genai-security-crosswalk 2.0.0

package/data/entries/LLM03.json

@@ -0,0 +1,817 @@
+{
+  "id": "LLM03",
+  "name": "Supply Chain Vulnerabilities",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0056",
+      "control_name": "Adversarial Model Manipulation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0056",
+      "notes": "Tampering with model weights, adapters, or configurations during supply chain"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0048",
+      "control_name": "Model Contamination",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0048",
+      "notes": "Introducing persistent malicious behaviour into model through supply chain"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0010",
+      "control_name": "Backdoor ML Model",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0010",
+      "notes": "Embedding trigger-based backdoors in model weights via training or fine-tuning supply chain"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Supply chain data governance — policies for third-party model and data provenance"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-5.1",
+      "control_name": "Interdependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Mapping of all AI system dependencies including third-party models, datasets, and libraries"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing and evaluation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Evaluation programme includes supply chain component integrity testing"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-3.2",
+      "control_name": "Residual risk — third party",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Residual risk from third-party components documented, monitored, and treated"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Supply chain risks must be identified and mitigated in the risk management system",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party component risks are in scope for Art. 9 risk management"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Quality management must cover supply chain controls",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented supply chain security procedures required"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Responsibilities distributed along the AI value chain between providers and deployers",
+      "control_name": "Art. 25 — Value chain responsibilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Providers must document what deployers inherit — deployers must verify"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "GPAI providers must document training data governance including third-party sources",
+      "control_name": "Art. 53(1)(a) — GPAI documentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party training data provenance is a GPAI documentation obligation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.19",
+      "control_name": "Supplier relationships",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements applied to all LLM model and data vendors — provenance, integrity, disclosure obligations"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.20",
+      "control_name": "Supplier agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Contractual security requirements for LLM component suppliers — integrity guarantees, vulnerability notification"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.21",
+      "control_name": "Supply chain security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Managing ICT supply chain risks — LLM model and library supply chain explicitly in scope"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.8",
+      "control_name": "Management of technical vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Scanning and patching LLM component vulnerabilities — model weights and inference runtime libraries"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.1",
+      "control_name": "Third-party AI system acquisition",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements applied to all LLM component vendors — model providers, dataset suppliers, inference runtime vendors"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.2",
+      "control_name": "Customer relationships",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM deployment obligations to downstream customers — what security properties are guaranteed"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.1.2",
+      "control_name": "Responsible AI system management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM components managed responsibly through lifecycle — acquisition, testing, deployment, decommission"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.2",
+      "control_name": "Data quality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party training datasets assessed for quality — provenance, completeness, representativeness, security"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "2.1 Establish and maintain software asset inventory",
+      "control_name": "CIS 2 — Inventory and Control of Software Assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "ML SBOM maintained as part of software asset inventory — model versions, libraries, adapters"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "7.1 Establish vulnerability management process",
+      "control_name": "CIS 7 — Continuous Vulnerability Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vulnerability management process covers LLM component CVEs and dependency risks"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.6 Use only up-to-date and trusted third-party components",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Only approved, verified LLM components used in production — unsigned components rejected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10.2.1",
+      "control_name": "Verify third-party components are current and free from vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10.2.2",
+      "control_name": "Verify only minimal approved external libraries are used",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V14.2.2",
+      "control_name": "Verify build pipelines include security checks",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.2",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Integrity verification of all LLM components before deployment in OT environment"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.6",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Restrictions on software installation — only approved, verified LLM components permitted in OT zones"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "Supplier security requirements",
+      "control_name": "62443-2-4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements applied to all LLM vendors with access to OT environments"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Third-party software compromise as OT attack vector",
