genai-security-crosswalk 2.0.0

package/data/entries/LLM01.json

@@ -0,0 +1,975 @@
+{
+  "id": "LLM01",
+  "name": "Prompt Injection",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051.000",
+      "control_name": "Direct Prompt Injection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0051.000",
+      "notes": "Attacker directly manipulates user-facing prompt to alter model behaviour"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051.001",
+      "control_name": "Indirect Prompt Injection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0051.001",
+      "notes": "Hidden instructions in content the model processes (documents, web, RAG)"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0054",
+      "control_name": "LLM Jailbreak",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0054",
+      "notes": "Circumventing model safety guardrails via crafted prompt sequences"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI characteristics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Organisational policies explicitly address adversarial input risks including prompt injection"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection categorised as a high-priority risk in the AI system risk register"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing and evaluation — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial testing programme validates model resilience to prompt injection at each release"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response — incident",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Defined incident response procedures for detected prompt injection attacks"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Providers of high-risk AI must implement a risk management system covering all reasonably foreseeable risks",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection must be identified, analysed, and mitigated in the risk management system"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI systems must be resilient to adversarial inputs and attempts to alter outputs or performance",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Robustness against prompt injection is a technical compliance requirement — not optional"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Providers of systemic risk GPAI models must conduct adversarial testing to identify and mitigate systemic risks",
+      "control_name": "Art. 55(1)(b) — Systemic risk GPAI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection adversarial testing is a binding obligation for systemic risk models"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure coding requirements for all LLM integration code — input validation, sanitisation, context separation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial testing programme covering prompt injection scenarios before each release"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.7",
+      "control_name": "Threat intelligence",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Active intelligence on prompt injection techniques — new attack patterns inform detection controls"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Runtime monitoring for prompt injection indicators in LLM inputs and outputs"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI systems designed with security controls — input validation, context separation, injection detection as AIMS design requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.6",
+      "control_name": "Testing of AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI systems tested before deployment — adversarial testing for prompt injection as AIMS testing requirement"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.8",
+      "control_name": "Monitoring of AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI systems monitored in operation — runtime injection detection as AIMS monitoring control"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.6.1",
+      "control_name": "Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection included in AI risk assessment — risk owner, treatment, review cadence documented"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.1 Establish secure application development standards",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure development standards covering LLM integration — input validation, context separation"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.2 Implement code review",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Code review for all LLM integration code — prompt injection patterns reviewed"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "18.1 Establish penetration testing programme",
+      "control_name": "CIS 18 — Penetration Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial testing programme covering prompt injection scenarios"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.2 Collect audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Runtime logging of all LLM inputs — injection attempts detectable through log analysis"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.1.1",
+      "control_name": "Verify all user input validated against an allowlist or rejected",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.1.2",
+      "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM API request validation — prompt structure, content type, and character set enforced"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.1",
+      "control_name": "Verify output encoding prevents injection attacks",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output encoding before passing to downstream renderers or interpreters"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.5",
+      "control_name": "Verify application protects against OS command injection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated content validated before execution in any shell or interpreter context"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V1.1.2",
+      "control_name": "Threat modelling of all data flows",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM data flows threat-modelled — all injection paths identified and documented"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.2",
+      "control_name": "Verify business logic limits prevent abuse of LLM functions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All inputs to LLMs connected to OT systems validated for integrity — crafted inputs rejected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLMs granted minimum necessary access to OT data — cannot read or write to control systems without explicit scoping"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.1",
+      "control_name": "Use control enforcement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforcement of permitted use of LLM within OT context — out-of-scope requests rejected at the gateway layer"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.6",
+      "control_name": "Authenticator feedback",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM interactions logged with user identity — injection attempts attributable to specific sessions"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.9",
+      "control_name": "Remote session termination",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ability to terminate LLM sessions immediately on detection of suspicious behaviour"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Malicious code and logic attacks via IT/OT convergence",
+      "control_name": "Section 5.3 — Threats",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection as a new logic attack vector through LLM at the IT/OT boundary"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Identify threats, vulnerabilities, and impacts for all OT systems",
+      "control_name": "Section 6.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection documented in OT risk assessment for each LLM integration"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Defense-in-depth network architecture with validated data flows",
