# CRO-034 — GAISSF–CSA Cloud Controls Matrix Mapping

**Version:** 1.0  
**Status:** Publication Candidate  
**Publisher:** ODA3 Institute  
**Verification date:** 29 June 2026

## Executive Summary

This document maps all 59 GAISSF v1.0 controls to the 17 security domains of CSA Cloud Controls Matrix v4.1. The register contains 281 domain-level mapping records. CCM v4.1 contains 207 controls and CAIQ v4.1 contains 283 questions. This crosswalk does not reproduce those control specifications or claim complete control-level coverage.

## Source Baseline

- GAISSF-NOR-001 and GAISSF-NOR-004 v1.0
- CSA Cloud Controls Matrix and CAIQ v4.1, released 27 January 2026
- STAR, CAIQ, Implementation Guidelines and Auditing Guidelines are separate layers

## CCM Domain Coverage

| Domain | Title | Mapped controls | Records |
|---|---|---:|---:|
| A&A | Audit & Assurance | 12 | 12 |
| AIS | Application & Interface Security | 28 | 28 |
| BCR | Business Continuity Management & Operational Resilience | 14 | 14 |
| CCC | Change Control & Configuration Management | 9 | 9 |
| CEK | Cryptography, Encryption & Key Management | 0 | 0 |
| DCS | Datacenter Security | 7 | 7 |
| DSP | Data Security & Privacy | 22 | 22 |
| GRC | Governance, Risk Management & Compliance | 37 | 37 |
| HRS | Human Resources Security | 5 | 5 |
| IAM | Identity & Access Management | 18 | 18 |
| IPY | Interoperability & Portability | 7 | 7 |
| IVS | Infrastructure & Virtualization Security | 13 | 13 |
| LOG | Logging & Monitoring | 43 | 43 |
| SEF | Security Incident Management, E-Discovery & Cloud Forensics | 27 | 27 |
| STA | Supply Chain Management, Transparency & Accountability | 12 | 12 |
| TVM | Threat & Vulnerability Management | 27 | 27 |
| UEM | Universal Endpoint Management | 0 | 0 |

## Mapping Register

| Record | GAISSF control | GAISSF title | CCM domain | Relationship | Confidence |
|---|---|---|---|---|---|
| CRO034-0001 | D1-CTL-01 | DATASET PROVENANCE & POISONING PREVENTION | DSP | SP | Medium-High |
| CRO034-0002 | D1-CTL-01 | DATASET PROVENANCE & POISONING PREVENTION | TVM | P | Medium |
| CRO034-0003 | D1-CTL-01 | DATASET PROVENANCE & POISONING PREVENTION | AIS | P | Medium |
| CRO034-0004 | D1-CTL-01 | DATASET PROVENANCE & POISONING PREVENTION | LOG | S | Medium |
| CRO034-0005 | D1-CTL-01 | DATASET PROVENANCE & POISONING PREVENTION | CCC | S | Medium |
| CRO034-0006 | D1-CTL-02 | MODEL EXTRACTION RESISTANCE | DSP | SP | Medium-High |
| CRO034-0007 | D1-CTL-02 | MODEL EXTRACTION RESISTANCE | TVM | P | Medium |
| CRO034-0008 | D1-CTL-02 | MODEL EXTRACTION RESISTANCE | AIS | P | Medium |
| CRO034-0009 | D1-CTL-02 | MODEL EXTRACTION RESISTANCE | LOG | S | Medium |
| CRO034-0010 | D1-CTL-02 | MODEL EXTRACTION RESISTANCE | CCC | S | Medium |
| CRO034-0011 | D1-CTL-03 | BEHAVIORAL DRIFT DETECTION | DSP | SP | Medium-High |
| CRO034-0012 | D1-CTL-03 | BEHAVIORAL DRIFT DETECTION | TVM | P | Medium |
| CRO034-0013 | D1-CTL-03 | BEHAVIORAL DRIFT DETECTION | AIS | P | Medium |
| CRO034-0014 | D1-CTL-03 | BEHAVIORAL DRIFT DETECTION | LOG | S | Medium |
| CRO034-0015 | D1-CTL-03 | BEHAVIORAL DRIFT DETECTION | CCC | S | Medium |
| CRO034-0016 | D1-CTL-04 | FEDERATED LEARNING POISONING PREVENTION | DSP | SP | Medium-High |
