@blamejs/exceptd-skills 0.12.27 → 0.12.28

package/data/_indexes/chains.json

@@ -3609,9 +3609,11 @@
       "attack-surface-pentest",
       "identity-assurance",
       "webapp-security",
-      "container-runtime-security"
+      "container-runtime-security",
+      "cloud-iam-incident",
+      "idp-incident-response"
     ],
-    "skill_count": 4,
+    "skill_count": 6,
     "chain": {
       "atlas": [
         {
@@ -3634,15 +3636,58 @@
         "T1059",
         "T1068",
         "T1078",
+        "T1078.004",
+        "T1098.001",
         "T1110",
         "T1133",
         "T1190",
+        "T1199",
         "T1505",
+        "T1538",
+        "T1552.005",
         "T1556",
+        "T1556.007",
+        "T1580",
+        "T1606.002",
         "T1610",
         "T1611"
       ],
       "framework_gaps": [
+        {
+          "id": "AU-ISM-1546-Cloud-Service-Account",
+          "framework": "ACSC ISM (Australian Government Information Security Manual)",
+          "control_name": "Multi-factor authentication for privileged users and remote access"
+        },
+        {
+          "id": "AU-ISM-1559-IdP",
+          "framework": "AU ISM",
+          "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension"
+        },
+        {
+          "id": "AWS-Security-Hub-Coverage-Gap",
+          "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
+          "control_name": "CSP-native posture-tool baseline (cross-provider gap class)"
+        },
+        {
+          "id": "CISA-Snowflake-AA24-IdP-Cloud",
+          "framework": "CISA (US) - Cross-framework advisory",
+          "control_name": "CISA Snowflake breach advisory - IdP-to-cloud chained-compromise"
+        },
+        {
+          "id": "DORA-Art-19-IdP-4h",
+          "framework": "EU DORA",
+          "control_name": "Major-ICT-related-incident notification — IdP-specific 4-hour clock"
+        },
+        {
+          "id": "FedRAMP-IL5-IAM-Federated",
+          "framework": "FedRAMP (US)",
+          "control_name": "FedRAMP Impact-Level 5 baseline IAM controls"
+        },
+        {
+          "id": "ISO-27001-2022-A.5.16-Federated",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Identity Management + Authentication Information — federated-state extension"
+        },
         {
           "id": "ISO-27001-2022-A.8.28",
           "framework": "ISO/IEC 27001:2022",
@@ -3653,6 +3698,16 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ISO-27017-Cloud-IAM",
+          "framework": "ISO/IEC 27017:2015",
+          "control_name": "ISO/IEC 27017 cloud-services security extension to ISO/IEC 27001"
+        },
+        {
+          "id": "NIS2-Art-21-Federated-Identity",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Cryptography + Access Control — federated-identity extension"
+        },
         {
           "id": "NIS2-Art21-patch-management",
           "framework": "EU NIS2 Directive",
@@ -3673,16 +3728,31 @@
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Account Management"
         },
+        {
+          "id": "NIST-800-53-AC-2-Cross-Account",
+          "framework": "NIST 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
         {
           "id": "NIST-800-53-CM-7",
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Least Functionality"
         },
+        {
+          "id": "NIST-800-53-IA-5-Federated",
+          "framework": "NIST 800-53 Rev.5",
+          "control_name": "Authenticator Management — federated-trust extension"
+        },
         {
           "id": "NIST-800-63B-rev4",
           "framework": "NIST SP 800-63B Rev 4 (Digital Identity Guidelines — Authentication & Lifecycle Mgmt)",
           "control_name": "Authentication and Lifecycle Management (AAL/IAL/FAL)"
         },
+        {
+          "id": "OFAC-Sanctions-Threat-Actor-Negotiation",
+          "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
+          "control_name": "Sanctions screening on ransomware-payment / threat-actor negotiation"
+        },
         {
           "id": "OWASP-ASVS-v5.0-V14",
           "framework": "OWASP ASVS v5.0",
@@ -3713,13 +3783,43 @@
           "framework": "SLSA v1.0 (Supply-chain Levels for Software Artifacts) — Build Track",
           "control_name": "Hardened build platform with non-falsifiable provenance"
         },
+        {
+          "id": "SOC2-CC6-Access-Key-Leak-Public-Repo",
+          "framework": "AICPA SOC 2 Trust Services Criteria",
+          "control_name": "Logical Access Controls"
+        },
+        {
+          "id": "SOC2-CC6-OAuth-Consent",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls — OAuth consent extension"
+        },
         {
           "id": "SOC2-CC6-logical-access",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
           "control_name": "Logical and Physical Access Controls"
+        },
+        {
+          "id": "UK-CAF-B2-Cloud-IAM",
+          "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
+          "control_name": "Identity and Access Control"
+        },
+        {
+          "id": "UK-CAF-B2-IdP-Tenant",
+          "framework": "UK NCSC CAF",
+          "control_name": "Identity and Access Control — IdP-tenant control-plane extension"
         }
       ],
       "d3fend": [
+        {
+          "id": "D3-CAA",
+          "name": "Credential Access Auditing",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
         {
           "id": "D3-CSPP",
           "name": "Client-server Payload Profiling",
@@ -3730,6 +3830,16 @@
           "name": "Executable Allowlisting",
           "tactic": "Harden"
         },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
+          "tactic": "Harden"
+        },
         {
           "id": "D3-NTA",
           "name": "Network Traffic Analysis",
@@ -3747,6 +3857,11 @@
           "title": "JSON Web Token (JWT)",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-7591",
+          "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8032",