+      "control_name": "Section 5.5 — Supply chain threats",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM model weights and plugins as supply chain risk components"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risk treatment",
+      "control_name": "Section 6.3 — Risk response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "ML SBOM and component integrity verification as supply chain controls"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "OT supply chain risk management programme",
+      "control_name": "Section 8.4 — Supply chain programme",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM vendors subject to same supply chain security requirements as OT software vendors"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply Chain Protection",
+      "control_name": "SA-12",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements applied to all LLM component vendors — provenance, integrity, vulnerability disclosure"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply Chain Controls and Plans",
+      "control_name": "SR-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented supply chain security plan covering LLM components in OT deployment"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supplier Assessments and Reviews",
+      "control_name": "SR-6",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Periodic security assessment of LLM vendors with OT-deployed components"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cybersecurity supply chain risk management programme — LLM component vendors in scope"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-06",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cybersecurity requirements included in contracts with suppliers — LLM model and data vendors"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.AM-08",
+      "control_name": "Asset Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Systems and hardware managed — ML SBOM as asset inventory for LLM components"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-02",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Software managed to reduce risk — LLM component vulnerability management and patching"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM component vendors assessed before use — security questionnaires, SOC 2 reports reviewed, ongoing monitoring",
+      "control_name": "CC9.1 — Vendor risk management",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Contractual security obligations for LLM vendors — data handling, vulnerability disclosure, incident notification",
+      "control_name": "CC9.2 — Vendor agreements",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM model updates and component changes managed through change management — approval, testing, rollback",
+      "control_name": "CC8.1 — Change management",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Supply chain attack vectors identified in LLM risk assessment — training data sources, model providers, plugin vendors",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.1",
+      "control_name": "Third-party service providers",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "List of all TPSPs maintained — LLM component vendors with CDE access or data in scope"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.3",
+      "control_name": "TPSP agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Written agreements with LLM vendors — acknowledge responsibility for CHD security"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.4",
+      "control_name": "TPSP PCI DSS compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor TPSP PCI DSS compliance status — LLM component vendors with CHD access have compliant status verified"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.3.3",
+      "control_name": "Security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM software components at latest security patches — ML libraries and inference runtime patched"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.5.1",
+      "control_name": "Secure system changes",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model component updates follow change management — security testing before production"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "SCS",
+      "control_name": "Supply Chain Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM component vendors assessed — model providers, dataset vendors, inference runtime suppliers subject to SCS practices"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model weight integrity verification — cryptographic signatures, hash-based baseline"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vendor risk management extended to AI component suppliers — contractual security obligations"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Supply Chain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "ML SBOM as software asset inventory — all LLM components inventoried, CVEs monitored"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Supply chain security policy covers LLM component vendors — security requirements in procurement"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "ML SBOM maintained, CVE scanning in CI/CD — LLM components verified before each deployment"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Architecture Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM supply chain architecture reviewed — trust boundaries and component integrity verified"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "S",
+      "control_name": "Component Spoofing",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "T",
+      "control_name": "Supply Chain Tampering",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "E",
+      "control_name": "Escalation via Trusted Component",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-494",
+      "control_name": "CWE-494",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/494.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-345",
+      "control_name": "CWE-345",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/345.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-1357",
+      "control_name": "CWE-1357",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/1357.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Component integrity verification",
+      "control_name": "SCT — Supply Chain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify cryptographic integrity of model weights, adapters, and libraries; test that procurement pipeline rejects tampered components"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Backdoor behaviour detection",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Test model with trigger inputs across all deployment configurations to detect backdoors introduced through supply chain"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Plugin and tool descriptor integrity",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify plugin descriptors and tool registries have not been tampered with; test that integrity checks reject modified components"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B003",