| CRO034-0017 | D1-CTL-04 | FEDERATED LEARNING POISONING PREVENTION | TVM | P | Medium |
| CRO034-0018 | D1-CTL-04 | FEDERATED LEARNING POISONING PREVENTION | AIS | P | Medium |
| CRO034-0019 | D1-CTL-04 | FEDERATED LEARNING POISONING PREVENTION | LOG | S | Medium |
| CRO034-0020 | D1-CTL-04 | FEDERATED LEARNING POISONING PREVENTION | CCC | S | Medium |
| CRO034-0021 | D1-CTL-05 | EMBEDDING SPACE ROBUSTNESS | DSP | SP | Medium-High |
| CRO034-0022 | D1-CTL-05 | EMBEDDING SPACE ROBUSTNESS | TVM | P | Medium |
| CRO034-0023 | D1-CTL-05 | EMBEDDING SPACE ROBUSTNESS | AIS | P | Medium |
| CRO034-0024 | D1-CTL-05 | EMBEDDING SPACE ROBUSTNESS | LOG | S | Medium |
| CRO034-0025 | D1-CTL-05 | EMBEDDING SPACE ROBUSTNESS | CCC | S | Medium |
| CRO034-0026 | D1-CTL-06 | POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING | DSP | SP | Medium-High |
| CRO034-0027 | D1-CTL-06 | POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING | TVM | P | Medium |
| CRO034-0028 | D1-CTL-06 | POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING | AIS | P | Medium |
| CRO034-0029 | D1-CTL-06 | POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING | LOG | S | Medium |
| CRO034-0030 | D1-CTL-06 | POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING | CCC | S | Medium |
| CRO034-0031 | D1-CTL-07 | LORA/ADAPTER INTEGRITY VERIFICATION | DSP | SP | Medium-High |
| CRO034-0032 | D1-CTL-07 | LORA/ADAPTER INTEGRITY VERIFICATION | TVM | P | Medium |
| CRO034-0033 | D1-CTL-07 | LORA/ADAPTER INTEGRITY VERIFICATION | AIS | P | Medium |
| CRO034-0034 | D1-CTL-07 | LORA/ADAPTER INTEGRITY VERIFICATION | LOG | S | Medium |
| CRO034-0035 | D1-CTL-07 | LORA/ADAPTER INTEGRITY VERIFICATION | CCC | S | Medium |
| CRO034-0036 | D1-CTL-08 | MODEL MERGE ATTACK DETECTION | DSP | SP | Medium-High |
| CRO034-0037 | D1-CTL-08 | MODEL MERGE ATTACK DETECTION | TVM | P | Medium |
| CRO034-0038 | D1-CTL-08 | MODEL MERGE ATTACK DETECTION | AIS | P | Medium |
| CRO034-0039 | D1-CTL-08 | MODEL MERGE ATTACK DETECTION | LOG | S | Medium |
| CRO034-0040 | D1-CTL-08 | MODEL MERGE ATTACK DETECTION | CCC | S | Medium |
| CRO034-0041 | D1-CTL-09 | QUANTIZATION BACKDOOR SCREENING | DSP | SP | Medium-High |
| CRO034-0042 | D1-CTL-09 | QUANTIZATION BACKDOOR SCREENING | TVM | P | Medium |
| CRO034-0043 | D1-CTL-09 | QUANTIZATION BACKDOOR SCREENING | AIS | P | Medium |
| CRO034-0044 | D1-CTL-09 | QUANTIZATION BACKDOOR SCREENING | LOG | S | Medium |
| CRO034-0045 | D1-CTL-09 | QUANTIZATION BACKDOOR SCREENING | CCC | S | Medium |
| CRO034-0046 | D2-CTL-01 | DIRECT PROMPT INJECTION PREVENTION | AIS | SP | Medium-High |
| CRO034-0047 | D2-CTL-01 | DIRECT PROMPT INJECTION PREVENTION | IVS | P | Medium |
| CRO034-0048 | D2-CTL-01 | DIRECT PROMPT INJECTION PREVENTION | IAM | P | Medium |
| CRO034-0049 | D2-CTL-01 | DIRECT PROMPT INJECTION PREVENTION | LOG | S | Medium |
| CRO034-0050 | D2-CTL-01 | DIRECT PROMPT INJECTION PREVENTION | TVM | S | Medium |
| CRO034-0051 | D2-CTL-02 | INDIRECT PROMPT INJECTION PREVENTION | AIS | SP | Medium-High |
| CRO034-0052 | D2-CTL-02 | INDIRECT PROMPT INJECTION PREVENTION | IVS | P | Medium |
| CRO034-0053 | D2-CTL-02 | INDIRECT PROMPT INJECTION PREVENTION | IAM | P | Medium |
| CRO034-0054 | D2-CTL-02 | INDIRECT PROMPT INJECTION PREVENTION | LOG | S | Medium |