           "title": "Edwards-Curve Digital Signature Algorithm (EdDSA)",
@@ -3757,16 +3872,31 @@
           "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-8693",
+          "title": "OAuth 2.0 Token Exchange",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8725",
           "title": "JSON Web Token Best Current Practices",
           "status": "Best Current Practice"
         },
+        {
+          "id": "RFC-9068",
+          "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9114",
           "title": "HTTP/3",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-9421",
+          "title": "HTTP Message Signatures",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9700",
           "title": "Best Current Practice for OAuth 2.0 Security",
@@ -3783,14 +3913,105 @@
   "CWE-284": {
     "name": "Improper Access Control",
     "category": "Access Control",
-    "referencing_skills": [],
-    "skill_count": 0,
+    "referencing_skills": [
+      "idp-incident-response"
+    ],
+    "skill_count": 1,
     "chain": {
       "atlas": [],
-      "attack_refs": [],
-      "framework_gaps": [],
-      "d3fend": [],
-      "rfc_refs": []
+      "attack_refs": [
+        "T1078.004",
+        "T1098.001",
+        "T1199",
+        "T1556.007",
+        "T1606.002"
+      ],
+      "framework_gaps": [
+        {
+          "id": "AU-ISM-1559-IdP",
+          "framework": "AU ISM",
+          "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension"
+        },
+        {
+          "id": "DORA-Art-19-IdP-4h",
+          "framework": "EU DORA",
+          "control_name": "Major-ICT-related-incident notification — IdP-specific 4-hour clock"
+        },
+        {
+          "id": "ISO-27001-2022-A.5.16-Federated",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Identity Management + Authentication Information — federated-state extension"
+        },
+        {
+          "id": "NIS2-Art-21-Federated-Identity",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Cryptography + Access Control — federated-identity extension"
+        },
+        {
+          "id": "NIST-800-53-IA-5-Federated",
+          "framework": "NIST 800-53 Rev.5",
+          "control_name": "Authenticator Management — federated-trust extension"
+        },
+        {
+          "id": "OFAC-Sanctions-Threat-Actor-Negotiation",
+          "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
+          "control_name": "Sanctions screening on ransomware-payment / threat-actor negotiation"
+        },
+        {
+          "id": "SOC2-CC6-OAuth-Consent",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls — OAuth consent extension"
+        },
+        {
+          "id": "UK-CAF-B2-IdP-Tenant",
+          "framework": "UK NCSC CAF",
+          "control_name": "Identity and Access Control — IdP-tenant control-plane extension"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
+        }
+      ],
+      "rfc_refs": [
+        {
+          "id": "RFC-7519",
+          "title": "JSON Web Token (JWT)",
+          "status": "Proposed Standard"
+        },
+        {
+          "id": "RFC-7591",
+          "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+          "status": "Proposed Standard"
+        },
+        {
+          "id": "RFC-8725",
+          "title": "JSON Web Token Best Current Practices",
+          "status": "Best Current Practice"
+        },
+        {
+          "id": "RFC-9421",
+          "title": "HTTP Message Signatures",
+          "status": "Proposed Standard"
+        }
+      ]
     },
     "related_cves": []
   },
@@ -3807,9 +4028,12 @@
       "sector-telecom",
       "api-security",
       "cloud-security",
-      "age-gates-child-safety"
+      "ransomware-response",
+      "age-gates-child-safety",
+      "cloud-iam-incident",
+      "idp-incident-response"
     ],
-    "skill_count": 10,
+    "skill_count": 13,
     "chain": {
       "atlas": [
         {
@@ -3845,16 +4069,23 @@
         "T1068",
         "T1071",
         "T1078",
+        "T1078.004",
         "T1098",
+        "T1098.001",
         "T1110",
         "T1190",
         "T1199",
         "T1486",
         "T1505",
         "T1530",
+        "T1538",
         "T1552",
+        "T1552.005",
         "T1556",
-        "T1567"
+        "T1556.007",
+        "T1567",
+        "T1580",
+        "T1606.002"
       ],
       "framework_gaps": [
         {
@@ -3862,16 +4093,51 @@
           "framework": "3GPP",
           "control_name": "3GPP Security Assurance Specification (gNB / eNB)"
         },
+        {
+          "id": "AU-ISM-1546-Cloud-Service-Account",
+          "framework": "ACSC ISM (Australian Government Information Security Manual)",
+          "control_name": "Multi-factor authentication for privileged users and remote access"
+        },
         {
           "id": "AU-ISM-1556",
           "framework": "au-ism",
           "control_name": "Multi-factor authentication for privileged users (telecom NMS application)"
         },
+        {
+          "id": "AU-ISM-1559-IdP",
+          "framework": "AU ISM",
+          "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension"
+        },
+        {
+          "id": "AWS-Security-Hub-Coverage-Gap",
+          "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
+          "control_name": "CSP-native posture-tool baseline (cross-provider gap class)"
+        },
+        {
+          "id": "CISA-Snowflake-AA24-IdP-Cloud",
+          "framework": "CISA (US) - Cross-framework advisory",
+          "control_name": "CISA Snowflake breach advisory - IdP-to-cloud chained-compromise"
+        },
+        {
+          "id": "DORA-Art-19-IdP-4h",
+          "framework": "EU DORA",
+          "control_name": "Major-ICT-related-incident notification — IdP-specific 4-hour clock"
+        },
         {
           "id": "DORA-Art-21-Telecom-ICT",
           "framework": "DORA",
