genai-security-crosswalk 2.0.0

package/data/entries/ASI10.json

@@ -0,0 +1,833 @@
+{
+  "id": "ASI10",
+  "name": "Rogue Agents",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": 9.7,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0054",
+      "control_name": "LLM Jailbreak",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0054",
+      "notes": "Persistent override of agent safety constraints enabling hidden goal execution"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0015",
+      "control_name": "LLM Capability Escalation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0015",
+      "notes": "Rogue agent gradually escalates its own capabilities and permissions over time"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Exploit Public-Facing ML Application",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0057",
+      "notes": "Compromised agent maintains persistent access and hidden execution across sessions"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Policy requires behavioural monitoring of all deployed agents — rogue agent detection as a governance objective"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent risk categorised per deployment — detection capability, blast radius, and response procedures mapped"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarial testing covering rogue agent scenarios — behavioural drift, persistent hidden goal detection"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Incident response for rogue agent — kill switch, audit procedure, operational impact assessment, root cause"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Rogue agent scenarios identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent risk in Art. 9 risk management — detection capability, blast radius, response documented"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Human oversight mechanisms effective against rogue behaviour",
+      "control_name": "Art. 14 — Human oversight",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Kill switch and behavioural monitoring are Art. 14 human oversight requirements for agentic systems"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Technical resilience against rogue agent behaviour",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Behavioural baselines, anomaly detection, and automated suspension are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring covering rogue agent detection",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Behavioural monitoring in post-market monitoring programme"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Behavioural baseline monitoring — deviation detection is the primary rogue agent control, new 2022 control directly applicable"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.2",
+      "control_name": "Privileged access rights",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Scope constraints enforced — rogue agent cannot exceed permission envelope regardless of internal goal state"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.24",
+      "control_name": "Information security incident management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent containment as ISMS incident — kill switch, recommendation audit, process state validation, forensic capture"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Scope constraints enforced at infrastructure layer — rogue agent cannot exceed permission envelope"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.8",
+      "control_name": "Monitoring of AI systems",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Behavioural monitoring as AIMS operational control — baseline deviation detection is the primary rogue agent control"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.1.2",
+      "control_name": "Responsible AI system management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Comprehensive audit logging and rogue agent containment as responsible lifecycle management obligation"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.9",
+      "control_name": "Performance evaluation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent detection rates and containment times in AIMS management review"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.2 Collect audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Comprehensive audit logging of all agent actions — no production deployment without full observability"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "13.1 Centralise security event alerting",
+      "control_name": "CIS 13 — Network Monitoring and Defence",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "17.2 Establish incident response procedures",
+      "control_name": "CIS 17 — Incident Response",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent containment as incident response procedure — kill switch, audit, state validation, forensic"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "18.1 Establish penetration testing",
+      "control_name": "CIS 18 — Penetration Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent scenarios in penetration testing — persistent hidden goal simulation, detection verification"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.1",
+      "control_name": "Verify access control decisions logged",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All agent actions logged — no production deployment without complete observability"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.2",
+      "control_name": "Verify all business logic decisions logged",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.2",
+      "control_name": "Verify business logic limits prevent abuse",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V13.1.1",
+      "control_name": "Verify API rate limiting",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity (monitoring)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Continuous behavioural monitoring of all OT agents — deviation from established baseline detected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.1",
+      "control_name": "Timely response to events",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent indicators treated as security events — immediate suspension, investigation, OT impact assessment"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent cannot exceed defined permission scope even if internal goals are compromised"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.6",
+      "control_name": "Use control enforcement",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rogue agent cannot load additional tools or expand its own capability scope"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Availability risks",
+      "control_name": "§5.6",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Cascading failure across OT components"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Cascade failure scenarios in OT risk register"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Security controls",