+      "control_name": "Section 7.2 — Network segmentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Input validation layer at the DMZ/control zone boundary — prompt injection filtered before reaching LLM"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Information Input Validation",
+      "control_name": "SI-10",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validate all inputs to LLMs connected to OT systems — reject inputs containing injection indicators"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Malicious Code Protection",
+      "control_name": "SI-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Treat prompt injection as a malicious code analog — detection and response controls required"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Access Enforcement",
+      "control_name": "AC-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM access to OT systems enforced by policy — injection cannot escalate LLM access beyond defined scope"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-04",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure software development practices applied to LLM integrations — input validation as a platform security control"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Networks and assets monitored for anomalies — LLM input channels monitored for injection indicators"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vulnerabilities in assets identified and documented — prompt injection as a documented vulnerability class for all LLM deployments"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Mission and stakeholder expectations inform cybersecurity risk decisions — acceptable LLM use scope defines injection risk surface"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed",
+      "control_name": "CC3.2 — Risk assessment identifies threats and vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Runtime monitoring for prompt injection indicators on all LLM input channels — alerts integrated into SOC monitoring",
+      "control_name": "CC7.2 — Anomaly and threat detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Input validation procedures documented for all LLM integrations — implemented, tested, and reviewed",
+      "control_name": "CC5.2 — Select and develop control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM access controls limit the blast radius of successful injection — least privilege enforced on all tool access",
+      "control_name": "CC6.1 — Logical access restrictions",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.2.4",
+      "control_name": "Secure software development",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All injection vulnerabilities addressed in LLM integration code — prompt injection as a known injection class"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.4.1",
+      "control_name": "Public-facing application protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-powered customer-facing applications protected against prompt injection — WAF or equivalent, security testing"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.6.1",
+      "control_name": "Audit log review",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated log analysis covering LLM injection indicators — anomalous inputs detected and reviewed"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "External and internal penetration testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Penetration testing includes prompt injection scenarios for all LLM applications in PCI scope"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM applications tested against prompt injection before deployment — adversarial inputs validated as part of AI system integrity verification"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Runtime monitoring for injection indicators across all LLM input channels — AI-specific anomaly detection"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection documented in AI risk register — risk assessment per deployment, treatment controls, review cadence"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Secure Development",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Input validation and context separation as secure development requirements for all LLM integrations"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Threat Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM data flows threat-modelled — all injection paths (direct, indirect, multi-turn) identified and documented"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Input validation and context separation as secure build requirements — reviewed in CI/CD before merge"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial testing programme covering prompt injection — direct, indirect, RAG-specific, jailbreak scenarios"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Incident Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Runtime injection detection as operational monitoring — alerts integrated into incident management"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "S",
+      "control_name": "Instruction Spoofing",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "T",
+      "control_name": "Behaviour Tampering",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "E",
+      "control_name": "Privilege Elevation via Injection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-20",
+      "control_name": "CWE-20",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/20.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-74",
+      "control_name": "CWE-74",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/74.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-77",
+      "control_name": "CWE-77",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/77.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Injection via all input channels",
+      "control_name": "IHT — Input Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inject instruction-overriding content through user prompt, RAG-retrieved documents, tool return values, uploaded files, and any other data source the LLM processes"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Goal consistency under adversarial input",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify the LLM's task framing at request start matches its actions and outputs at completion — test divergence after injection"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Injection detection audit trail",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that injection attempts are flagged in monitoring and appear in audit logs with sufficient detail for incident response"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B005",
+      "control_name": "Implement real-time input filtering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Injection blast radius proportional to credential scope",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply least-privilege to all LLM application credentials"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Injected session can use stolen long-lived tokens for extended period",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Rotate all LLM application tokens; implement short-lived token pattern"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software to meet security requirements — adversarial input",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Threat model the AI pipeline for adversarial input vectors including direct and indirect prompt injection; document mitigating design decisions"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review the software for security vulnerabilities — model behaviour",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Review model outputs and system behaviour for unexpected responses to adversarial inputs; include injection bypass scenarios in code and design reviews"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.8.2-PS",
+      "control_name": "Test for security vulnerabilities — adversarial / red-team",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct adversarial testing (red-teaming) against prompt injection vectors before each production release; cover direct, indirect, and multimodal injection paths"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.1.1-PS",