| CRO034-0055 | D2-CTL-02 | INDIRECT PROMPT INJECTION PREVENTION | TVM | S | Medium |
| CRO034-0056 | D2-CTL-03 | JAILBREAK RESISTANCE TESTING | AIS | SP | Medium-High |
| CRO034-0057 | D2-CTL-03 | JAILBREAK RESISTANCE TESTING | IVS | P | Medium |
| CRO034-0058 | D2-CTL-03 | JAILBREAK RESISTANCE TESTING | IAM | P | Medium |
| CRO034-0059 | D2-CTL-03 | JAILBREAK RESISTANCE TESTING | LOG | S | Medium |
| CRO034-0060 | D2-CTL-03 | JAILBREAK RESISTANCE TESTING | TVM | S | Medium |
| CRO034-0061 | D2-CTL-04 | MULTI-MODAL INJECTION DEFENSE | AIS | SP | Medium-High |
| CRO034-0062 | D2-CTL-04 | MULTI-MODAL INJECTION DEFENSE | IVS | P | Medium |
| CRO034-0063 | D2-CTL-04 | MULTI-MODAL INJECTION DEFENSE | IAM | P | Medium |
| CRO034-0064 | D2-CTL-04 | MULTI-MODAL INJECTION DEFENSE | LOG | S | Medium |
| CRO034-0065 | D2-CTL-04 | MULTI-MODAL INJECTION DEFENSE | TVM | S | Medium |
| CRO034-0066 | D2-CTL-05 | FUNCTION CALL/TOOL CALL INJECTION PREVENTION | AIS | SP | Medium-High |
| CRO034-0067 | D2-CTL-05 | FUNCTION CALL/TOOL CALL INJECTION PREVENTION | IVS | P | Medium |
| CRO034-0068 | D2-CTL-05 | FUNCTION CALL/TOOL CALL INJECTION PREVENTION | IAM | P | Medium |
| CRO034-0069 | D2-CTL-05 | FUNCTION CALL/TOOL CALL INJECTION PREVENTION | LOG | S | Medium |
| CRO034-0070 | D2-CTL-05 | FUNCTION CALL/TOOL CALL INJECTION PREVENTION | TVM | S | Medium |
| CRO034-0071 | D2-CTL-06 | CROSS-CONTEXT HIJACKING MITIGATION | AIS | SP | Medium-High |
| CRO034-0072 | D2-CTL-06 | CROSS-CONTEXT HIJACKING MITIGATION | IVS | P | Medium |
| CRO034-0073 | D2-CTL-06 | CROSS-CONTEXT HIJACKING MITIGATION | IAM | P | Medium |
| CRO034-0074 | D2-CTL-06 | CROSS-CONTEXT HIJACKING MITIGATION | LOG | S | Medium |
| CRO034-0075 | D2-CTL-06 | CROSS-CONTEXT HIJACKING MITIGATION | TVM | S | Medium |
| CRO034-0076 | D3-CTL-01 | LEAST AGENCY ENFORCEMENT | AIS | SP | Medium-High |
| CRO034-0077 | D3-CTL-01 | LEAST AGENCY ENFORCEMENT | IAM | P | Medium |
| CRO034-0078 | D3-CTL-01 | LEAST AGENCY ENFORCEMENT | GRC | P | Medium |
| CRO034-0079 | D3-CTL-01 | LEAST AGENCY ENFORCEMENT | LOG | S | Medium |
| CRO034-0080 | D3-CTL-01 | LEAST AGENCY ENFORCEMENT | SEF | S | Medium |
| CRO034-0081 | D3-CTL-02 | INTER-AGENT COMMUNICATION SECURITY | AIS | SP | Medium-High |
| CRO034-0082 | D3-CTL-02 | INTER-AGENT COMMUNICATION SECURITY | IAM | P | Medium |
| CRO034-0083 | D3-CTL-02 | INTER-AGENT COMMUNICATION SECURITY | GRC | P | Medium |
| CRO034-0084 | D3-CTL-02 | INTER-AGENT COMMUNICATION SECURITY | LOG | S | Medium |
| CRO034-0085 | D3-CTL-02 | INTER-AGENT COMMUNICATION SECURITY | SEF | S | Medium |
| CRO034-0086 | D3-CTL-03 | AGENTIC PROMPT CHAINING DETECTION | AIS | SP | Medium-High |
| CRO034-0087 | D3-CTL-03 | AGENTIC PROMPT CHAINING DETECTION | IAM | P | Medium |
| CRO034-0088 | D3-CTL-03 | AGENTIC PROMPT CHAINING DETECTION | GRC | P | Medium |
| CRO034-0089 | D3-CTL-03 | AGENTIC PROMPT CHAINING DETECTION | LOG | S | Medium |
| CRO034-0090 | D3-CTL-03 | AGENTIC PROMPT CHAINING DETECTION | SEF | S | Medium |
| CRO034-0091 | D3-CTL-04 | EMBODIED AI SAFETY CONTROLS | AIS | SP | Medium-High |
| CRO034-0092 | D3-CTL-04 | EMBODIED AI SAFETY CONTROLS | IAM | P | Medium |
| CRO034-0093 | D3-CTL-04 | EMBODIED AI SAFETY CONTROLS | GRC | P | Medium |