           "control_name": "DORA Art. 21 — ICT third-party risk (telecom-adjacent application)"
         },
+        {
+          "id": "Decryptor-Availability-Pre-Decision",
+          "framework": "ALL",
+          "control_name": "Decryptor availability lookup as precondition to ransomware pay/restore decision"
+        },
+        {
+          "id": "EU-Sanctions-Reg-2014-833-Cyber",
+          "framework": "EU",
+          "control_name": "EU Council Regulation 2014/833 — Cyber Sanctions screening on ransomware payment posture"
+        },
         {
           "id": "FCC-CPNI-4.1",
           "framework": "FCC-CPNI",
@@ -3882,6 +4148,11 @@
           "framework": "FCC",
           "control_name": "FCC Cyber Incident Notification (4 business days)"
         },
+        {
+          "id": "FedRAMP-IL5-IAM-Federated",
+          "framework": "FedRAMP (US)",
+          "control_name": "FedRAMP Impact-Level 5 baseline IAM controls"
+        },
         {
           "id": "FedRAMP-Rev5-Moderate",
           "framework": "FedRAMP Rev 5 Moderate",
@@ -3907,6 +4178,11 @@
           "framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
           "control_name": "System security requirements and security levels"
         },
+        {
+          "id": "ISO-27001-2022-A.5.16-Federated",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Identity Management + Authentication Information — federated-state extension"
+        },
         {
           "id": "ISO-27001-2022-A.8.28",
           "framework": "ISO/IEC 27001:2022",
@@ -3917,11 +4193,26 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ISO-27017-Cloud-IAM",
+          "framework": "ISO/IEC 27017:2015",
+          "control_name": "ISO/IEC 27017 cloud-services security extension to ISO/IEC 27001"
+        },
         {
           "id": "ITU-T-X.805",
           "framework": "ITU-T",
           "control_name": "ITU-T X.805 — 8-dimension security architecture for end-to-end communications"
         },
+        {
+          "id": "Immutable-Backup-Recovery",
+          "framework": "ALL",
+          "control_name": "Immutable backup as distinct sub-property of backup control (vs replication / write-protect / off-network)"
+        },
+        {
+          "id": "Insurance-Carrier-24h-Notification",
+          "framework": "ALL",
+          "control_name": "Cyber insurance carrier 24h notification with pre-approval workflow"
+        },
         {
           "id": "NERC-CIP-007-6-R4",
           "framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
@@ -3932,6 +4223,11 @@
           "framework": "NIS2",
           "control_name": "NIS2 Annex I — telecommunications essential entities"
         },
+        {
+          "id": "NIS2-Art-21-Federated-Identity",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Cryptography + Access Control — federated-identity extension"
+        },
         {
           "id": "NIS2-Art21-patch-management",
           "framework": "EU NIS2 Directive",
@@ -3947,11 +4243,21 @@
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Account Management"
         },
+        {
+          "id": "NIST-800-53-AC-2-Cross-Account",
+          "framework": "NIST 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
         {
           "id": "NIST-800-53-CM-7",
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Least Functionality"
         },
+        {
+          "id": "NIST-800-53-IA-5-Federated",
+          "framework": "NIST 800-53 Rev.5",
+          "control_name": "Authenticator Management — federated-trust extension"
+        },
         {
           "id": "NIST-800-63B-rev4",
           "framework": "NIST SP 800-63B Rev 4 (Digital Identity Guidelines — Authentication & Lifecycle Mgmt)",
@@ -3962,6 +4268,16 @@
           "framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
           "control_name": "Guide to Operational Technology (OT) Security"
         },
+        {
+          "id": "OFAC-SDN-Payment-Block",
+          "framework": "ALL",
+          "control_name": "OFAC SDN sanctions screening as blocking gate on ransomware payment posture"
+        },
+        {
+          "id": "OFAC-Sanctions-Threat-Actor-Negotiation",
+          "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
+          "control_name": "Sanctions screening on ransomware-payment / threat-actor negotiation"
+        },
         {
           "id": "OWASP-ASVS-v5.0-V14",
           "framework": "OWASP ASVS v5.0",
@@ -3972,11 +4288,26 @@
           "framework": "OWASP Top 10 for LLM Applications 2025",
           "control_name": "Prompt Injection"
         },
+        {
+          "id": "PHI-Exfil-Before-Encrypt-Breach-Class",
+          "framework": "ALL",
+          "control_name": "PHI / personal-data exfiltration before encryption as distinct breach class from the encryption event"
+        },
         {
           "id": "PSD2-RTS-SCA",
           "framework": "EU PSD2 Regulatory Technical Standards on Strong Customer Authentication (Commission Delegated Regulation (EU) 2018/389)",
           "control_name": "Strong Customer Authentication and Common and Secure Communication"
         },
+        {
+          "id": "SOC2-CC6-Access-Key-Leak-Public-Repo",
+          "framework": "AICPA SOC 2 Trust Services Criteria",
+          "control_name": "Logical Access Controls"
+        },
+        {
+          "id": "SOC2-CC6-OAuth-Consent",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls — OAuth consent extension"
+        },
         {
           "id": "SOC2-CC6-logical-access",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -3992,6 +4323,16 @@
           "framework": "SWIFT Customer Security Controls Framework v2026",
           "control_name": "SWIFT Environment Protection"
         },
+        {
+          "id": "UK-CAF-B2-Cloud-IAM",
+          "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
+          "control_name": "Identity and Access Control"
+        },
+        {