+      "control_name": "Third-party security assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B008",
+      "control_name": "Third-party NHI controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy supply chain controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Third-party plugin tokens with excessive permissions",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Review all third-party credentials; apply minimum scope"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Third-party dev/staging credentials used in production",
+      "control_name": "NHI-8 Environment Isolation Failure",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce environment isolation for all third-party integrations"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Third-party component credentials exposed in shared config",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Separate credential stores per third-party component"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — training data and pipelines",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Protect training data repositories, fine-tuning datasets, and ML pipeline code from unauthorised read, write, and modification"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — model versioning",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain versioned, integrity-verified training data snapshots and model checkpoints in a secure model registry; enable rollback"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.4.1-PS",
+      "control_name": "Reuse existing well-secured software — dataset vetting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vet all third-party and external training datasets for provenance, integrity, and potential poisoning before use in any training run"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.3.1-PS",
+      "control_name": "Analyse root causes — training data forensics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "When poisoning is detected, conduct training data analysis to identify the poisoned records, their source, and the blast radius"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-2",
+      "control_name": "Supply Chain Risk Management Plan — AI data sources",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI training data sources, fine-tuning datasets, and pre-trained model weights in the supply chain risk management plan; document provenance and risk assessment for each"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-3",
+      "control_name": "Supply Chain Controls and Processes — model provenance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement supply chain controls for AI model components — verify integrity, provenance, and authenticity of all training data and model weights before use"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-3",
+      "control_name": "Malicious Code Protection — training pipeline integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Extend malicious code protection to training data pipelines; detect and block poisoned data, anomalous labels, and backdoor triggers"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-3",
+      "control_name": "Configuration Change Control — model update governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require formal change control for all model updates, fine-tuning runs, and training data changes; maintain audit trail of all modifications"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — AI data and model provider oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI model providers and training data vendors in third-party ICT risk oversight; assess data provenance, integrity, and poisoning risk"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — training pipeline integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls protecting training data pipelines from unauthorised modification, poisoned data injection, and backdoor embedding"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — AI training data assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Identify and classify all AI training datasets, fine-tuning data, and model weights as ICT assets in the asset inventory"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — poisoning post-mortem",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct post-incident analysis for data poisoning events; identify root cause, trace poisoned records, and update protection controls"
+    }
+  ],
+  "tools": [
+    {
+      "name": "CycloneDX",
+      "type": "open-source",
+      "url": "https://cyclonedx.org"
+    },
+    {
+      "name": "OWASP Dependency-Check",
+      "type": "open-source",
+      "url": "https://owasp.org/www-project-dependency-check/"
+    },
+    {
+      "name": "ModelScan",
+      "type": "open-source",
+      "url": "https://github.com/protectai/modelscan"
+    },
+    {
+      "name": "Snyk",
+      "type": "commercial",
+      "url": "https://snyk.io"
+    },
+    {
+      "name": "Grype",
+      "type": "open-source",
+      "url": "https://github.com/anchore/grype"
+    },
+    {
+      "name": "Syft",
+      "type": "open-source",
+      "url": "https://github.com/anchore/syft"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "IBM Adversarial Robustness Toolbox",
+      "type": "open-source",
+      "url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox"
+    },
+    {
+      "name": "CleanLab",
+      "type": "open-source",
+      "url": "https://github.com/cleanlab/cleanlab"
+    },
+    {
+      "name": "Great Expectations",
+      "type": "open-source",
+      "url": "https://greatexpectations.io"
+    },
+    {
+      "name": "Sigstore",
+      "type": "open-source",
+      "url": "https://www.sigstore.dev"
+    },
+    {
+      "name": "Counterfit",
+      "url": "https://github.com/Azure/counterfit",
+      "type": "open-source"
+    },
+    {
+      "name": "WhyLogs",
+      "url": "https://github.com/whylabs/whylogs",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Hugging Face model repository pickle-based malware supply chain",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-009"
+    },
+    {
+      "name": "Hugging Face model card supply chain manipulation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-038"
+    },
+    {
+      "name": "Scale AI / Sama contractor data exposure — third-party AI labeling workforce privacy violations",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-044"
+    },
+    {
+      "name": "Stability AI synthetic CSAM generation — training data and output safety failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-049"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI04",
+      "ASI07",
+      "ASI06"
+    ],
+    "dsgai_2026": [
+      "DSGAI04",
+      "DSGAI03",
+      "DSGAI06",
+      "DSGAI16",
+      "DSGAI17",
+      "DSGAI05"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}