| CRO034-0094 | D3-CTL-04 | EMBODIED AI SAFETY CONTROLS | LOG | S | Medium |
| CRO034-0095 | D3-CTL-04 | EMBODIED AI SAFETY CONTROLS | SEF | S | Medium |
| CRO034-0096 | D3-CTL-05 | MULTI-AGENT TRUST CHAIN ATTESTATION | AIS | SP | Medium-High |
| CRO034-0097 | D3-CTL-05 | MULTI-AGENT TRUST CHAIN ATTESTATION | IAM | P | Medium |
| CRO034-0098 | D3-CTL-05 | MULTI-AGENT TRUST CHAIN ATTESTATION | GRC | P | Medium |
| CRO034-0099 | D3-CTL-05 | MULTI-AGENT TRUST CHAIN ATTESTATION | LOG | S | Medium |
| CRO034-0100 | D3-CTL-05 | MULTI-AGENT TRUST CHAIN ATTESTATION | SEF | S | Medium |
| CRO034-0101 | D3-CTL-06 | PERSISTENT MEMORY EXFILTRATION PREVENTION | AIS | SP | Medium-High |
| CRO034-0102 | D3-CTL-06 | PERSISTENT MEMORY EXFILTRATION PREVENTION | IAM | P | Medium |
| CRO034-0103 | D3-CTL-06 | PERSISTENT MEMORY EXFILTRATION PREVENTION | GRC | P | Medium |
| CRO034-0104 | D3-CTL-06 | PERSISTENT MEMORY EXFILTRATION PREVENTION | LOG | S | Medium |
| CRO034-0105 | D3-CTL-06 | PERSISTENT MEMORY EXFILTRATION PREVENTION | SEF | S | Medium |
| CRO034-0106 | D3-CTL-07 | SECURE MEMORY LIFECYCLE MANAGEMENT | AIS | SP | Medium-High |
| CRO034-0107 | D3-CTL-07 | SECURE MEMORY LIFECYCLE MANAGEMENT | IAM | P | Medium |
| CRO034-0108 | D3-CTL-07 | SECURE MEMORY LIFECYCLE MANAGEMENT | GRC | P | Medium |
| CRO034-0109 | D3-CTL-07 | SECURE MEMORY LIFECYCLE MANAGEMENT | LOG | S | Medium |
| CRO034-0110 | D3-CTL-07 | SECURE MEMORY LIFECYCLE MANAGEMENT | SEF | S | Medium |
| CRO034-0111 | D4-CTL-01 | AI BILL OF MATERIALS (AI BOM) MAINTENANCE | STA | SP | Medium-High |
| CRO034-0112 | D4-CTL-01 | AI BILL OF MATERIALS (AI BOM) MAINTENANCE | GRC | P | Medium |
| CRO034-0113 | D4-CTL-01 | AI BILL OF MATERIALS (AI BOM) MAINTENANCE | DSP | P | Medium |
| CRO034-0114 | D4-CTL-01 | AI BILL OF MATERIALS (AI BOM) MAINTENANCE | TVM | S | Medium |
| CRO034-0115 | D4-CTL-01 | AI BILL OF MATERIALS (AI BOM) MAINTENANCE | IPY | S | Medium |
| CRO034-0116 | D4-CTL-02 | MODEL FILE & ARTIFACT SCANNING | STA | SP | Medium-High |
| CRO034-0117 | D4-CTL-02 | MODEL FILE & ARTIFACT SCANNING | GRC | P | Medium |
| CRO034-0118 | D4-CTL-02 | MODEL FILE & ARTIFACT SCANNING | DSP | P | Medium |
| CRO034-0119 | D4-CTL-02 | MODEL FILE & ARTIFACT SCANNING | TVM | S | Medium |
| CRO034-0120 | D4-CTL-02 | MODEL FILE & ARTIFACT SCANNING | IPY | S | Medium |
| CRO034-0121 | D4-CTL-03 | MODEL HUB & REGISTRY VETTING | STA | SP | Medium-High |
| CRO034-0122 | D4-CTL-03 | MODEL HUB & REGISTRY VETTING | GRC | P | Medium |
| CRO034-0123 | D4-CTL-03 | MODEL HUB & REGISTRY VETTING | DSP | P | Medium |
| CRO034-0124 | D4-CTL-03 | MODEL HUB & REGISTRY VETTING | TVM | S | Medium |
| CRO034-0125 | D4-CTL-03 | MODEL HUB & REGISTRY VETTING | IPY | S | Medium |
| CRO034-0126 | D4-CTL-04 | MCP SERVER BEHAVIORAL MONITORING | STA | SP | Medium-High |
| CRO034-0127 | D4-CTL-04 | MCP SERVER BEHAVIORAL MONITORING | GRC | P | Medium |
| CRO034-0128 | D4-CTL-04 | MCP SERVER BEHAVIORAL MONITORING | DSP | P | Medium |
| CRO034-0129 | D4-CTL-04 | MCP SERVER BEHAVIORAL MONITORING | TVM | S | Medium |
| CRO034-0130 | D4-CTL-04 | MCP SERVER BEHAVIORAL MONITORING | IPY | S | Medium |
| CRO034-0131 | D4-CTL-05 | THIRD-PARTY AI API SECURITY ASSESSMENT | STA | SP | Medium-High |
