genai-security-crosswalk 2.0.0

package/data/entries/DSGAI17.json

@@ -0,0 +1,690 @@
+{
+  "id": "DSGAI17",
+  "name": "Data Availability and Resilience Failures",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0029",
+      "control_name": "Denial of ML Service",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversary saturates GenAI pipeline — vector store, RAG retrieval, or inference endpoint rendered unavailable"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0034",
+      "control_name": "Cost Harvesting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversary triggers disproportionate resource consumption through crafted queries — financial or operational DoS"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Data from Information Repositories",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Pipeline failures may expose data through error messages or fallback paths that lack normal access controls"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-4.1",
+      "control_name": "Risk tolerance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Availability risk tolerance defined for AI pipelines — RTO/RPO per component documented"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Resilience testing of RAG pipelines — vector store saturation, stale replica, index corruption"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident response for AI pipeline availability failures — silent degradation detection and response"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-3.2",
+      "control_name": "Residual risk",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Residual availability risk documented — BCP coverage for AI pipeline components"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI must remain accurate and available under adverse conditions",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store redundancy, circuit breakers, and staleness detection are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring covering availability and resilience",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI pipeline availability monitoring in quality management and post-market monitoring programme"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.30",
+      "control_name": "ICT readiness for business continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI pipeline availability requirements included in BCP — RTO/RPO defined for vector stores and RAG components"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.13",
+      "control_name": "Backup",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Backup and recovery for all AI data assets — vector stores, embedding indexes, RAG corpora"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.14",
+      "control_name": "Redundancy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Redundancy and failover for production RAG and vector store infrastructure"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.24",
+      "control_name": "Incident management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident management procedures covering AI pipeline availability failures"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — decommissioning",
+      "control_name": "A.6.2.8",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — testing",
+      "control_name": "A.6.2.6",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Operation",
+      "control_name": "Cl.8",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Improvement",
+      "control_name": "Cl.10",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 11",
+      "control_name": "11.1 — Establish recovery capability",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 11",
+      "control_name": "11.4 — Test data recovery",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 13",
+      "control_name": "13.8 — Deploy DNS filtering",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11 Business Logic",
+      "control_name": "V11.1.7 — Anti-automation controls",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V13 API",
+      "control_name": "V13.1.2 — API throttling",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 7.6",
+      "control_name": "Denial of service protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Circuit breakers preventing OT GenAI service degradation from affecting process control"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 7.7",
+      "control_name": "Control system backup",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT GenAI failures cannot affect backup and recovery of process control — independence verified"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT GenAI pipeline failures treated as security events — process control fallback activated"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.1",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT GenAI availability events do not propagate to process control — architectural separation"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risks",
+      "control_name": "§5.5",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model components are supply chain assets in OT"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risk management",
+      "control_name": "§6.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model provenance for OT deployments"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Third-party management",
+      "control_name": "§8.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vendor assessment for model providers"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.IR-01",
+      "control_name": "Infrastructure Resilience",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Networks and environments protected for resilience — circuit breakers, freshness monitoring, redundancy"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "GenAI pipeline health monitored — freshness, availability metrics reviewed continuously"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.MI-01",
+      "control_name": "Incident Mitigation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Pipeline failures contained — circuit breaker activation, graceful degradation, user notification"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RC.RP-01",
+      "control_name": "Incident Recovery",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Recovery plan includes GenAI pipeline failures — BCP covers AI availability, RTO/RPO defined"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM service availability commitments cover RAG freshness — stale data producing misinformation is an availability failure",
+      "control_name": "A1.1 — Availability policy",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Circuit breakers and freshness monitoring protect availability commitments — graceful degradation over silent failure",
+      "control_name": "A1.2 — Environmental protections",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "RAG freshness monitoring — alert when index staleness exceeds threshold before misinformation reaches users",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Silent RAG degradation identified as availability risk in assessment",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.3.2",
+      "control_name": "Targeted risk analysis",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Targeted risk analysis for GenAI availability in payment processing — silent failure impact on fraud detection"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 1.3.2",
+      "control_name": "Network security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Rate limiting protecting availability of CDE-facing LLM endpoints — DoS prevention"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.6.1",
+      "control_name": "Audit log review",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated monitoring for GenAI pipeline health in CDE — freshness and availability metrics reviewed"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.10.1",
