# CRO-025 - GAISSF-MITRE ATLAS Mapping

**Version:** 1.0  
**Status:** Publication Candidate  
**Publisher:** ODA3 Institute  
**Publication date:** 29 June 2026

> This crosswalk documents defensive relationships between GAISSF controls and MITRE ATLAS adversary behavior. It does not establish MITRE endorsement, certification, equivalence, prevention, detection, or operating effectiveness.

## Source baseline

- GAISSF-NOR-001 v1.0 and GAISSF-NOR-004 v1.0.
- MITRE ATLAS content release 2026.05, format 6.0.0, modified 27 May 2026.
- Live matrix reported counts: 16 tactics, 170 techniques including sub-techniques, 35 mitigations, and 57 case studies.

## Scope

All 59 GAISSF controls are mapped to materially relevant ATLAS tactics and a priority set of directly AI-relevant techniques. The official ATLAS dataset remains authoritative for the complete technique inventory.

## Tactics

- `AML.TA0002` Reconnaissance
- `AML.TA0003` Resource Development
- `AML.TA0004` Initial Access
- `AML.TA0000` AI Model Access
- `AML.TA0005` Execution
- `AML.TA0006` Persistence
- `AML.TA0012` Privilege Escalation
- `AML.TA0007` Defense Evasion
- `AML.TA0013` Credential Access
- `AML.TA0008` Discovery
- `AML.TA0015` Lateral Movement
- `AML.TA0009` Collection
- `AML.TA0001` AI Attack Staging
- `AML.TA0014` Command and Control
- `AML.TA0010` Exfiltration
- `AML.TA0011` Impact

## Reverse tactic coverage

| Tactic | Coverage | Mapped GAISSF controls |
|---|---|---|
| AML.TA0002 Reconnaissance | Substantially Addressed | D5-CTL-05, D5-CTL-06, D6-CTL-01, D6-CTL-02, D6-CTL-04, D7-CTL-H01, D7-CTL-H03, D8-CTL-01, D8-CTL-02, D8-CTL-03, D8-CTL-05 |
| AML.TA0003 Resource Development | Substantially Addressed | D1-CTL-01, D1-CTL-04, D2-CTL-02, D2-CTL-06, D3-CTL-01, D3-CTL-02, D3-CTL-03, D3-CTL-04, D3-CTL-05, D3-CTL-06, D3-CTL-07, D7-CTL-H01, D7-CTL-H02, D8-CTL-03, D8-CTL-05 |
| AML.TA0004 Initial Access | Substantially Addressed | D1-CTL-05, D1-CTL-06, D1-CTL-07, D1-CTL-08, D2-CTL-04, D2-CTL-05, D4-CTL-01, D4-CTL-02, D4-CTL-03, D4-CTL-04, D4-CTL-05, D4-CTL-06, D4-CTL-07, D6-CTL-06, D7-CTL-H05 |
| AML.TA0000 AI Model Access | Substantially Addressed | D3-CTL-01, D3-CTL-04, D4-CTL-04, D5-CTL-02, D6-CTL-03, D6-CTL-05, D9-CTL-02, D9-CTL-03, D9-CTL-05, D9-CTL-06 |
| AML.TA0005 Execution | Partially Addressed | D2-CTL-01, D2-CTL-02, D3-CTL-02, D3-CTL-05, D3-CTL-07 |
| AML.TA0006 Persistence | Partially Addressed | D9-CTL-02 |
| AML.TA0012 Privilege Escalation | Not Addressed |  |
| AML.TA0007 Defense Evasion | Substantially Addressed | D1-CTL-06, D4-CTL-01, D4-CTL-02, D4-CTL-03, D4-CTL-05, D4-CTL-06, D4-CTL-07, D6-CTL-06 |
| AML.TA0013 Credential Access | Not Addressed |  |
| AML.TA0008 Discovery | Substantially Addressed | D5-CTL-01, D5-CTL-03, D5-CTL-04, D5-CTL-05, D8-CTL-04, D9-CTL-01, D9-CTL-05, D9-CTL-07 |
| AML.TA0015 Lateral Movement | Not Addressed |  |
| AML.TA0009 Collection | Not Addressed |  |
| AML.TA0001 AI Attack Staging | Substantially Addressed | D1-CTL-02, D1-CTL-03, D1-CTL-05, D1-CTL-07, D1-CTL-08, D1-CTL-09, D2-CTL-03, D2-CTL-04, D2-CTL-05, D5-CTL-01, D5-CTL-03, D5-CTL-04, D7-CTL-H02, D7-CTL-H04, D9-CTL-01 |
| AML.TA0014 Command and Control | Not Addressed |  |
| AML.TA0010 Exfiltration | Partially Addressed | D2-CTL-01, D2-CTL-06, D3-CTL-03, D3-CTL-06, D5-CTL-06, D6-CTL-04, D7-CTL-H04 |
| AML.TA0011 Impact | Partially Addressed | D1-CTL-01, D6-CTL-07, D7-CTL-H03, D7-CTL-H05 |