| CRO034-0132 | D4-CTL-05 | THIRD-PARTY AI API SECURITY ASSESSMENT | GRC | P | Medium |
| CRO034-0133 | D4-CTL-05 | THIRD-PARTY AI API SECURITY ASSESSMENT | DSP | P | Medium |
| CRO034-0134 | D4-CTL-05 | THIRD-PARTY AI API SECURITY ASSESSMENT | TVM | S | Medium |
| CRO034-0135 | D4-CTL-05 | THIRD-PARTY AI API SECURITY ASSESSMENT | IPY | S | Medium |
| CRO034-0136 | D4-CTL-06 | SHADOW AI DISCOVERY & GOVERNANCE | STA | SP | Medium-High |
| CRO034-0137 | D4-CTL-06 | SHADOW AI DISCOVERY & GOVERNANCE | GRC | P | Medium |
| CRO034-0138 | D4-CTL-06 | SHADOW AI DISCOVERY & GOVERNANCE | DSP | P | Medium |
| CRO034-0139 | D4-CTL-06 | SHADOW AI DISCOVERY & GOVERNANCE | TVM | S | Medium |
| CRO034-0140 | D4-CTL-06 | SHADOW AI DISCOVERY & GOVERNANCE | IPY | S | Medium |
| CRO034-0141 | D4-CTL-07 | AI SOFTWARE COMPOSITION ANALYSIS (SCA) | STA | SP | Medium-High |
| CRO034-0142 | D4-CTL-07 | AI SOFTWARE COMPOSITION ANALYSIS (SCA) | GRC | P | Medium |
| CRO034-0143 | D4-CTL-07 | AI SOFTWARE COMPOSITION ANALYSIS (SCA) | DSP | P | Medium |
| CRO034-0144 | D4-CTL-07 | AI SOFTWARE COMPOSITION ANALYSIS (SCA) | TVM | S | Medium |
| CRO034-0145 | D4-CTL-07 | AI SOFTWARE COMPOSITION ANALYSIS (SCA) | IPY | S | Medium |
| CRO034-0146 | D5-CTL-01 | HARMFUL CONTENT BLOCKING | DSP | SP | Medium-High |
| CRO034-0147 | D5-CTL-01 | HARMFUL CONTENT BLOCKING | AIS | P | Medium |
| CRO034-0148 | D5-CTL-01 | HARMFUL CONTENT BLOCKING | GRC | P | Medium |
| CRO034-0149 | D5-CTL-01 | HARMFUL CONTENT BLOCKING | LOG | S | Medium |
| CRO034-0150 | D5-CTL-02 | PII LEAKAGE PREVENTION | DSP | SP | Medium-High |
| CRO034-0151 | D5-CTL-02 | PII LEAKAGE PREVENTION | AIS | P | Medium |
| CRO034-0152 | D5-CTL-02 | PII LEAKAGE PREVENTION | GRC | P | Medium |
| CRO034-0153 | D5-CTL-02 | PII LEAKAGE PREVENTION | LOG | S | Medium |
| CRO034-0154 | D5-CTL-03 | COPYRIGHT DETECTION | DSP | SP | Medium-High |
| CRO034-0155 | D5-CTL-03 | COPYRIGHT DETECTION | AIS | P | Medium |
| CRO034-0156 | D5-CTL-03 | COPYRIGHT DETECTION | GRC | P | Medium |
| CRO034-0157 | D5-CTL-03 | COPYRIGHT DETECTION | LOG | S | Medium |
| CRO034-0158 | D5-CTL-04 | AI WATERMARKING ROBUSTNESS | DSP | SP | Medium-High |
| CRO034-0159 | D5-CTL-04 | AI WATERMARKING ROBUSTNESS | AIS | P | Medium |
| CRO034-0160 | D5-CTL-04 | AI WATERMARKING ROBUSTNESS | GRC | P | Medium |
| CRO034-0161 | D5-CTL-04 | AI WATERMARKING ROBUSTNESS | LOG | S | Medium |
| CRO034-0162 | D5-CTL-05 | PRIVACY-BY-DESIGN VERIFICATION | DSP | SP | Medium-High |
| CRO034-0163 | D5-CTL-05 | PRIVACY-BY-DESIGN VERIFICATION | AIS | P | Medium |
| CRO034-0164 | D5-CTL-05 | PRIVACY-BY-DESIGN VERIFICATION | GRC | P | Medium |
| CRO034-0165 | D5-CTL-05 | PRIVACY-BY-DESIGN VERIFICATION | LOG | S | Medium |
| CRO034-0166 | D5-CTL-06 | PRIVACY-PRESERVING ML VALIDATION | DSP | SP | Medium-High |
| CRO034-0167 | D5-CTL-06 | PRIVACY-PRESERVING ML VALIDATION | AIS | P | Medium |
| CRO034-0168 | D5-CTL-06 | PRIVACY-PRESERVING ML VALIDATION | GRC | P | Medium |
| CRO034-0169 | D5-CTL-06 | PRIVACY-PRESERVING ML VALIDATION | LOG | S | Medium |
| CRO034-0170 | D6-CTL-01 | HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS | GRC | SP | Medium-High |
| CRO034-0171 | D6-CTL-01 | HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS | A&A | P | Medium |