+          "id": "UK-CAF-B2-IdP-Tenant",
+          "framework": "UK NCSC CAF",
+          "control_name": "Identity and Access Control — IdP-tenant control-plane extension"
+        },
         {
           "id": "UK-CAF-B5",
           "framework": "UK-CAF",
@@ -3999,11 +4340,31 @@
         }
       ],
       "d3fend": [
+        {
+          "id": "D3-CAA",
+          "name": "Credential Access Auditing",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-CSPP",
+          "name": "Client-server Payload Profiling",
+          "tactic": "Detect"
+        },
         {
           "id": "D3-IOPR",
           "name": "Input/Output Profiling Resource",
           "tactic": "Detect"
         },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
+          "tactic": "Harden"
+        },
         {
           "id": "D3-NI",
           "name": "Network Isolation",
@@ -4018,6 +4379,11 @@
           "id": "D3-NTPM",
           "name": "Network Traffic Policy Mapping",
           "tactic": "Model"
+        },
+        {
+          "id": "D3-RPA",
+          "name": "Remote Process Analysis",
+          "tactic": "Detect"
         }
       ],
       "rfc_refs": [
@@ -4031,6 +4397,11 @@
           "title": "JSON Web Token (JWT)",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-7591",
+          "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8032",
           "title": "Edwards-Curve Digital Signature Algorithm (EdDSA)",
@@ -4041,11 +4412,21 @@
           "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-8693",
+          "title": "OAuth 2.0 Token Exchange",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8725",
           "title": "JSON Web Token Best Current Practices",
           "status": "Best Current Practice"
         },
+        {
+          "id": "RFC-9068",
+          "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9114",
           "title": "HTTP/3",
@@ -4470,9 +4851,10 @@
     "name": "Insufficient Verification of Data Authenticity",
     "category": "Authenticity / Supply Chain",
     "referencing_skills": [
-      "mcp-agent-trust"
+      "mcp-agent-trust",
+      "idp-incident-response"
     ],
-    "skill_count": 1,
+    "skill_count": 2,
     "chain": {
       "atlas": [
         {
@@ -4493,8 +4875,13 @@
       ],
       "attack_refs": [
         "T1059",
+        "T1078.004",
+        "T1098.001",
         "T1190",
-        "T1195.001"
+        "T1195.001",
+        "T1199",
+        "T1556.007",
+        "T1606.002"
       ],
       "framework_gaps": [
         {
@@ -4502,26 +4889,61 @@
           "framework": "ALL",
           "control_name": "MCP/Agent Tool Trust Boundaries"
         },
+        {
+          "id": "AU-ISM-1559-IdP",
+          "framework": "AU ISM",
+          "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension"
+        },
+        {
+          "id": "DORA-Art-19-IdP-4h",
+          "framework": "EU DORA",
+          "control_name": "Major-ICT-related-incident notification — IdP-specific 4-hour clock"
+        },
+        {
+          "id": "ISO-27001-2022-A.5.16-Federated",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Identity Management + Authentication Information — federated-state extension"
+        },
         {
           "id": "ISO-27001-2022-A.8.30",
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "NIS2-Art-21-Federated-Identity",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Cryptography + Access Control — federated-identity extension"
+        },
         {
           "id": "NIST-800-53-CM-7",
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Least Functionality"
         },
+        {
+          "id": "NIST-800-53-IA-5-Federated",
+          "framework": "NIST 800-53 Rev.5",
+          "control_name": "Authenticator Management — federated-trust extension"
+        },
         {
           "id": "NIST-800-53-SA-12",
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Supply Chain Protection"
         },
+        {
+          "id": "OFAC-Sanctions-Threat-Actor-Negotiation",
+          "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
+          "control_name": "Sanctions screening on ransomware-payment / threat-actor negotiation"
+        },
         {
           "id": "OWASP-LLM-Top-10-2025-LLM06",
           "framework": "OWASP Top 10 for LLM Applications 2025",
           "control_name": "Excessive Agency"
         },
+        {
+          "id": "SOC2-CC6-OAuth-Consent",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls — OAuth consent extension"
+        },
         {
           "id": "SOC2-CC9-vendor-management",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -4531,6 +4953,11 @@
           "id": "SWIFT-CSCF-v2026-1.1",
           "framework": "SWIFT Customer Security Controls Framework v2026",
           "control_name": "SWIFT Environment Protection"
+        },
+        {
+          "id": "UK-CAF-B2-IdP-Tenant",
+          "framework": "UK NCSC CAF",
+          "control_name": "Identity and Access Control — IdP-tenant control-plane extension"
         }
       ],
       "d3fend": [
@@ -4554,10 +4981,20 @@
           "name": "Executable Hashbased Allowlist",
           "tactic": "Harden"
         },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
         {
           "id": "D3-MFA",
           "name": "Multi-factor Authentication",
           "tactic": "Harden"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
         }
       ],
       "rfc_refs": [
@@ -4571,6 +5008,11 @@
           "title": "JSON Web Token (JWT)",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-7591",
+          "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8446",
           "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
@@ -5628,9 +6070,192 @@
           "tactic": "Harden"
         },
         {
-          "id": "D3-EHB",
-          "name": "Executable Hashbased Allowlist",
+          "id": "D3-EHB",
+          "name": "Executable Hashbased Allowlist",