+      "control_name": "§7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Circuit breakers between OT automation layers"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for anomalous data and software use — behavioural baseline deviation detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.AE-02",
+      "control_name": "Adverse Event Analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Detected events analysed to understand attack targets — rogue agent patterns correlated across sessions"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.AN-03",
+      "control_name": "Incident Analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Root cause analysis — what caused rogue behaviour, which sessions were affected, what was the blast radius"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Access permissions managed — rogue agent cannot exceed its permission envelope regardless of internal goal state"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Continuous monitoring for rogue agent behaviour — actions outside authorised scope detected and alerted",
+      "control_name": "CC7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent action audit log, anomaly alert records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access controls define authorised agent scope — technical enforcement of what agents may and may not do",
+      "control_name": "CC6.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Permission policy, access control configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Rogue agent risk in risk assessment — autonomous agent operating outside scope is a documented risk",
+      "control_name": "CC3.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Risk register with rogue agent scenarios"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Rogue agent impact on availability — resource consumption by rogue agents does not degrade service for authorised operations",
+      "control_name": "A1.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Resource monitoring, quota enforcement records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent access to CHD follows documented scope — technical controls prevent access outside defined role",
+      "control_name": "Req 7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Access control matrix, technical enforcement evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Rogue agent behaviour logged — actions outside defined scope generate audit log entries and alerts",
+      "control_name": "Req 10.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Action audit log, out-of-scope alert records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Rogue agent scenarios in penetration test scope — test whether agents can operate outside authorised scope",
+      "control_name": "Req 11.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Pen test report with rogue agent test cases"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Rogue agent risk analysis — targeted risk analysis documents scenarios, CHD impact, treatment",
+      "control_name": "Req 12.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Risk analysis documentation"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Continuous monitoring for agents operating outside authorised scope — AI-specific behavioural baselines enable deviation detection"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Incident Response (IRS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "AI incident response plan covers rogue agent scenarios — automated isolation, manual rollback, forensic investigation procedures"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Authorised behaviour envelope documented per agent role — enables definition of what constitutes rogue behaviour"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "AI system integrity controls enforce authorised behaviour boundaries — runtime enforcement, not just policy statements"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Design circuit breakers and blast radius containment between agents"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Detect correlated failures across multiple agents; alert before full cascade"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-EM",
+      "control_name": "Operations / Environment Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Continuous health checks; automatic isolation of degraded agents"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify blast radius containment in architecture review"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Documented runbook for cascade scenarios including rollback procedures"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Access Control",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Rogue agent exceeds its permitted access scope — no scope enforcement"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Protection Mechanism Failure",
+      "control_name": "CWE-693",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Behavioural monitoring and detection mechanisms bypassed by rogue agent"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Control of Interaction Frequency",
+      "control_name": "CWE-799",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Rogue agent evades detection by maintaining normal action frequency while biasing recommendations"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Embedded Malicious Code",
+      "control_name": "CWE-506",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Rogue behaviour may result from backdoored model or component"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Incorrect Default Permissions",
+      "control_name": "CWE-276",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent deployed with broader permissions than needed — amplifies rogue blast radius"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Behavioural baseline establishment and deviation",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Establish baseline during commissioning; inject anomalous behaviour patterns; verify detection"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Hidden goal persistence detection",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify that systematic recommendation bias is detectable through aggregate output analysis"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Kill switch activation coverage",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify kill switch activation logs are complete and anomaly-to-suspension latency meets SLA"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party testing of adversarial robustness",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI agent actions",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "C",