| CRO034-0172 | D6-CTL-01 | HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS | LOG | P | Medium |
| CRO034-0173 | D6-CTL-01 | HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS | SEF | S | Medium |
| CRO034-0174 | D6-CTL-01 | HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS | BCR | S | Medium |
| CRO034-0175 | D6-CTL-02 | AUDIT TRAIL COMPLETENESS | GRC | SP | Medium-High |
| CRO034-0176 | D6-CTL-02 | AUDIT TRAIL COMPLETENESS | A&A | P | Medium |
| CRO034-0177 | D6-CTL-02 | AUDIT TRAIL COMPLETENESS | LOG | P | Medium |
| CRO034-0178 | D6-CTL-02 | AUDIT TRAIL COMPLETENESS | SEF | S | Medium |
| CRO034-0179 | D6-CTL-02 | AUDIT TRAIL COMPLETENESS | BCR | S | Medium |
| CRO034-0180 | D6-CTL-03 | AI MODEL CARD COMPLETENESS | GRC | SP | Medium-High |
| CRO034-0181 | D6-CTL-03 | AI MODEL CARD COMPLETENESS | A&A | P | Medium |
| CRO034-0182 | D6-CTL-03 | AI MODEL CARD COMPLETENESS | LOG | P | Medium |
| CRO034-0183 | D6-CTL-03 | AI MODEL CARD COMPLETENESS | SEF | S | Medium |
| CRO034-0184 | D6-CTL-03 | AI MODEL CARD COMPLETENESS | BCR | S | Medium |
| CRO034-0185 | D6-CTL-04 | AI INCIDENT RESPONSE READINESS | GRC | SP | Medium-High |
| CRO034-0186 | D6-CTL-04 | AI INCIDENT RESPONSE READINESS | A&A | P | Medium |
| CRO034-0187 | D6-CTL-04 | AI INCIDENT RESPONSE READINESS | LOG | P | Medium |
| CRO034-0188 | D6-CTL-04 | AI INCIDENT RESPONSE READINESS | SEF | S | Medium |
| CRO034-0189 | D6-CTL-04 | AI INCIDENT RESPONSE READINESS | BCR | S | Medium |
| CRO034-0190 | D6-CTL-05 | MODEL DEPRECATION & DECOMMISSIONING | GRC | SP | Medium-High |
| CRO034-0191 | D6-CTL-05 | MODEL DEPRECATION & DECOMMISSIONING | A&A | P | Medium |
| CRO034-0192 | D6-CTL-05 | MODEL DEPRECATION & DECOMMISSIONING | LOG | P | Medium |
| CRO034-0193 | D6-CTL-05 | MODEL DEPRECATION & DECOMMISSIONING | SEF | S | Medium |
| CRO034-0194 | D6-CTL-05 | MODEL DEPRECATION & DECOMMISSIONING | BCR | S | Medium |
| CRO034-0195 | D6-CTL-06 | THIRD-PARTY AI VENDOR GOVERNANCE | GRC | SP | Medium-High |
| CRO034-0196 | D6-CTL-06 | THIRD-PARTY AI VENDOR GOVERNANCE | A&A | P | Medium |
| CRO034-0197 | D6-CTL-06 | THIRD-PARTY AI VENDOR GOVERNANCE | LOG | P | Medium |
| CRO034-0198 | D6-CTL-06 | THIRD-PARTY AI VENDOR GOVERNANCE | SEF | S | Medium |
| CRO034-0199 | D6-CTL-06 | THIRD-PARTY AI VENDOR GOVERNANCE | BCR | S | Medium |
| CRO034-0200 | D6-CTL-07 | AI RESILIENCE & BUSINESS CONTINUITY | GRC | SP | Medium-High |
| CRO034-0201 | D6-CTL-07 | AI RESILIENCE & BUSINESS CONTINUITY | A&A | P | Medium |
| CRO034-0202 | D6-CTL-07 | AI RESILIENCE & BUSINESS CONTINUITY | LOG | P | Medium |
| CRO034-0203 | D6-CTL-07 | AI RESILIENCE & BUSINESS CONTINUITY | SEF | S | Medium |
| CRO034-0204 | D6-CTL-07 | AI RESILIENCE & BUSINESS CONTINUITY | BCR | S | Medium |
| CRO034-0205 | D7-CTL-H01 | AI-GENERATED PHISHING SIMULATION | HRS | SP | Medium-High |
| CRO034-0206 | D7-CTL-H01 | AI-GENERATED PHISHING SIMULATION | IAM | P | Medium |
| CRO034-0207 | D7-CTL-H01 | AI-GENERATED PHISHING SIMULATION | SEF | P | Medium |
| CRO034-0208 | D7-CTL-H01 | AI-GENERATED PHISHING SIMULATION | TVM | S | Medium |
| CRO034-0209 | D7-CTL-H01 | AI-GENERATED PHISHING SIMULATION | GRC | S | Medium |