+          "tactic": "Harden"
+        }
+      ],
+      "rfc_refs": [
+        {
+          "id": "RFC-7519",
+          "title": "JSON Web Token (JWT)",
+          "status": "Proposed Standard"
+        },
+        {
+          "id": "RFC-8032",
+          "title": "Edwards-Curve Digital Signature Algorithm (EdDSA)",
+          "status": "Informational"
+        },
+        {
+          "id": "RFC-8446",
+          "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
+          "status": "Proposed Standard"
+        },
+        {
+          "id": "RFC-8725",
+          "title": "JSON Web Token Best Current Practices",
+          "status": "Best Current Practice"
+        },
+        {
+          "id": "RFC-9114",
+          "title": "HTTP/3",
+          "status": "Proposed Standard"
+        }
+      ]
+    },
+    "related_cves": [
+      "CVE-2025-53773",
+      "CVE-2026-30615"
+    ]
+  },
+  "CWE-506": {
+    "name": "Embedded Malicious Code",
+    "category": "Supply Chain",
+    "referencing_skills": [],
+    "skill_count": 0,
+    "chain": {
+      "atlas": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "d3fend": [],
+      "rfc_refs": []
+    },
+    "related_cves": []
+  },
+  "CWE-522": {
+    "name": "Insufficiently Protected Credentials",
+    "category": "Credentials Management",
+    "referencing_skills": [
+      "cloud-iam-incident",
+      "idp-incident-response"
+    ],
+    "skill_count": 2,
+    "chain": {
+      "atlas": [
+        {
+          "id": "AML.T0051",
+          "name": "LLM Prompt Injection",
+          "tactic": "Execution"
+        }
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1078.004",
+        "T1098.001",
+        "T1199",
+        "T1538",
+        "T1552.005",
+        "T1556.007",
+        "T1580",
+        "T1606.002"
+      ],
+      "framework_gaps": [
+        {
+          "id": "AU-ISM-1546-Cloud-Service-Account",
+          "framework": "ACSC ISM (Australian Government Information Security Manual)",
+          "control_name": "Multi-factor authentication for privileged users and remote access"
+        },
+        {
+          "id": "AU-ISM-1559-IdP",
+          "framework": "AU ISM",
+          "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension"
+        },
+        {
+          "id": "AWS-Security-Hub-Coverage-Gap",
+          "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
+          "control_name": "CSP-native posture-tool baseline (cross-provider gap class)"
+        },
+        {
+          "id": "CISA-Snowflake-AA24-IdP-Cloud",
+          "framework": "CISA (US) - Cross-framework advisory",
+          "control_name": "CISA Snowflake breach advisory - IdP-to-cloud chained-compromise"
+        },
+        {
+          "id": "DORA-Art-19-IdP-4h",
+          "framework": "EU DORA",
+          "control_name": "Major-ICT-related-incident notification — IdP-specific 4-hour clock"
+        },
+        {
+          "id": "FedRAMP-IL5-IAM-Federated",
+          "framework": "FedRAMP (US)",
+          "control_name": "FedRAMP Impact-Level 5 baseline IAM controls"
+        },
+        {
+          "id": "ISO-27001-2022-A.5.16-Federated",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Identity Management + Authentication Information — federated-state extension"
+        },
+        {
+          "id": "ISO-27017-Cloud-IAM",
+          "framework": "ISO/IEC 27017:2015",
+          "control_name": "ISO/IEC 27017 cloud-services security extension to ISO/IEC 27001"
+        },
+        {
+          "id": "NIS2-Art-21-Federated-Identity",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Cryptography + Access Control — federated-identity extension"
+        },
+        {
+          "id": "NIST-800-53-AC-2-Cross-Account",
+          "framework": "NIST 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
+        {
+          "id": "NIST-800-53-IA-5-Federated",
+          "framework": "NIST 800-53 Rev.5",
+          "control_name": "Authenticator Management — federated-trust extension"
+        },
+        {
+          "id": "OFAC-Sanctions-Threat-Actor-Negotiation",
+          "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
+          "control_name": "Sanctions screening on ransomware-payment / threat-actor negotiation"
+        },
+        {
+          "id": "SOC2-CC6-Access-Key-Leak-Public-Repo",
+          "framework": "AICPA SOC 2 Trust Services Criteria",
+          "control_name": "Logical Access Controls"
+        },
+        {
+          "id": "SOC2-CC6-OAuth-Consent",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls — OAuth consent extension"
+        },
+        {
+          "id": "UK-CAF-B2-Cloud-IAM",
+          "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
+          "control_name": "Identity and Access Control"
+        },
+        {
+          "id": "UK-CAF-B2-IdP-Tenant",
+          "framework": "UK NCSC CAF",
+          "control_name": "Identity and Access Control — IdP-tenant control-plane extension"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-CAA",
+          "name": "Credential Access Auditing",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
           "tactic": "Harden"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
         }
       ],
       "rfc_refs": [
@@ -5640,13 +6265,13 @@
           "status": "Proposed Standard"
         },
         {
-          "id": "RFC-8032",
-          "title": "Edwards-Curve Digital Signature Algorithm (EdDSA)",
-          "status": "Informational"
+          "id": "RFC-7591",
+          "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+          "status": "Proposed Standard"
         },
         {
-          "id": "RFC-8446",
-          "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
+          "id": "RFC-8693",
+          "title": "OAuth 2.0 Token Exchange",
           "status": "Proposed Standard"
         },
         {
@@ -5655,43 +6280,17 @@