## Limitations

- Mapping is not MITRE endorsement, certification, equivalence, or proof of defensive effectiveness.
- ATLAS describes adversary behavior; GAISSF defines control and evidence expectations. A relationship does not prove prevention or detection.
- The priority technique register is deliberately focused on techniques with direct AI-system relevance to GAISSF controls; the official ATLAS dataset remains authoritative for the complete 170-object technique inventory.
- Environment-specific threat modelling, telemetry, detection engineering, adversary emulation, and validation remain necessary.
- ATLAS publishes monthly content updates; revalidation is required after a source release changes.

## Notably absent

- No MITRE endorsement or certification.
- No proof that mapped techniques are prevented or detected.
- No universal technique-coverage percentage.
- No substitution for adversary emulation, telemetry validation, or operating-effectiveness testing.

## Mapping register

| Record | GAISSF control | ATLAS technique | Relationship | Confidence |
|---|---|---|---|---|
| CRO025-MAP-0001 | D1-CTL-01 Dataset Provenance & Poisoning Prevention | AML.T0020 Poison Training Data | S | Low |
| CRO025-MAP-0002 | D1-CTL-01 Dataset Provenance & Poisoning Prevention | AML.T0059 Erode Dataset Integrity | S | Low |
| CRO025-MAP-0003 | D1-CTL-02 Model Extraction Resistance | AML.T0042 Verify Attack | P | Medium |
| CRO025-MAP-0004 | D1-CTL-03 Behavioral Drift Detection | AML.T0042 Verify Attack | P | Medium |
| CRO025-MAP-0005 | D1-CTL-04 Federated Learning Poisoning Prevention | AML.T0020 Poison Training Data | S | Low |
| CRO025-MAP-0006 | D1-CTL-04 Federated Learning Poisoning Prevention | AML.T0058 Publish Poisoned Models | S | Low |
| CRO025-MAP-0007 | D1-CTL-05 Embedding Space Robustness | AML.T0015 Evade AI Model | S | Low |
| CRO025-MAP-0008 | D1-CTL-05 Embedding Space Robustness | AML.T0005 Create Proxy AI Model | S | Low |
| CRO025-MAP-0009 | D1-CTL-06 Post-Quantum Model Signing & Crypto Hardening | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0010 | D1-CTL-06 Post-Quantum Model Signing & Crypto Hardening | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0011 | D1-CTL-07 Lora/Adapter Integrity Verification | AML.T0015 Evade AI Model | S | Low |
| CRO025-MAP-0012 | D1-CTL-07 Lora/Adapter Integrity Verification | AML.T0005 Create Proxy AI Model | S | Low |
| CRO025-MAP-0013 | D1-CTL-08 Model Merge Attack Detection | AML.T0015 Evade AI Model | S | Low |
| CRO025-MAP-0014 | D1-CTL-08 Model Merge Attack Detection | AML.T0005 Create Proxy AI Model | S | Low |
| CRO025-MAP-0015 | D1-CTL-09 Quantization Backdoor Screening | AML.T0042 Verify Attack | P | Medium |
| CRO025-MAP-0016 | D2-CTL-01 Direct Prompt Injection Prevention | AML.T0051 LLM Prompt Injection | S | Low |
| CRO025-MAP-0017 | D2-CTL-01 Direct Prompt Injection Prevention | AML.T0056 Extract LLM System Prompt | S | Low |
| CRO025-MAP-0018 | D2-CTL-02 Indirect Prompt Injection Prevention | AML.T0051 LLM Prompt Injection | S | Low |
| CRO025-MAP-0019 | D2-CTL-02 Indirect Prompt Injection Prevention | AML.T0065 LLM Prompt Crafting | S | Low |
| CRO025-MAP-0020 | D2-CTL-03 Jailbreak Resistance Testing | AML.T0042 Verify Attack | P | Medium |
| CRO025-MAP-0021 | D2-CTL-04 Multi-Modal Injection Defense | AML.T0043 Craft Adversarial Data | S | Low |