| CRO034-0210 | D7-CTL-H02 | DEEPFAKE DETECTION TRAINING | HRS | SP | Medium-High |
| CRO034-0211 | D7-CTL-H02 | DEEPFAKE DETECTION TRAINING | IAM | P | Medium |
| CRO034-0212 | D7-CTL-H02 | DEEPFAKE DETECTION TRAINING | SEF | P | Medium |
| CRO034-0213 | D7-CTL-H02 | DEEPFAKE DETECTION TRAINING | TVM | S | Medium |
| CRO034-0214 | D7-CTL-H02 | DEEPFAKE DETECTION TRAINING | GRC | S | Medium |
| CRO034-0215 | D7-CTL-H03 | OUT-OF-BAND AUTHENTICATION | HRS | SP | Medium-High |
| CRO034-0216 | D7-CTL-H03 | OUT-OF-BAND AUTHENTICATION | IAM | P | Medium |
| CRO034-0217 | D7-CTL-H03 | OUT-OF-BAND AUTHENTICATION | SEF | P | Medium |
| CRO034-0218 | D7-CTL-H03 | OUT-OF-BAND AUTHENTICATION | TVM | S | Medium |
| CRO034-0219 | D7-CTL-H03 | OUT-OF-BAND AUTHENTICATION | GRC | S | Medium |
| CRO034-0220 | D7-CTL-H04 | AI SOCIAL ENGINEERING IR | HRS | SP | Medium-High |
| CRO034-0221 | D7-CTL-H04 | AI SOCIAL ENGINEERING IR | IAM | P | Medium |
| CRO034-0222 | D7-CTL-H04 | AI SOCIAL ENGINEERING IR | SEF | P | Medium |
| CRO034-0223 | D7-CTL-H04 | AI SOCIAL ENGINEERING IR | TVM | S | Medium |
| CRO034-0224 | D7-CTL-H04 | AI SOCIAL ENGINEERING IR | GRC | S | Medium |
| CRO034-0225 | D7-CTL-H05 | AI-ENHANCED EXTERNAL ATTACK DEFENSE | HRS | SP | Medium-High |
| CRO034-0226 | D7-CTL-H05 | AI-ENHANCED EXTERNAL ATTACK DEFENSE | IAM | P | Medium |
| CRO034-0227 | D7-CTL-H05 | AI-ENHANCED EXTERNAL ATTACK DEFENSE | SEF | P | Medium |
| CRO034-0228 | D7-CTL-H05 | AI-ENHANCED EXTERNAL ATTACK DEFENSE | TVM | S | Medium |
| CRO034-0229 | D7-CTL-H05 | AI-ENHANCED EXTERNAL ATTACK DEFENSE | GRC | S | Medium |
| CRO034-0230 | D8-CTL-01 | EU AI ACT RISK TIER MAPPING | GRC | SP | Medium-High |
| CRO034-0231 | D8-CTL-01 | EU AI ACT RISK TIER MAPPING | A&A | P | Medium |
| CRO034-0232 | D8-CTL-01 | EU AI ACT RISK TIER MAPPING | STA | P | Medium |
| CRO034-0233 | D8-CTL-02 | ISO 42001 GAP ANALYSIS | GRC | SP | Medium-High |
| CRO034-0234 | D8-CTL-02 | ISO 42001 GAP ANALYSIS | A&A | P | Medium |
| CRO034-0235 | D8-CTL-02 | ISO 42001 GAP ANALYSIS | STA | P | Medium |
| CRO034-0236 | D8-CTL-03 | GPAI TECHNICAL DOCUMENTATION VERIFICATION | GRC | SP | Medium-High |
| CRO034-0237 | D8-CTL-03 | GPAI TECHNICAL DOCUMENTATION VERIFICATION | A&A | P | Medium |
| CRO034-0238 | D8-CTL-03 | GPAI TECHNICAL DOCUMENTATION VERIFICATION | STA | P | Medium |
| CRO034-0239 | D8-CTL-04 | DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR) | GRC | SP | Medium-High |
| CRO034-0240 | D8-CTL-04 | DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR) | A&A | P | Medium |
| CRO034-0241 | D8-CTL-04 | DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR) | STA | P | Medium |
| CRO034-0242 | D8-CTL-04 | DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR) | SEF | S | Medium |
| CRO034-0243 | D8-CTL-04 | DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR) | LOG | S | Medium |
| CRO034-0244 | D8-CTL-05 | NIST SP 800-218A COMPLIANCE CHECK | GRC | SP | Medium-High |
| CRO034-0245 | D8-CTL-05 | NIST SP 800-218A COMPLIANCE CHECK | A&A | P | Medium |
| CRO034-0246 | D8-CTL-05 | NIST SP 800-218A COMPLIANCE CHECK | STA | P | Medium |
| CRO034-0247 | D9-CTL-01 | PHYSICAL HARM BOUNDARY ENFORCEMENT | DCS | SP | Medium-High |
| CRO034-0248 | D9-CTL-01 | PHYSICAL HARM BOUNDARY ENFORCEMENT | IVS | P | Medium |