           "status": "Best Current Practice"
         },
         {
-          "id": "RFC-9114",
-          "title": "HTTP/3",
+          "id": "RFC-9068",
+          "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+          "status": "Proposed Standard"
+        },
+        {
+          "id": "RFC-9421",
+          "title": "HTTP Message Signatures",
           "status": "Proposed Standard"
         }
       ]
     },
-    "related_cves": [
-      "CVE-2025-53773",
-      "CVE-2026-30615"
-    ]
-  },
-  "CWE-506": {
-    "name": "Embedded Malicious Code",
-    "category": "Supply Chain",
-    "referencing_skills": [],
-    "skill_count": 0,
-    "chain": {
-      "atlas": [],
-      "attack_refs": [],
-      "framework_gaps": [],
-      "d3fend": [],
-      "rfc_refs": []
-    },
-    "related_cves": []
-  },
-  "CWE-522": {
-    "name": "Insufficiently Protected Credentials",
-    "category": "Credentials Management",
-    "referencing_skills": [],
-    "skill_count": 0,
-    "chain": {
-      "atlas": [],
-      "attack_refs": [],
-      "framework_gaps": [],
-      "d3fend": [],
-      "rfc_refs": []
-    },
     "related_cves": []
   },
   "CWE-669": {
@@ -5807,9 +6406,10 @@
       "identity-assurance",
       "webapp-security",
       "cloud-security",
-      "container-runtime-security"
+      "container-runtime-security",
+      "cloud-iam-incident"
     ],
-    "skill_count": 5,
+    "skill_count": 6,
     "chain": {
       "atlas": [
         {
@@ -5837,17 +6437,42 @@
         "T1059",
         "T1068",
         "T1078",
+        "T1078.004",
+        "T1098.001",
         "T1110",
         "T1133",
         "T1190",
         "T1505",
         "T1530",
+        "T1538",
         "T1552",
+        "T1552.005",
         "T1556",
+        "T1580",
         "T1610",
         "T1611"
       ],
       "framework_gaps": [
+        {
+          "id": "AU-ISM-1546-Cloud-Service-Account",
+          "framework": "ACSC ISM (Australian Government Information Security Manual)",
+          "control_name": "Multi-factor authentication for privileged users and remote access"
+        },
+        {
+          "id": "AWS-Security-Hub-Coverage-Gap",
+          "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
+          "control_name": "CSP-native posture-tool baseline (cross-provider gap class)"
+        },
+        {
+          "id": "CISA-Snowflake-AA24-IdP-Cloud",
+          "framework": "CISA (US) - Cross-framework advisory",
+          "control_name": "CISA Snowflake breach advisory - IdP-to-cloud chained-compromise"
+        },
+        {
+          "id": "FedRAMP-IL5-IAM-Federated",
+          "framework": "FedRAMP (US)",
+          "control_name": "FedRAMP Impact-Level 5 baseline IAM controls"
+        },
         {
           "id": "FedRAMP-Rev5-Moderate",
           "framework": "FedRAMP Rev 5 Moderate",
@@ -5863,6 +6488,11 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ISO-27017-Cloud-IAM",
+          "framework": "ISO/IEC 27017:2015",
+          "control_name": "ISO/IEC 27017 cloud-services security extension to ISO/IEC 27001"
+        },
         {
           "id": "NIS2-Art21-patch-management",
           "framework": "EU NIS2 Directive",
@@ -5883,6 +6513,11 @@
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Account Management"
         },
+        {
+          "id": "NIST-800-53-AC-2-Cross-Account",
+          "framework": "NIST 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
         {
           "id": "NIST-800-53-CM-7",
           "framework": "NIST SP 800-53 Rev 5",
@@ -5923,6 +6558,11 @@
           "framework": "SLSA v1.0 (Supply-chain Levels for Software Artifacts) — Build Track",
           "control_name": "Hardened build platform with non-falsifiable provenance"
         },
+        {
+          "id": "SOC2-CC6-Access-Key-Leak-Public-Repo",
+          "framework": "AICPA SOC 2 Trust Services Criteria",
+          "control_name": "Logical Access Controls"
+        },
         {
           "id": "SOC2-CC6-logical-access",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -5932,9 +6572,24 @@
           "id": "SOC2-CC9-vendor-management",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
           "control_name": "Risk Mitigation — Vendor and Business Partner Risk"
+        },
+        {
+          "id": "UK-CAF-B2-Cloud-IAM",
+          "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
+          "control_name": "Identity and Access Control"
         }
       ],
       "d3fend": [
+        {
+          "id": "D3-CAA",
+          "name": "Credential Access Auditing",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
         {
           "id": "D3-CSPP",
           "name": "Client-server Payload Profiling",
@@ -5945,6 +6600,16 @@
           "name": "Executable Allowlisting",
           "tactic": "Harden"
         },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
+          "tactic": "Harden"
+        },
         {
           "id": "D3-NTA",
           "name": "Network Traffic Analysis",
@@ -5972,11 +6637,21 @@
           "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-8693",
+          "title": "OAuth 2.0 Token Exchange",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8725",
           "title": "JSON Web Token Best Current Practices",
           "status": "Best Current Practice"
         },
+        {
+          "id": "RFC-9068",
+          "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9114",
           "title": "HTTP/3",
@@ -6219,9 +6894,11 @@
       "ot-ics-security",
       "sector-financial",
       "sector-energy",
-      "cloud-security"
+      "cloud-security",
+      "ransomware-response",
+      "cloud-iam-incident"
     ],
-    "skill_count": 5,
+    "skill_count": 7,
     "chain": {
       "atlas": [
         {
@@ -6248,17 +6925,53 @@
       "attack_refs": [
         "T0855",
         "T0883",
+        "T1059",
         "T1068",
         "T1078",
+        "T1078.004",