| CRO025-MAP-0022 | D2-CTL-04 Multi-Modal Injection Defense | AML.T0015 Evade AI Model | S | Low |
| CRO025-MAP-0023 | D2-CTL-05 Function Call/Tool Call Injection Prevention | AML.T0043 Craft Adversarial Data | S | Low |
| CRO025-MAP-0024 | D2-CTL-05 Function Call/Tool Call Injection Prevention | AML.T0015 Evade AI Model | S | Low |
| CRO025-MAP-0025 | D2-CTL-06 Cross-Context Hijacking Mitigation | AML.T0056 Extract LLM System Prompt | S | Low |
| CRO025-MAP-0026 | D2-CTL-06 Cross-Context Hijacking Mitigation | AML.T0065 LLM Prompt Crafting | S | Low |
| CRO025-MAP-0027 | D3-CTL-01 Least Agency Enforcement | AML.T0104 Publish Poisoned AI Agent Tool | S | Low |
| CRO025-MAP-0028 | D3-CTL-01 Least Agency Enforcement | AML.T0040 AI Model Inference API Access | S | Low |
| CRO025-MAP-0029 | D3-CTL-02 Inter-Agent Communication Security | AML.T0104 Publish Poisoned AI Agent Tool | S | Low |
| CRO025-MAP-0030 | D3-CTL-02 Inter-Agent Communication Security | AML.T0100 AI Agent Clickbait | S | Low |
| CRO025-MAP-0031 | D3-CTL-03 Agentic Prompt Chaining Detection | AML.T0056 Extract LLM System Prompt | S | Low |
| CRO025-MAP-0032 | D3-CTL-03 Agentic Prompt Chaining Detection | AML.T0065 LLM Prompt Crafting | S | Low |
| CRO025-MAP-0033 | D3-CTL-04 Embodied Ai Safety Controls | AML.T0104 Publish Poisoned AI Agent Tool | S | Low |
| CRO025-MAP-0034 | D3-CTL-04 Embodied Ai Safety Controls | AML.T0041 Physical Environment Access | S | Low |
| CRO025-MAP-0035 | D3-CTL-05 Multi-Agent Trust Chain Attestation | AML.T0104 Publish Poisoned AI Agent Tool | S | Low |
| CRO025-MAP-0036 | D3-CTL-05 Multi-Agent Trust Chain Attestation | AML.T0100 AI Agent Clickbait | S | Low |
| CRO025-MAP-0037 | D3-CTL-06 Persistent Memory Exfiltration Prevention | AML.T0101 Exfiltration via AI Agent Tool Invocation | S | Low |
| CRO025-MAP-0038 | D3-CTL-06 Persistent Memory Exfiltration Prevention | AML.T0104 Publish Poisoned AI Agent Tool | S | Low |
| CRO025-MAP-0039 | D3-CTL-07 Secure Memory Lifecycle Management | AML.T0104 Publish Poisoned AI Agent Tool | S | Low |
| CRO025-MAP-0040 | D3-CTL-07 Secure Memory Lifecycle Management | AML.T0100 AI Agent Clickbait | S | Low |
| CRO025-MAP-0041 | D4-CTL-01 Ai Bill Of Materials (Ai Bom) Maintenance | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0042 | D4-CTL-01 Ai Bill Of Materials (Ai Bom) Maintenance | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0043 | D4-CTL-02 Model File & Artifact Scanning | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0044 | D4-CTL-02 Model File & Artifact Scanning | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0045 | D4-CTL-03 Model Hub & Registry Vetting | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0046 | D4-CTL-03 Model Hub & Registry Vetting | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0047 | D4-CTL-04 Mcp Server Behavioral Monitoring | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0048 | D4-CTL-04 Mcp Server Behavioral Monitoring | AML.T0040 AI Model Inference API Access | S | Low |
