genai-security-crosswalk 2.0.0

package/data/entries/LLM04.json

@@ -0,0 +1,797 @@
+{
+  "id": "LLM04",
+  "name": "Data and Model Poisoning",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0032",
+      "control_name": "Data Poisoning",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0032",
+      "notes": "Injecting malicious data into training pipelines to corrupt model behaviour"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0031",
+      "control_name": "Backdoor ML Model",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0031",
+      "notes": "Embedding hidden trigger-response patterns in model via poisoned training data"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0027",
+      "control_name": "Model Inversion",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0027",
+      "notes": "Reconstructing sensitive training data from model outputs"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data and model poisoning categorised as Critical in AI risk register"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarial testing specifically covering poisoning detection in training pipelines"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-3.3",
+      "control_name": "Data quality",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data quality measurement and validation applied to all training and fine-tuning data"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Defined response procedures including model rollback for detected poisoning events"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Data poisoning must be identified as a foreseeable risk and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning attack scenarios required in Art. 9 risk assessment"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Training data must be subject to appropriate governance practices — relevant, representative, free of errors",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data quality controls preventing poisoning are a compliance requirement"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Technical robustness against poisoning is a binding Art. 15 requirement"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify model-level risks",
+      "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning detection is in scope for Art. 55 adversarial testing"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.8",
+      "control_name": "Management of technical vulnerabilities",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training pipeline dependency scanning — vulnerabilities in training infrastructure components"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.27",
+      "control_name": "Secure system architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training pipeline designed with integrity controls — data validation, source allowlisting, lineage tracking"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarial testing covering poisoning detection before each production model promotion"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.7",
+      "control_name": "Threat intelligence",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Intelligence on active data poisoning campaigns targeting your sector and model type"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.2",
+      "control_name": "Data quality",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data quality requirements include integrity — anomaly detection, source allowlisting, provenance tracking as data quality controls"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.3",
+      "control_name": "Data provenance and characteristics",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data provenance documented — full chain from source to training dataset, modification history tracked"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training pipeline integrity controls — input validation, source allowlisting as AIMS security design requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.6",
+      "control_name": "Testing of AI systems",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning detection in AIMS testing — backdoor trigger testing, biased output detection before each production promotion"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "7.5 Perform automated vulnerability scanning",
+      "control_name": "CIS 7 — Continuous Vulnerability Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.7 Use standard hardening configuration templates",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardened training pipeline configurations — immutable infrastructure, locked data sources"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "18.3 Remediate penetration testing findings",
+      "control_name": "CIS 18 — Penetration Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.12 Collect service provider logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Full audit trail of training data provenance and model training runs"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.1.1",
+      "control_name": "Verify all inputs validated against allowlist",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data pipeline input validation — anomalous data rejected before training"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10.2.1",
+      "control_name": "Verify third-party components free of vulnerabilities",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training pipeline components scanned — compromised dependencies rejected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V12.1.1",
+      "control_name": "Verify file uploads scanned for malware",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data uploads scanned before ingestion — adversarial content detected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "LLM model integrity verified before each OT deployment — poisoning detection as integrity control"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity (monitoring)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Continuous monitoring of LLM outputs for anomalous recommendations — statistical deviation detection"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.1",
+      "control_name": "Timely response to events",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Detection and response to poisoning indicators — LLM output anomalies treated as security events"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Attacks targeting OT data and system integrity",
+      "control_name": "Section 5.3 — Integrity threats",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model poisoning as an integrity attack on the LLM advisory system"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Assess integrity risks for all OT-connected systems",
+      "control_name": "Section 6.2 — Risk assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model poisoning scenarios included in OT risk assessment for each LLM"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Layered controls to maintain system integrity",
+      "control_name": "Section 7.2 — Defense-in-depth",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Independent validation of LLM outputs against rule-based reference systems"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Software, Firmware, and Information Integrity",
+      "control_name": "SI-7",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model integrity verification before each OT deployment — hash-based integrity check"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Information Input Validation",
+      "control_name": "SI-10",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data validation — adversarial content detected and rejected before training"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Audit Record Generation",
+      "control_name": "AU-12",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Full audit trail of LLM outputs — poisoning indicators detectable through output analysis"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data protected at rest — integrity verification, source allowlisting, provenance tracking"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for unauthorised software and configuration changes — model integrity verification at deployment"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning attack vectors identified and documented in risk assessment for each LLM deployment"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.AN-03",
+      "control_name": "Incident Analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Root cause analysis for poisoning incidents — identify affected deployments, assess physical impact"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Data and model poisoning identified as threats in LLM risk assessment — training pipeline, supply chain, and model update vectors",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Anomaly detection on model outputs and training data distributions — poisoning indicators detected before operational impact",
+      "control_name": "CC7.2 — Threat detection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Model promotions managed through change management — integrity verification before production deployment",
+      "control_name": "CC8.1 — Change management",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Training data providers assessed — data provenance, quality, and integrity guarantees required from vendors",
+      "control_name": "CC9.1 — Vendor risk",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.5.6",
+      "control_name": "Secure system changes",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All model promotions tested for unexpected functionality before CDE deployment — poisoning as unexpected functionality"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.6.1",