+        "T1098.001",
         "T1110",
         "T1190",
         "T1486",
         "T1530",
+        "T1538",
         "T1552",
+        "T1552.005",
         "T1556",
-        "T1567"
+        "T1567",
+        "T1580"
       ],
       "framework_gaps": [
+        {
+          "id": "AU-ISM-1546-Cloud-Service-Account",
+          "framework": "ACSC ISM (Australian Government Information Security Manual)",
+          "control_name": "Multi-factor authentication for privileged users and remote access"
+        },
+        {
+          "id": "AWS-Security-Hub-Coverage-Gap",
+          "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
+          "control_name": "CSP-native posture-tool baseline (cross-provider gap class)"
+        },
+        {
+          "id": "CISA-Snowflake-AA24-IdP-Cloud",
+          "framework": "CISA (US) - Cross-framework advisory",
+          "control_name": "CISA Snowflake breach advisory - IdP-to-cloud chained-compromise"
+        },
+        {
+          "id": "Decryptor-Availability-Pre-Decision",
+          "framework": "ALL",
+          "control_name": "Decryptor availability lookup as precondition to ransomware pay/restore decision"
+        },
+        {
+          "id": "EU-Sanctions-Reg-2014-833-Cyber",
+          "framework": "EU",
+          "control_name": "EU Council Regulation 2014/833 — Cyber Sanctions screening on ransomware payment posture"
+        },
+        {
+          "id": "FedRAMP-IL5-IAM-Federated",
+          "framework": "FedRAMP (US)",
+          "control_name": "FedRAMP Impact-Level 5 baseline IAM controls"
+        },
         {
           "id": "FedRAMP-Rev5-Moderate",
           "framework": "FedRAMP Rev 5 Moderate",
@@ -6274,6 +6987,21 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ISO-27017-Cloud-IAM",
+          "framework": "ISO/IEC 27017:2015",
+          "control_name": "ISO/IEC 27017 cloud-services security extension to ISO/IEC 27001"
+        },
+        {
+          "id": "Immutable-Backup-Recovery",
+          "framework": "ALL",
+          "control_name": "Immutable backup as distinct sub-property of backup control (vs replication / write-protect / off-network)"
+        },
+        {
+          "id": "Insurance-Carrier-24h-Notification",
+          "framework": "ALL",
+          "control_name": "Cyber insurance carrier 24h notification with pre-approval workflow"
+        },
         {
           "id": "NERC-CIP-007-6-R4",
           "framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
@@ -6289,6 +7017,11 @@
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Account Management"
         },
+        {
+          "id": "NIST-800-53-AC-2-Cross-Account",
+          "framework": "NIST 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
         {
           "id": "NIST-800-53-CM-7",
           "framework": "NIST SP 800-53 Rev 5",
@@ -6304,11 +7037,26 @@
           "framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
           "control_name": "Guide to Operational Technology (OT) Security"
         },
+        {
+          "id": "OFAC-SDN-Payment-Block",
+          "framework": "ALL",
+          "control_name": "OFAC SDN sanctions screening as blocking gate on ransomware payment posture"
+        },
+        {
+          "id": "PHI-Exfil-Before-Encrypt-Breach-Class",
+          "framework": "ALL",
+          "control_name": "PHI / personal-data exfiltration before encryption as distinct breach class from the encryption event"
+        },
         {
           "id": "PSD2-RTS-SCA",
           "framework": "EU PSD2 Regulatory Technical Standards on Strong Customer Authentication (Commission Delegated Regulation (EU) 2018/389)",
           "control_name": "Strong Customer Authentication and Common and Secure Communication"
         },
+        {
+          "id": "SOC2-CC6-Access-Key-Leak-Public-Repo",
+          "framework": "AICPA SOC 2 Trust Services Criteria",
+          "control_name": "Logical Access Controls"
+        },
         {
           "id": "SOC2-CC6-logical-access",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -6323,9 +7071,50 @@
           "id": "SWIFT-CSCF-v2026-1.1",
           "framework": "SWIFT Customer Security Controls Framework v2026",
           "control_name": "SWIFT Environment Protection"
+        },
+        {
+          "id": "UK-CAF-B2-Cloud-IAM",
+          "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
+          "control_name": "Identity and Access Control"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-CAA",
+          "name": "Credential Access Auditing",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-CSPP",
+          "name": "Client-server Payload Profiling",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-RPA",
+          "name": "Remote Process Analysis",
+          "tactic": "Detect"
         }
       ],
-      "d3fend": [],
       "rfc_refs": [
         {
           "id": "RFC-6749",
@@ -6347,11 +7136,21 @@
           "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-8693",
+          "title": "OAuth 2.0 Token Exchange",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8725",
           "title": "JSON Web Token Best Current Practices",
           "status": "Best Current Practice"
         },
+        {
+          "id": "RFC-9068",
+          "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9180",
           "title": "Hybrid Public Key Encryption",
@@ -6675,9 +7474,11 @@
       "identity-assurance",
       "webapp-security",
       "sector-financial",
-      "api-security"
+      "api-security",
+      "cloud-iam-incident",
+      "idp-incident-response"
     ],
-    "skill_count": 4,
+    "skill_count": 6,
     "chain": {
       "atlas": [
         {
@@ -6699,14 +7500,57 @@
       "attack_refs": [
         "T1059",
         "T1078",
+        "T1078.004",
+        "T1098.001",
         "T1110",
         "T1190",
+        "T1199",
         "T1486",
         "T1505",
+        "T1538",