| CRO025-MAP-0049 | D4-CTL-05 Third-Party Ai Api Security Assessment | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0050 | D4-CTL-05 Third-Party Ai Api Security Assessment | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0051 | D4-CTL-06 Shadow Ai Discovery & Governance | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0052 | D4-CTL-06 Shadow Ai Discovery & Governance | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0053 | D4-CTL-07 Ai Software Composition Analysis (Sca) | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0054 | D4-CTL-07 Ai Software Composition Analysis (Sca) | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0055 | D5-CTL-01 Harmful Content Blocking | AML.T0062 Discover LLM Hallucinations | S | Low |
| CRO025-MAP-0056 | D5-CTL-01 Harmful Content Blocking | AML.T0099 Generate Deepfakes | S | Low |
| CRO025-MAP-0057 | D5-CTL-02 Pii Leakage Prevention | AML.T0040 AI Model Inference API Access | S | Low |
| CRO025-MAP-0058 | D5-CTL-02 Pii Leakage Prevention | AML.T0044 Full AI Model Access | S | Low |
| CRO025-MAP-0059 | D5-CTL-03 Copyright Detection | AML.T0062 Discover LLM Hallucinations | S | Low |
| CRO025-MAP-0060 | D5-CTL-03 Copyright Detection | AML.T0099 Generate Deepfakes | S | Low |
| CRO025-MAP-0061 | D5-CTL-04 Ai Watermarking Robustness | AML.T0062 Discover LLM Hallucinations | S | Low |
| CRO025-MAP-0062 | D5-CTL-04 Ai Watermarking Robustness | AML.T0099 Generate Deepfakes | S | Low |
| CRO025-MAP-0063 | D5-CTL-05 Privacy-By-Design Verification | AML.T0087 Gather Victim Identity Information | S | Low |
| CRO025-MAP-0064 | D5-CTL-05 Privacy-By-Design Verification | AML.T0062 Discover LLM Hallucinations | S | Low |
| CRO025-MAP-0065 | D5-CTL-06 Privacy-Preserving Ml Validation | AML.T0024 Exfiltration via AI Inference API | S | Low |
| CRO025-MAP-0066 | D5-CTL-06 Privacy-Preserving Ml Validation | AML.T0087 Gather Victim Identity Information | S | Low |
| CRO025-MAP-0067 | D6-CTL-01 Human-In-The-Loop For High-Risk Actions | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0068 | D6-CTL-01 Human-In-The-Loop For High-Risk Actions | AML.T0087 Gather Victim Identity Information | S | Low |
| CRO025-MAP-0069 | D6-CTL-02 Audit Trail Completeness | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0070 | D6-CTL-02 Audit Trail Completeness | AML.T0087 Gather Victim Identity Information | S | Low |
| CRO025-MAP-0071 | D6-CTL-03 Ai Model Card Completeness | AML.T0040 AI Model Inference API Access | S | Low |
| CRO025-MAP-0072 | D6-CTL-03 Ai Model Card Completeness | AML.T0044 Full AI Model Access | S | Low |
| CRO025-MAP-0073 | D6-CTL-04 Ai Incident Response Readiness | AML.T0090 LLM Response Rendering | S | Low |
| CRO025-MAP-0074 | D6-CTL-04 Ai Incident Response Readiness | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0075 | D6-CTL-05 Model Deprecation & Decommissioning | AML.T0040 AI Model Inference API Access | S | Low |
| CRO025-MAP-0076 | D6-CTL-05 Model Deprecation & Decommissioning | AML.T0044 Full AI Model Access | S | Low |
| CRO025-MAP-0077 | D6-CTL-06 Third-Party Ai Vendor Governance | AML.T0010 AI Supply Chain Compromise | S | Low |
| CRO025-MAP-0078 | D6-CTL-06 Third-Party Ai Vendor Governance | AML.T0109 AI Supply Chain Reputation Inflation | S | Low |
| CRO025-MAP-0079 | D6-CTL-07 Ai Resilience & Business Continuity | AML.T0046 Spamming AI System with Chaff Data | S | Low |
| CRO025-MAP-0080 | D6-CTL-07 Ai Resilience & Business Continuity | AML.T0029 Denial of AI Service | S | Low |
| CRO025-MAP-0081 | D7-CTL-H01 Ai-Generated Phishing Simulation | AML.T0001 Search Open AI Vulnerability Analysis | S | Low |
| CRO025-MAP-0082 | D7-CTL-H01 Ai-Generated Phishing Simulation | AML.T0020 Poison Training Data | S | Low |
