "nist_id": "RC.CO-04", "function": "RECOVER", "category": "Incident Recovery Communication", "nist_outcome": "Public updates on incident recovery are shared using approved methods and messaging", "gaissf_ids": "", "coverage": "Not Addressed", "relationship": "N", "confidence": "Not Rated", "gap": "No sufficiently direct GAISSF control was identified.", "verification_date": "2026-10-05" } ] }