genai-security-crosswalk 2.0.0

package/data/entries/LLM02.json

@@ -0,0 +1,868 @@
+{
+  "id": "LLM02",
+  "name": "Sensitive Information Disclosure",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0021",
+      "control_name": "Data Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0021",
+      "notes": "Unintended exposure of training data or sensitive context through model outputs"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0030",
+      "control_name": "Information Disclosure",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0030",
+      "notes": "Extraction of confidential information via targeted model queries"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0024",
+      "control_name": "Model Inversion",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0024",
+      "notes": "Reconstructing training data from model outputs or confidence scores"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Organisational policies for data privacy in AI systems — classification, handling, and disclosure controls"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive information disclosure categorised and risk-rated in AI system risk register"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Evaluation programme includes data leakage and privacy disclosure testing"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Defined procedures for responding to sensitive data disclosure incidents"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Training data for high-risk AI must be relevant, representative, free of errors, and complete — must address privacy",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Privacy-preserving training data practices are a compliance requirement for high-risk LLMs"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Users must receive information about capabilities, limitations, and conditions of use",
+      "control_name": "Art. 13 — Transparency",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Disclosure of potential data disclosure risks is a transparency obligation"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Documented quality management system including post-market monitoring",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Post-market monitoring must detect and respond to sensitive disclosure incidents"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "GPAI providers must maintain technical documentation including training data governance",
+      "control_name": "Art. 53(1)(a) — GPAI documentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data governance for GPAI training data is a binding documentation obligation from Aug 2025"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output redaction for PII and sensitive patterns before responses reach users"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DLP on all LLM output channels — API, chat interface, logs"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All data in LLM scope classified — training data, RAG sources, outputs, embeddings"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access controls on RAG retrieval — users retrieve only data they are authorised to access"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.2",
+      "control_name": "Data quality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training data and RAG content quality requirements — sensitivity, completeness, appropriateness assessed before use"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.3",
+      "control_name": "Data provenance and characteristics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data provenance documented — source, classification, handling requirements tracked from ingestion through all derived forms"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output scanning and redaction as AIMS security controls — DLP enforced at the system boundary"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.5.2",
+      "control_name": "Impact assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Impact assessment covers data disclosure risk — what data is in LLM scope, what is the disclosure impact per stakeholder"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "3.1 Establish and maintain data management process",
+      "control_name": "CIS 3 — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data classification and handling requirements applied to all LLM data assets"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "3.11 Encrypt sensitive data at rest",
+      "control_name": "CIS 3 — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Embeddings, training data, and RAG caches containing sensitive data encrypted"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "14.1 Establish security awareness programme",
+      "control_name": "CIS 14 — Security Awareness",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "User training on LLM data handling — what data should not be shared with LLMs"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.5 Collect detailed audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Detailed logging of all LLM data access — RAG queries, data retrieved, outputs generated"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8.1.1",
+      "control_name": "Verify sensitive data is not cached or exposed in logs",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8.3.4",
+      "control_name": "Verify PII is identified and protected",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control decisions enforce least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V6.1.1",
+      "control_name": "Verify all sensitive data encrypted at rest",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V9.1.1",
+      "control_name": "Verify all sensitive data encrypted in transit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality in transit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All OT data accessed by LLMs encrypted in transit — no cleartext historian queries over OT network"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.2",
+      "control_name": "Data confidentiality at rest",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT data used in LLM context or stored by LLM components encrypted at rest"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.1",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM outputs containing OT data restricted to authorised users — no unrestricted external output"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Identification and authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM access to OT data systems requires authenticated, authorised identity"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Information disclosure and OT espionage",
+      "control_name": "Section 5.4 — Threats",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLMs with historian access as a new vector for automated OT intelligence gathering"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Assess confidentiality of OT data",
+      "control_name": "Section 6.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT data classification applied to all data accessible by LLMs"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Protecting OT data at rest and in transit",
+      "control_name": "Section 7.3 — Data protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Encryption and access controls on all OT data paths feeding LLM context"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Protection of Information at Rest",
+      "control_name": "SC-28",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT data used in LLM context encrypted at rest — historian exports, embedding stores, prompt caches"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Access Enforcement",
+      "control_name": "AC-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM access to OT data enforced by classification — sensitive process and network data requires elevated access tier"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Protection of Audit Information",
+      "control_name": "AU-9",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM access logs to OT data protected — audit trail of all OT data accessed by LLM"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data-at-rest protected — training data, embeddings, RAG stores containing sensitive information encrypted"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-02",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data-in-transit protected — all LLM API calls and RAG retrieval paths encrypted"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output channels monitored for sensitive data patterns — DLP coverage"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.RM-06",
+      "control_name": "Risk Management Strategy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk tolerance established — acceptable levels of sensitive data disclosure risk defined per use case"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Policy identifying confidential information in LLM scope and how it is handled — training data, RAG corpus, outputs",
+      "control_name": "C1.1 — Confidentiality policy",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Technical controls protecting confidential data in LLM pipelines — encryption, access controls, output scanning",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Personal information in LLM scope identified — training data, RAG sources, outputs — collection documented",
+      "control_name": "P3.1 — Personal information collection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Personal information used only for purposes disclosed — LLM processing of customer PII limited to agreed use cases",
+      "control_name": "P5.1 — Personal information use",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access controls on RAG data sources — users retrieve only data they are authorised to access",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.3.1",
+      "control_name": "Protect stored account data — SAD prohibition",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "SAD (CVV, PIN) must never be in LLM training data or RAG — stored after authorisation is prohibited"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.4.1",