+      "control_name": "Safety (full domain)",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability (full domain)",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Rogue agent detected but not offboarded — credentials remain valid",
+      "control_name": "NHI-1 Improper Offboarding",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Formal agent offboarding triggered immediately on rogue detection — all credentials revoked"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Rogue agent with excess privilege causes larger blast radius before detection",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Least privilege — rogue agent with narrow scope causes less damage before containment"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived tokens allow rogue agent to operate indefinitely after detection",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Short-lived credentials — rogue detection triggers token expiry without requiring manual revocation"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Vet all external agent dependencies — LLM APIs, tool endpoints, MCP servers, orchestration platforms — for reliability, security posture, and failure mode characteristics before adoption",
+      "control_name": "PW.4.1-PS – Reuse existing well-secured software",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents adoption of unreliable dependencies"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Verify that external dependency responses are consistent with expected behaviour — detect API version changes, model swaps, or degraded output quality that could affect agent correctness",
+      "control_name": "PS.2.1-PS – Verify software integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Detects dependency degradation and tampering"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Monitor all agent dependencies for availability, behavioural consistency, and security posture changes; establish triage procedures for dependency degradation events",
+      "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enables rapid detection of dependency failures"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Define remediation procedures for dependency failures — graceful degradation, fallback providers, workflow suspension, and stakeholder notification",
+      "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ensures operational continuity during dependency outages"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-2",
+      "control_name": "Supply Chain Risk Management Plan — agent dependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include all agent external dependencies — model APIs, tool endpoints, data sources — in supply chain risk management with availability and integrity requirements"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-9",
+      "control_name": "External Information System Services — agent service dependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require SLAs from agent dependency providers covering availability, performance, security, and incident notification; establish fallback procedures"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — dependency health monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "IR-4",
+      "control_name": "Incident Handling — dependency failure response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define incident handling procedures for agent dependency failures; include automated fallback activation, graceful degradation, and service restoration"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — agent dependency oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include all agent external dependencies — model APIs, tool endpoints, data sources — in third-party ICT risk management with availability and integrity requirements"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 11",
+      "control_name": "Response and Recovery — dependency failure response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define response and recovery procedures for agent dependency failures; include fallback activation, graceful degradation, and service restoration"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 12",
+      "control_name": "Backup Policies — dependency continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain backup and fallback mechanisms for critical agent dependencies; enable continued operation during provider outages"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — dependency health monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Langfuse",
+      "type": "open-source",
+      "url": "https://langfuse.com"
+    },
+    {
+      "name": "Helicone",
+      "type": "open-source",
+      "url": "https://www.helicone.ai"
+    },
+    {
+      "name": "Weights & Biases",
+      "type": "commercial",
+      "url": "https://wandb.ai"
+    },
+    {
+      "name": "Wazuh",
+      "type": "open-source",
+      "url": "https://wazuh.com"
+    },
+    {
+      "name": "Dragos",
+      "type": "commercial",
+      "url": "https://www.dragos.com"
+    },
+    {
+      "name": "Prometheus",
+      "type": "open-source",
+      "url": "https://prometheus.io"
+    },
+    {
+      "name": "Falco",
+      "type": "open-source",
+      "url": "https://falco.org"
+    },
+    {
+      "name": "Entro Security",
+      "type": "commercial",
+      "url": "https://entro.security"
+    },
+    {
+      "name": "HashiCorp Vault",
+      "type": "open-source",
+      "url": "https://www.vaultproject.io"
+    },
+    {
+      "name": "Teleport",
+      "type": "commercial",
+      "url": "https://goteleport.com"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "LiteLLM",
+      "type": "open-source",
+      "url": "https://github.com/BerriAI/litellm"
+    },
+    {
+      "name": "Grafana",
+      "type": "open-source",
+      "url": "https://grafana.com"
+    },
+    {
+      "name": "PagerDuty",
+      "type": "commercial",
+      "url": "https://www.pagerduty.com"
+    },
+    {
+      "name": "Istio",
+      "type": "open-source",
+      "url": "https://istio.io"
+    },
+    {
+      "name": "AgentOps",
+      "url": "https://github.com/AgentOps-AI/agentops",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Multi-agent financial trading system flash crash — cascading autonomous failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-041"
+    },
+    {
+      "name": "Apollo Research: frontier models demonstrate strategic deception to avoid shutdown",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-047"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM06",
+      "LLM10",
+      "LLM05"
+    ],
+    "agentic_top10": [
+      "ASI01",
+      "ASI02",
+      "ASI03",
+      "ASI05",
+      "ASI04",
+      "ASI06",
+      "ASI07",
+      "ASI08",
+      "ASI09"
+    ],
+    "dsgai_2026": [
+      "DSGAI16",
+      "DSGAI03",
+      "DSGAI19",
+      "DSGAI02",
+      "DSGAI17",
+      "DSGAI06"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}