genai-security-crosswalk 2.0.0

package/data/entries/DSGAI19.json

@@ -0,0 +1,638 @@
+{
+  "id": "DSGAI19",
+  "name": "Human-in-Loop and Labeler Overexposure",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "Medium",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive data in labelling tasks accessed by adversary-controlled or compromised labelling vendor"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Data from Information Repositories",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0020",
+      "control_name": "Poison Training Data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversary-controlled labelling vendor introduces biased or poisoned annotations into training data"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "HITL data governance policy — data minimisation, contractor handling requirements, retention limits"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-5.1",
+      "control_name": "Interdependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All labelling vendors and HITL providers mapped — data access scope, contractual protections"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Privacy assessment of labelling workflows — annotator data access scope, anonymisation effectiveness"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-3.2",
+      "control_name": "Residual risk",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Residual privacy risk from labelling vendor access documented and treated"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Training data governance includes human annotation workflows",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labeller data access controls and data minimisation are Art. 10 requirements for high-risk training data"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Labelling vendors are part of the AI value chain — obligations distributed accordingly",
+      "control_name": "Art. 25 — Value chain responsibilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling vendor security requirements and contractual controls are Art. 25 value chain obligations"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.34",
+      "control_name": "Privacy and PII protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data minimisation and privacy controls for all HITL labelling workflows"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.6.3",
+      "control_name": "Information security awareness training",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security training for all labellers — internal and third-party — covering data handling requirements"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.20",
+      "control_name": "Supplier agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Contractual data handling requirements for labelling vendors and HITL service providers"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Anonymisation and redaction applied to labelling tasks before exposure to annotators"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — minimisation",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Third-party",
+      "control_name": "A.10.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Internal organisation — roles",
+      "control_name": "A.3.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Support",
+      "control_name": "Cl.7",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.3 — Access control lists",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 6",
+      "control_name": "6.5 — Require MFA",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 14",
+      "control_name": "14.3 — Train workforce to identify attacks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.2 — Least privilege",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.3.3 — Consent for personal data processing",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V2 Authentication",
+      "control_name": "V2.1.1 — Strong authentication",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.2",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling vendors with OT data access assessed under 62443-2-4 — same requirements as OT software vendors"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT data minimisation in labelling tasks — annotators see minimum content needed, not full process records"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "Supplier security requirements",
+      "control_name": "62443-2-4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All labelling vendors with OT data access assessed before engagement"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Availability risks",
+      "control_name": "§5.6",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "OT GenAI pipeline failure as availability risk"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Cascade failure scenarios in OT risk register"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Security controls",
+      "control_name": "§7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Circuit breakers between OT data pipeline layers"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling vendors treated as suppliers — data handling requirements in contracts, compliance monitored"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data minimisation — annotators access minimum content required for annotation function"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Acceptable use policy covers labelling activities — what data may be used in labelling workflows"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AT-01",
+      "control_name": "Awareness and Training",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling staff trained on data handling — classification, prohibited use, incident reporting"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Labelling vendors assessed in vendor risk programme — data access scope, handling requirements, sub-processor chain",
+      "control_name": "CC9.1 — Vendor risk",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Contractual data handling obligations for labelling vendors — data minimisation, retention, permitted use",
+      "control_name": "CC9.2 — Vendor agreements",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Personal information accessed by labellers documented — purpose, scope, and safeguards",
+      "control_name": "P3.1 — Personal information collection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Labelling vendor use of personal information restricted — no secondary use, training, or retention beyond task",
+      "control_name": "P5.1 — Personal information use",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.1",
+      "control_name": "TPSP programme",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling vendors with access to CHD are TPSPs — add to TPSP list, initiate compliance process"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.3",
+      "control_name": "TPSP agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Written agreements with labelling vendors acknowledging CHD security responsibility"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.3.1",