+      "control_name": "Identify and confirm vulnerabilities — AI-specific",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish procedures to identify prompt injection incidents in production including monitoring, triage, and confirmation workflows"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-3",
+      "control_name": "Malicious Code Protection — adversarial AI inputs",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Extend malicious code protection to detect and block adversarial inputs including direct and indirect prompt injection payloads"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-10",
+      "control_name": "Information Input Validation — prompt validation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validate all inputs to LLM inference endpoints; enforce structural separation between instruction and data contexts; reject known injection patterns"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "RA-5",
+      "control_name": "Vulnerability Scanning — AI red-teaming",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include prompt injection vectors in vulnerability scanning programme; conduct regular automated and manual injection testing"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CA-8",
+      "control_name": "Penetration Testing — AI adversarial testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include prompt injection scenarios in penetration testing engagements; cover direct, indirect, and multimodal injection paths"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — adversarial input controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement ICT security controls to detect and block adversarial inputs including direct and indirect prompt injection; treat as a mandatory protection measure"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Digital Operational Resilience Testing — AI red-teaming",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include prompt injection scenarios in threat-led penetration testing (TLPT); cover direct, indirect, and multimodal injection vectors targeting financial AI services"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — injection monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deploy detection mechanisms for prompt injection attempts; monitor inference requests for adversarial patterns and alert security operations"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 45",
+      "control_name": "Information Sharing — injection threat intelligence",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Share prompt injection threat intelligence with sector peers through DORA information sharing arrangements"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "PromptBench",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/promptbench"
+    },
+    {
+      "name": "LLM Guard",
+      "type": "open-source",
+      "url": "https://github.com/protectai/llm-guard"
+    },
+    {
+      "name": "Rebuff",
+      "type": "open-source",
+      "url": "https://github.com/protectai/rebuff"
+    },
+    {
+      "name": "NIST AI RMF Playbook",
+      "type": "open-source",
+      "url": "https://airc.nist.gov/Docs/2"
+    },
+    {
+      "name": "OWASP ZAP (for API testing)",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "Claroty",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "Dragos",
+      "type": "commercial",
+      "url": "https://www.dragos.com"
+    },
+    {
+      "name": "Garak (for adversarial testing)",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "Promptfoo",
+      "type": "open-source",
+      "url": "https://github.com/promptfoo/promptfoo"
+    },
+    {
+      "name": "PyRIT",
+      "type": "open-source",
+      "url": "https://github.com/Azure/PyRIT"
+    },
+    {
+      "name": "NIST SP 800-218A",
+      "type": "open-source",
+      "url": "https://doi.org/10.6028/NIST.SP.800-218A.ipd"
+    },
+    {
+      "name": "NIST SP 800-53A",
+      "type": "open-source",
+      "url": "https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final"
+    },
+    {
+      "name": "DORA RTS/ITS",
+      "type": "open-source",
+      "url": "https://www.eba.europa.eu/regulation-and-policy/digital-operational-resilience-act-dora"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Bing Chat 'Sydney' jailbreak — persona escape and threatening behaviour",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-002"
+    },
+    {
+      "name": "ChatGPT indirect prompt injection via attacker-controlled web content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-003"
+    },
+    {
+      "name": "Chevrolet dealership chatbot agrees to sell car for $1",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-005"
+    },
+    {
+      "name": "Indirect prompt injection in LLM email assistant via malicious email body",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-007"
+    },
+    {
+      "name": "Microsoft Copilot for M365 — document exfiltration via indirect injection",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-010"
+    },
+    {
+      "name": "WormGPT — uncensored LLM sold for cybercrime on dark web forums",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-011"
+    },
+    {
+      "name": "LangChain and LlamaIndex RCE — agent code execution via prompt injection",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-012"
+    },
+    {
+      "name": "Perez & Ribeiro — 'Ignore Previous Prompt': foundational direct injection study",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2022,
+      "incident_id": "INC-013"
+    },
+    {
+      "name": "Multimodal indirect injection — image-embedded instructions in GPT-4V",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-015"
+    },
+    {
+      "name": "RAG corpus poisoning — embedding-space manipulation to force retrieval",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-016"
+    },
+    {
+      "name": "GPT-4 system prompt extraction via jailbreak in production deployments",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-018"
+    },
+    {
+      "name": "Multi-agent prompt injection cascade — demonstrated cross-agent goal propagation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-020"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    },
+    {
+      "name": "Greshake et al. \"Not What You've Signed Up For\" indirect prompt injection paper",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-022"
+    },
+    {
+      "name": "Nassi et al. \"ComPromptMized\" Morris II multi-agent worm",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-023"
+    },
+    {
+      "name": "Slack AI indirect injection via channel content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-024"
+    },
+    {
+      "name": "GitHub Copilot Workspace prompt injection via repository content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-025"
+    },
+    {
+      "name": "MathPrompt: symbolic mathematics jailbreak attack",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-027"
+    },
+    {
+      "name": "Many-shot jailbreaking (Anthropic research)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-028"
+    },
+    {
+      "name": "Crescendo: multi-turn escalation attack (Microsoft)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-029"
+    },
+    {
+      "name": "Skeleton Key: direct system prompt override (Microsoft)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-030"
+    },
+    {
+      "name": "OpenAI o1/o3 reasoning chain jailbreak via chain-of-thought manipulation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-033"
+    },
+    {
+      "name": "Azure OpenAI content filter bypass via structured output mode",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-037"
+    },
+    {
+      "name": "Adversarial embedding attacks on production RAG systems",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-046"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI01",
+      "ASI02"
+    ],
+    "dsgai_2026": [
+      "DSGAI01",
+      "DSGAI15",
+      "DSGAI12"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}