+      "control_name": "Incident response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident response procedure covers GenAI pipeline failures affecting payment processing"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Business Continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All GenAI critical assets backed up — training data, model weights, embedding stores, RAG corpora subject to backup and recovery testing"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "IRS",
+      "control_name": "Incident Response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI incident response plan covers availability failures — model rollback procedure, RAG corpus recovery, embedding store restoration"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "GenAI asset availability monitored — alerts on data store unavailability, model health degradation, pipeline failures"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model weights and training artefacts protected against accidental or malicious deletion — versioned storage, immutable backups"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Only approved model sources; provenance verification required"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "SBOM covering base models, adapters, and ML framework dependencies"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Architecture review validates model sourcing against policy"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model compromise scenarios for base models, adapters, and frameworks"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Track CVEs and security advisories for all model components"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-400",
+      "control_name": "CWE-400",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/400.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-770",
+      "control_name": "CWE-770",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/770.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B003",
+      "control_name": "Third-party security assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B008",
+      "control_name": "Third-party NHI controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Model provider API keys with excessive access to model versions",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Review and scope all model provider credentials"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Same model registry token used across dev/staging/production",
+      "control_name": "NHI-8 Environment Isolation Failure",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Separate credentials per environment"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Model provider credentials in pipeline config",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vault all model provider credentials"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review for security vulnerabilities — bias and fairness review",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include bias, fairness, and discrimination testing in pre-release model behaviour reviews; assess model outputs across protected attributes and demographic groups"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.8.2-PS",
+      "control_name": "Test for security vulnerabilities — adversarial fairness testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct adversarial testing for discriminatory outputs; test model behaviour across demographic groups, intersectional categories, and edge cases"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.3.1-PS",
+      "control_name": "Analyse root causes — bias source tracing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "When discriminatory behaviour is identified, conduct root cause analysis tracing bias to specific training data sources, labelling processes, or preprocessing steps"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — bias detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor AI outputs for bias indicators; track fairness metrics across demographic groups and use cases"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CA-7",
+      "control_name": "Continuous Monitoring — fairness monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include bias and fairness metrics in continuous monitoring; track output equity over time"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "RA-5",
+      "control_name": "Vulnerability Scanning — bias assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include bias detection and fairness assessment in vulnerability scanning; test for disparate impact"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — fairness governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI bias and fairness in ICT risk management; define fairness requirements for financial AI systems and acceptable disparity thresholds"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — bias testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include bias detection and fairness testing in resilience testing programme; test for disparate impact in financial AI outputs across demographic groups"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — fairness improvement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply lessons learned from bias incidents; update training data, model parameters, and controls based on fairness assessments"
+    }
+  ],
+  "tools": [
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "Resilience4j",
+      "type": "open-source",
+      "url": "https://resilience4j.readme.io"
+    },
+    {
+      "name": "DVC (Data Version Control)",
+      "type": "open-source",
+      "url": "https://github.com/iterative/dvc"
+    },
+    {
+      "name": "MLflow",
+      "type": "open-source",
+      "url": "https://github.com/mlflow/mlflow"
+    },
+    {
+      "name": "Velero",
+      "type": "open-source",
+      "url": "https://github.com/vmware-tanzu/velero"
+    },
+    {
+      "name": "Chaos Monkey",
+      "type": "open-source",
+      "url": "https://github.com/Netflix/chaosmonkey"
+    },
+    {
+      "name": "Fairlearn",
+      "type": "open-source",
+      "url": "https://fairlearn.org"
+    },
+    {
+      "name": "AI Fairness 360",
+      "type": "open-source",
+      "url": "https://aif360.mybluemix.net"
+    },
+    {
+      "name": "What-If Tool",
+      "type": "open-source",
+      "url": "https://pair-code.github.io/what-if-tool"
+    },
+    {
+      "name": "Aequitas",
+      "type": "open-source",
+      "url": "https://github.com/dssg/aequitas"
+    },
+    {
+      "name": "IBM AI Fairness 360",
+      "type": "open-source",
+      "url": "https://aif360.mybluemix.net"
+    },
+    {
+      "name": "Fiddler AI",
+      "type": "commercial",
+      "url": "https://www.fiddler.ai"
+    },
+    {
+      "name": "Evidently",
+      "url": "https://github.com/evidentlyai/evidently",
+      "type": "open-source"
+    },
+    {
+      "name": "WhyLogs",
+      "url": "https://github.com/whylabs/whylogs",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Meta Galactica model withdrawn after misinformation at launch",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2022,
+      "incident_id": "INC-031"
+    },
+    {
+      "name": "Clearview AI biometric bias — $50M class action settlement",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-036"
+    },
+    {
+      "name": "Stability AI synthetic CSAM generation — training data and output safety failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-049"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM10",
+      "LLM03",
+      "LLM04",
+      "LLM09"
+    ],
+    "agentic_top10": [
+      "ASI08",
+      "ASI07",
+      "ASI09"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}