| CRO025-MAP-0083 | D7-CTL-H02 Deepfake Detection Training | AML.T0020 Poison Training Data | S | Low |
| CRO025-MAP-0084 | D7-CTL-H02 Deepfake Detection Training | AML.T0042 Verify Attack | S | Low |
| CRO025-MAP-0085 | D7-CTL-H03 Out-Of-Band Authentication | AML.T0048 External Harms | S | Low |
| CRO025-MAP-0086 | D7-CTL-H03 Out-Of-Band Authentication | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0087 | D7-CTL-H04 Ai Social Engineering Ir | AML.T0042 Verify Attack | S | Low |
| CRO025-MAP-0088 | D7-CTL-H04 Ai Social Engineering Ir | AML.T0090 LLM Response Rendering | S | Low |
| CRO025-MAP-0089 | D7-CTL-H05 Ai-Enhanced External Attack Defense | AML.T0048 External Harms | S | Low |
| CRO025-MAP-0090 | D7-CTL-H05 Ai-Enhanced External Attack Defense | AML.T0052 Phishing | S | Low |
| CRO025-MAP-0091 | D8-CTL-01 Eu Ai Act Risk Tier Mapping | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0092 | D8-CTL-01 Eu Ai Act Risk Tier Mapping | AML.T0087 Gather Victim Identity Information | S | Low |
| CRO025-MAP-0093 | D8-CTL-02 Iso 42001 Gap Analysis | AML.T0001 Search Open AI Vulnerability Analysis | S | Low |
| CRO025-MAP-0094 | D8-CTL-02 Iso 42001 Gap Analysis | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0095 | D8-CTL-03 Gpai Technical Documentation Verification | AML.T0000 Search Open Technical Databases | S | Low |
| CRO025-MAP-0096 | D8-CTL-03 Gpai Technical Documentation Verification | AML.T0020 Poison Training Data | S | Low |
| CRO025-MAP-0097 | D8-CTL-04 Dora Ict Incident Reporting (Financial Sector) | AML.T0106 Discover AI Agent Configuration | S | Low |
| CRO025-MAP-0098 | D8-CTL-04 Dora Ict Incident Reporting (Financial Sector) | AML.T0007 Discover AI Artifacts | S | Low |
| CRO025-MAP-0099 | D8-CTL-05 Nist Sp 800-218A Compliance Check | AML.T0017 Develop Capabilities | S | Low |
| CRO025-MAP-0100 | D8-CTL-05 Nist Sp 800-218A Compliance Check | AML.T0064 Gather RAG-Indexed Targets | S | Low |
| CRO025-MAP-0101 | D9-CTL-01 Physical Harm Boundary Enforcement | AML.T0062 Discover LLM Hallucinations | P | Medium |
| CRO025-MAP-0102 | D9-CTL-01 Physical Harm Boundary Enforcement | AML.T0042 Verify Attack | P | Medium |
| CRO025-MAP-0103 | D9-CTL-02 Safe State And Graceful Degradation | AML.T0041 Physical Environment Access | S | Low |
| CRO025-MAP-0104 | D9-CTL-02 Safe State And Graceful Degradation | AML.T0110 AI Agent Context Poisoning | S | Low |
| CRO025-MAP-0105 | D9-CTL-03 Human Override And Emergency Stop | AML.T0040 AI Model Inference API Access | S | Low |
| CRO025-MAP-0106 | D9-CTL-03 Human Override And Emergency Stop | AML.T0044 Full AI Model Access | S | Low |
| CRO025-MAP-0107 | D9-CTL-04 Cyber-Physical Attack Detection | AML.T0042 Verify Attack | P | Medium |
| CRO025-MAP-0108 | D9-CTL-05 Physical Environment Integrity Monitoring | AML.T0041 Physical Environment Access | S | Low |
| CRO025-MAP-0109 | D9-CTL-05 Physical Environment Integrity Monitoring | AML.T0069 Discover LLM System Information | S | Low |
| CRO025-MAP-0110 | D9-CTL-06 Actuator Command Verification | AML.T0015 Evade AI Model | S | Low |
| CRO025-MAP-0111 | D9-CTL-06 Actuator Command Verification | AML.T0041 Physical Environment Access | S | Low |
| CRO025-MAP-0112 | D9-CTL-07 Physical Incident Evidence Preservation | AML.T0062 Discover LLM Hallucinations | P | Medium |