+      "control_name": "Audit log review",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Automated monitoring of LLM outputs in CDE — poisoning indicators (systematic anomalous recommendations) detected"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "Penetration testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning detection included in penetration testing programme for LLM applications in CDE"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.3.2",
+      "control_name": "Targeted risk analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Targeted risk analysis for training pipeline security — documented controls and frequency of review"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data integrity controls — source allowlisting, anomaly detection, provenance tracking as DMS practices"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Post-training backdoor detection and model integrity verification as ASI practices before deployment"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Production monitoring for poisoning indicators — systematic output anomalies detected through AI-specific monitoring"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "IRS",
+      "control_name": "Incident Response",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model rollback and poisoning incident response as ENISA IRS practice for AI-specific incidents"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Threat Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning attack vectors documented in threat model — training data sources, supply chain, fine-tuning pipeline each assessed"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Secure Build",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data integrity controls in build pipeline — source allowlisting, anomaly detection, provenance tracking"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning detection in adversarial testing — backdoor trigger testing before each model promotion"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning incident response defined — model rollback, affected deployment scope, disclosure procedure"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "T",
+      "control_name": "Training Data Tampering",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "R",
+      "control_name": "Poisoning Without Audit Trail",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-345",
+      "control_name": "CWE-345",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/345.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-346",
+      "control_name": "CWE-346",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/346.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-20",
+      "control_name": "CWE-20",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/20.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Training data integrity verification",
+      "control_name": "DPT — Data Protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify data quality gates and integrity checks at each pipeline stage catch adversarially modified samples"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Backdoor trigger detection",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Test deployed model with known trigger patterns across all deployment configurations; verify unexpected behaviour is not present"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Dataset provenance verification",
+      "control_name": "SCT — Supply Chain",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify all training datasets have documented provenance; test that unverified datasets are rejected by the pipeline"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain (all controls)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Write access to training data stores enables poisoning",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Read-only credentials for data consumption; separate write credentials with MFA"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Third-party data pipeline credentials with training data write access",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Apply NHI-3 controls to all data pipeline third-party credentials"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software — resource and availability constraints",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include resource limits, rate limiting, and availability requirements as explicit security design requirements for AI inference services"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.8.2-PS",
+      "control_name": "Test for security vulnerabilities — load and adversarial testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct adversarial load testing and sponge example testing to validate resource consumption limits hold under attack conditions"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.2.1-PS",
+      "control_name": "Assess, prioritise, and remediate — availability remediation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define remediation procedures for availability incidents including model rollback, rate limit tightening, and cost circuit breakers"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review for security vulnerabilities — resource handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include resource exhaustion scenarios in pre-release security reviews; verify that token limits and rate limits are enforced by design"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-7",
+      "control_name": "Boundary Protection — AI API endpoints",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce boundary protection on all AI inference endpoints — rate limiting, token quotas, and cost circuit breakers at the network and application boundary"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — consumption anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor AI inference services for resource consumption anomalies — token spikes, latency degradation, cost overruns; alert and auto-mitigate on threshold breach"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — AI resource restrictions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Restrict AI inference services to minimum necessary compute, memory, and token budgets; disable unused model capabilities and endpoints"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — resource consumption logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log resource consumption per inference request — tokens, latency, cost; enable detection and forensic analysis of DoS patterns"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — availability controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement rate limiting, token quotas, and cost circuit breakers on AI inference services to prevent resource exhaustion and denial of service"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — consumption anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor AI inference services for resource consumption anomalies; alert on token spikes, latency degradation, and cost overruns"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 12",
+      "control_name": "Backup Policies — AI service continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain backup model deployments, checkpoint restoration capability, and fallback inference paths for AI services supporting critical financial functions"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 11",
+      "control_name": "Response and Recovery — DoS incident response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define response and recovery procedures for AI denial of service events; include automated throttling, failover, and service restoration"
+    }
+  ],
+  "tools": [
+    {
+      "name": "IBM Adversarial Robustness Toolbox",
+      "type": "open-source",
+      "url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox"
+    },
+    {
+      "name": "CleanLab",
+      "type": "open-source",
+      "url": "https://github.com/cleanlab/cleanlab"
+    },
+    {
+      "name": "BackdoorBench",
+      "type": "open-source",
+      "url": "https://github.com/SCLBD/BackdoorBench"
+    },
+    {
+      "name": "Great Expectations",
+      "type": "open-source",
+      "url": "https://greatexpectations.io"
+    },
+    {
+      "name": "Claroty (OT monitoring)",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "Dragos",
+      "type": "commercial",
+      "url": "https://www.dragos.com"
+    },
+    {
+      "name": "Cleanlab",
+      "type": "open-source",
+      "url": "https://github.com/cleanlab/cleanlab"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "LiteLLM",
+      "type": "open-source",
+      "url": "https://github.com/BerriAI/litellm"
+    },
+    {
+      "name": "Kong Gateway",
+      "type": "open-source",
+      "url": "https://github.com/Kong/kong"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "Locust",
+      "type": "open-source",
+      "url": "https://locust.io"
+    },
+    {
+      "name": "AWS WAF / Azure Front Door",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/waf/"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Many-shot jailbreaking (Anthropic research)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-028"
+    },
+    {
+      "name": "Anthropic Claude context flooding — resource exhaustion via adversarial long-context prompts",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-045"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI06",
+      "ASI08"
+    ],
+    "dsgai_2026": [
+      "DSGAI04",
+      "DSGAI21",
+      "DSGAI03",
+      "DSGAI02",
+      "DSGAI09",
+      "DSGAI17"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}