| CRO034-0249 | D9-CTL-01 | PHYSICAL HARM BOUNDARY ENFORCEMENT | BCR | P | Medium |
| CRO034-0250 | D9-CTL-01 | PHYSICAL HARM BOUNDARY ENFORCEMENT | SEF | S | Medium |
| CRO034-0251 | D9-CTL-01 | PHYSICAL HARM BOUNDARY ENFORCEMENT | LOG | S | Medium |
| CRO034-0252 | D9-CTL-02 | SAFE STATE AND GRACEFUL DEGRADATION | DCS | SP | Medium-High |
| CRO034-0253 | D9-CTL-02 | SAFE STATE AND GRACEFUL DEGRADATION | IVS | P | Medium |
| CRO034-0254 | D9-CTL-02 | SAFE STATE AND GRACEFUL DEGRADATION | BCR | P | Medium |
| CRO034-0255 | D9-CTL-02 | SAFE STATE AND GRACEFUL DEGRADATION | SEF | S | Medium |
| CRO034-0256 | D9-CTL-02 | SAFE STATE AND GRACEFUL DEGRADATION | LOG | S | Medium |
| CRO034-0257 | D9-CTL-03 | HUMAN OVERRIDE AND EMERGENCY STOP | DCS | SP | Medium-High |
| CRO034-0258 | D9-CTL-03 | HUMAN OVERRIDE AND EMERGENCY STOP | IVS | P | Medium |
| CRO034-0259 | D9-CTL-03 | HUMAN OVERRIDE AND EMERGENCY STOP | BCR | P | Medium |
| CRO034-0260 | D9-CTL-03 | HUMAN OVERRIDE AND EMERGENCY STOP | SEF | S | Medium |
| CRO034-0261 | D9-CTL-03 | HUMAN OVERRIDE AND EMERGENCY STOP | LOG | S | Medium |
| CRO034-0262 | D9-CTL-04 | CYBER-PHYSICAL ATTACK DETECTION | DCS | SP | Medium-High |
| CRO034-0263 | D9-CTL-04 | CYBER-PHYSICAL ATTACK DETECTION | IVS | P | Medium |
| CRO034-0264 | D9-CTL-04 | CYBER-PHYSICAL ATTACK DETECTION | BCR | P | Medium |
| CRO034-0265 | D9-CTL-04 | CYBER-PHYSICAL ATTACK DETECTION | SEF | S | Medium |
| CRO034-0266 | D9-CTL-04 | CYBER-PHYSICAL ATTACK DETECTION | LOG | S | Medium |
| CRO034-0267 | D9-CTL-05 | PHYSICAL ENVIRONMENT INTEGRITY MONITORING | DCS | SP | Medium-High |
| CRO034-0268 | D9-CTL-05 | PHYSICAL ENVIRONMENT INTEGRITY MONITORING | IVS | P | Medium |
| CRO034-0269 | D9-CTL-05 | PHYSICAL ENVIRONMENT INTEGRITY MONITORING | BCR | P | Medium |
| CRO034-0270 | D9-CTL-05 | PHYSICAL ENVIRONMENT INTEGRITY MONITORING | SEF | S | Medium |
| CRO034-0271 | D9-CTL-05 | PHYSICAL ENVIRONMENT INTEGRITY MONITORING | LOG | S | Medium |
| CRO034-0272 | D9-CTL-06 | ACTUATOR COMMAND VERIFICATION | DCS | SP | Medium-High |
| CRO034-0273 | D9-CTL-06 | ACTUATOR COMMAND VERIFICATION | IVS | P | Medium |
| CRO034-0274 | D9-CTL-06 | ACTUATOR COMMAND VERIFICATION | BCR | P | Medium |
| CRO034-0275 | D9-CTL-06 | ACTUATOR COMMAND VERIFICATION | SEF | S | Medium |
| CRO034-0276 | D9-CTL-06 | ACTUATOR COMMAND VERIFICATION | LOG | S | Medium |
| CRO034-0277 | D9-CTL-07 | PHYSICAL INCIDENT EVIDENCE PRESERVATION | DCS | SP | Medium-High |
| CRO034-0278 | D9-CTL-07 | PHYSICAL INCIDENT EVIDENCE PRESERVATION | IVS | P | Medium |
| CRO034-0279 | D9-CTL-07 | PHYSICAL INCIDENT EVIDENCE PRESERVATION | BCR | P | Medium |
| CRO034-0280 | D9-CTL-07 | PHYSICAL INCIDENT EVIDENCE PRESERVATION | SEF | S | Medium |
| CRO034-0281 | D9-CTL-07 | PHYSICAL INCIDENT EVIDENCE PRESERVATION | LOG | S | Medium |

## Limitations

- CSA endorsement or affiliation
- STAR listing, certification or attestation
- CAIQ submission or validation
- Proof of implementation or operating effectiveness
- Control-specification-level mapping to all 207 CCM controls
- Cloud-provider-specific configuration evidence
- Automatic assignment of shared responsibility

© 2026 ODA3 Pvt Ltd. Published by ODA3 Institute.