+      "control_name": "Protect stored account data — PAN rendering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "PANs in LLM outputs masked — only first six and last four digits displayed in any LLM response"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protect stored account data — encryption",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Any PAN in LLM scope encrypted with strong cryptography — AES-256 or equivalent"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 4.2.1",
+      "control_name": "Protect cardholder data in transit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM API calls and RAG retrieval paths carrying CHD encrypted in transit — TLS 1.2 minimum"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access by need to know",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM access to CHD restricted to minimum required — retrieval access controls prevent over-broad PAN access"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All data in LLM scope classified and governed — training corpora, RAG sources, embeddings, outputs"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DLP on all LLM output channels — AI-specific monitoring covering sensitive data patterns"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "GDPR and EU AI Act Article 10 data governance obligations addressed for LLM deployments"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training data, embeddings, and RAG stores encrypted at rest and in transit"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data classification and handling requirements defined for all LLM-integrated applications before development"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output redaction and DLP implemented in code — LLM output scanned before delivery, reviewed in build"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-RT",
+      "control_name": "Requirements-Driven Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data protection requirements verified in testing — PII patterns confirmed not to appear in LLM outputs"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Production DLP monitoring on LLM output channels — operational data protection as ongoing practice"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "I",
+      "control_name": "Sensitive Data Disclosure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "R",
+      "control_name": "Disclosure Without Audit Trail",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-201",
+      "control_name": "CWE-201",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/201.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-359",
+      "control_name": "CWE-359",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/359.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "PII and sensitive data extraction from outputs",
+      "control_name": "DPT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Attempt to extract PII, credentials, financial data, and confidential content from model outputs through direct questions, social engineering prompts, and adversarial extraction techniques"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Output DLP effectiveness",
+      "control_name": "OHT — Output Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that DLP controls on LLM outputs correctly detect and block sensitive data patterns before delivery"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Data access authorisation enforcement",
+      "control_name": "ACT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that RAG retrieval and context population enforce user authorisation — users cannot access documents above their permission level"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "PII protection and data leakage prevention",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "LLM outputs containing API keys, tokens, or credentials",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output filtering: detect and redact credential patterns in all outputs"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Credentials in plaintext config files ingested by LLM",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Audit all config and data sources for embedded credentials"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.5.1-PS",
+      "control_name": "Secure coding — ML pipeline output handling",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Implement secure coding practices for all code paths that consume LLM output; treat model responses as untrusted input to downstream systems"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review for security vulnerabilities — output validation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include output injection and unsafe rendering scenarios in pre-release security reviews; verify that output sanitisation controls are present and effective"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.2.1-PS",
+      "control_name": "Verify software integrity — model artifact integrity",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Verify that the model artifact serving output has not been tampered with; maintain signed model checksums and verify before deployment"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.8.2-PS",
+      "control_name": "Test for security vulnerabilities — output security",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include output-based injection testing (XSS, SQLi, CMDi via LLM output) in adversarial test suites"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-28",
+      "control_name": "Protection of Information at Rest — training data and model weights",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Encrypt training data, fine-tuning datasets, and model weights at rest; prevent data memorisation exposure through access controls on data stores"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — AI inference logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log all model inference requests and responses with sufficient detail to detect sensitive data disclosure; include user identity, query content, and response metadata"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — model endpoint access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce role-based access control on model inference endpoints; restrict access to training data, fine-tuning data, and model configuration based on clearance and need-to-know"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — output content monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor model outputs for sensitive data patterns — PII, credentials, classification markings — and alert on detection"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — data disclosure controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement ICT security controls to prevent LLM-based disclosure of sensitive financial data, PII, and credentials; include output monitoring and data loss prevention"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 17–23",
+      "control_name": "ICT Incident Management — data breach reporting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Classify LLM data disclosure events as ICT-related incidents; report to competent authorities per DORA incident classification and reporting requirements"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — AI data governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI data handling in ICT risk management framework; define policies for data processed by LLM systems including classification, retention, and access controls"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — data leakage detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Microsoft Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "Amazon Comprehend",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/comprehend/"
+    },
+    {
+      "name": "Nightfall AI",
+      "type": "commercial",
+      "url": "https://nightfall.ai"
+    },
+    {
+      "name": "Private AI",
+      "type": "commercial",
+      "url": "https://private-ai.com"
+    },
+    {
+      "name": "Nozomi Networks",
+      "type": "commercial",
+      "url": "https://www.nozominetworks.com"
+    },
+    {
+      "name": "Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "LLM Guard",
+      "type": "open-source",
+      "url": "https://github.com/protectai/llm-guard"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "OWASP ZAP",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://semgrep.dev"
+    },
+    {
+      "name": "DOMPurify",
+      "type": "open-source",
+      "url": "https://github.com/cure53/DOMPurify"
+    },
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "AWS CloudTrail / Azure Monitor",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/cloudtrail/"
+    },
+    {
+      "name": "Nightfall DLP",
+      "type": "commercial",
+      "url": "https://www.nightfall.ai"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Samsung employees leak source code and meeting notes via ChatGPT",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-001"
+    },
+    {
+      "name": "OpenAI Redis caching bug exposes user conversation history",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-006"
+    },
+    {
+      "name": "GitHub Copilot reproduces verbatim licensed code and embedded secrets",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-008"
+    },
+    {
+      "name": "Slack AI indirect injection via channel content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-024"
+    },
+    {
+      "name": "DeepSeek AI database exposure — 1M+ chat logs publicly accessible",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-032"
+    },
+    {
+      "name": "Cursor AI code agent leaking repository secrets via context window",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-034"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI03",
+      "ASI06",
+      "ASI02",
+      "ASI05"
+    ],
+    "dsgai_2026": [
+      "DSGAI01",
+      "DSGAI10",
+      "DSGAI18",
+      "DSGAI07",
+      "DSGAI08",
+      "DSGAI06",
+      "DSGAI03",
+      "DSGAI05",
+      "DSGAI12",
+      "DSGAI16"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}