+        "T1552.005",
         "T1556",
-        "T1567"
+        "T1556.007",
+        "T1567",
+        "T1580",
+        "T1606.002"
       ],
       "framework_gaps": [
+        {
+          "id": "AU-ISM-1546-Cloud-Service-Account",
+          "framework": "ACSC ISM (Australian Government Information Security Manual)",
+          "control_name": "Multi-factor authentication for privileged users and remote access"
+        },
+        {
+          "id": "AU-ISM-1559-IdP",
+          "framework": "AU ISM",
+          "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension"
+        },
+        {
+          "id": "AWS-Security-Hub-Coverage-Gap",
+          "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
+          "control_name": "CSP-native posture-tool baseline (cross-provider gap class)"
+        },
+        {
+          "id": "CISA-Snowflake-AA24-IdP-Cloud",
+          "framework": "CISA (US) - Cross-framework advisory",
+          "control_name": "CISA Snowflake breach advisory - IdP-to-cloud chained-compromise"
+        },
+        {
+          "id": "DORA-Art-19-IdP-4h",
+          "framework": "EU DORA",
+          "control_name": "Major-ICT-related-incident notification — IdP-specific 4-hour clock"
+        },
+        {
+          "id": "FedRAMP-IL5-IAM-Federated",
+          "framework": "FedRAMP (US)",
+          "control_name": "FedRAMP Impact-Level 5 baseline IAM controls"
+        },
+        {
+          "id": "ISO-27001-2022-A.5.16-Federated",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Identity Management + Authentication Information — federated-state extension"
+        },
         {
           "id": "ISO-27001-2022-A.8.28",
           "framework": "ISO/IEC 27001:2022",
@@ -6717,6 +7561,16 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ISO-27017-Cloud-IAM",
+          "framework": "ISO/IEC 27017:2015",
+          "control_name": "ISO/IEC 27017 cloud-services security extension to ISO/IEC 27001"
+        },
+        {
+          "id": "NIS2-Art-21-Federated-Identity",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Cryptography + Access Control — federated-identity extension"
+        },
         {
           "id": "NIST-800-218-SSDF",
           "framework": "NIST SP 800-218 (Secure Software Development Framework v1.1)",
@@ -6727,11 +7581,26 @@
           "framework": "NIST SP 800-53 Rev 5",
           "control_name": "Account Management"
         },
+        {
+          "id": "NIST-800-53-AC-2-Cross-Account",
+          "framework": "NIST 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
+        {
+          "id": "NIST-800-53-IA-5-Federated",
+          "framework": "NIST 800-53 Rev.5",
+          "control_name": "Authenticator Management — federated-trust extension"
+        },
         {
           "id": "NIST-800-63B-rev4",
           "framework": "NIST SP 800-63B Rev 4 (Digital Identity Guidelines — Authentication & Lifecycle Mgmt)",
           "control_name": "Authentication and Lifecycle Management (AAL/IAL/FAL)"
         },
+        {
+          "id": "OFAC-Sanctions-Threat-Actor-Negotiation",
+          "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
+          "control_name": "Sanctions screening on ransomware-payment / threat-actor negotiation"
+        },
         {
           "id": "OWASP-ASVS-v5.0-V14",
           "framework": "OWASP ASVS v5.0",
@@ -6747,6 +7616,16 @@
           "framework": "EU PSD2 Regulatory Technical Standards on Strong Customer Authentication (Commission Delegated Regulation (EU) 2018/389)",
           "control_name": "Strong Customer Authentication and Common and Secure Communication"
         },
+        {
+          "id": "SOC2-CC6-Access-Key-Leak-Public-Repo",
+          "framework": "AICPA SOC 2 Trust Services Criteria",
+          "control_name": "Logical Access Controls"
+        },
+        {
+          "id": "SOC2-CC6-OAuth-Consent",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls — OAuth consent extension"
+        },
         {
           "id": "SOC2-CC6-logical-access",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -6756,9 +7635,45 @@
           "id": "SWIFT-CSCF-v2026-1.1",
           "framework": "SWIFT Customer Security Controls Framework v2026",
           "control_name": "SWIFT Environment Protection"
+        },
+        {
+          "id": "UK-CAF-B2-Cloud-IAM",
+          "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
+          "control_name": "Identity and Access Control"
+        },
+        {
+          "id": "UK-CAF-B2-IdP-Tenant",
+          "framework": "UK NCSC CAF",
+          "control_name": "Identity and Access Control — IdP-tenant control-plane extension"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-CAA",
+          "name": "Credential Access Auditing",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CBAN",
+          "name": "Certificate-based Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-MFA",
+          "name": "Multi-factor Authentication",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
         }
       ],
-      "d3fend": [],
       "rfc_refs": [
         {
           "id": "RFC-6749",
@@ -6770,6 +7685,11 @@
           "title": "JSON Web Token (JWT)",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-7591",
+          "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8032",
           "title": "Edwards-Curve Digital Signature Algorithm (EdDSA)",
@@ -6780,11 +7700,21 @@
           "title": "The Transport Layer Security (TLS) Protocol Version 1.3",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-8693",
+          "title": "OAuth 2.0 Token Exchange",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-8725",
           "title": "JSON Web Token Best Current Practices",
           "status": "Best Current Practice"
         },
+        {
+          "id": "RFC-9068",
+          "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9114",
           "title": "HTTP/3",