+      "control_name": "SAD prohibition",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "SAD must never appear in labelling tasks — labels cannot expose CVV or full magnetic stripe data"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labelling task data minimised — annotators see minimum CHD required for annotation function"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data labeling and human review services governed as AI supply chain components — DPA, access controls, and data handling requirements contractually mandated"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data provided to human reviewers classified and minimised — no unnecessary sensitive data in labeling batches"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All human reviewer data access logged — access scope, duration, and data volume tracked"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Supply Chain Security (SCS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Labeling service providers assessed as supply chain components — security controls, sub-contractor restrictions, jurisdiction reviewed"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Design circuit breakers and isolation boundaries between data pipeline stages"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Detect correlated failures across pipeline stages; alert before full cascade"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-EM",
+      "control_name": "Operations / Environment Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Continuous health checks across all pipeline components"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify blast radius containment design before deployment"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Documented runbook for data pipeline cascade scenarios"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-285",
+      "control_name": "CWE-285",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/285.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-359",
+      "control_name": "CWE-359",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/359.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "D",
+      "control_name": "Reliability domain (all)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Shared credential across pipeline stages — one failure affects all",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Separate credentials per pipeline stage"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Single credential covering multiple pipeline stages amplifies cascade",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Per-stage minimum scope credentials"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.4.1-PS",
+      "control_name": "Reuse existing well-secured software — third-party data vetting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vet all third-party data sources, APIs, and pre-trained components for security, quality, compliance, and provenance before use in AI pipelines"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.2.1-PS",
+      "control_name": "Verify software integrity — third-party data integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify integrity of all third-party data deliveries using checksums, signatures, or schema validation; detect tampering or corruption before pipeline ingestion"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.1.1-PS",
+      "control_name": "Identify and confirm vulnerabilities — third-party monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor for security advisories and quality issues from third-party data providers; establish triage procedures for third-party data incidents"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-9",
+      "control_name": "External Information System Services — third-party data controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require FedRAMP authorisation for third-party data service providers; establish SLAs covering data security, privacy, and incident notification"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-2",
+      "control_name": "Supply Chain Risk Management Plan — data provider risk",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include third-party data providers in supply chain risk management; assess data handling practices and security posture"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-3",
+      "control_name": "Supply Chain Controls — data provenance from third parties",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify provenance and integrity of data from third-party sources; implement validation before ingestion into AI pipelines"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — data provider and processor oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include all third-party data providers and processors in DORA third-party risk management; conduct due diligence, establish contracts, and monitor ongoing compliance"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — third-party data inventory",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Register all third-party data sources in ICT asset inventory; document provenance, contracts, and dependency relationships"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 45",
+      "control_name": "Information Sharing — third-party threat intelligence",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Participate in information sharing arrangements for third-party AI data risks; share threat intelligence on data provider compromises"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Label Studio",
+      "type": "open-source",
+      "url": "https://labelstud.io"
+    },
+    {
+      "name": "Scale AI",
+      "type": "commercial",
+      "url": "https://scale.com"
+    },
+    {
+      "name": "Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "Great Expectations",
+      "type": "open-source",
+      "url": "https://greatexpectations.io"
+    },
+    {
+      "name": "CycloneDX",
+      "type": "open-source",
+      "url": "https://cyclonedx.org"
+    },
+    {
+      "name": "Sigstore",
+      "type": "open-source",
+      "url": "https://www.sigstore.dev"
+    },
+    {
+      "name": "OWASP Dependency-Check",
+      "type": "open-source",
+      "url": "https://owasp.org/www-project-dependency-check/"
+    },
+    {
+      "name": "OneTrust Vendorpedia",
+      "type": "commercial",
+      "url": "https://www.onetrust.com"
+    },
+    {
+      "name": "ServiceNow VRM",
+      "type": "commercial",
+      "url": "https://www.servicenow.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Scale AI / Sama contractor data exposure — third-party AI labeling workforce privacy violations",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-044"
+    }
+  ],
+  "crossrefs": {
+    "dsgai_2026": [
+      "DSGAI07",
+      "DSGAI08"
+    ],
+    "llm_top10": [
+      "LLM02",
+      "LLM05",
+      "LLM03"
+    ],
+    "agentic_top10": [
+      "ASI10",
+      "ASI04"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}