genai-security-crosswalk 2.0.0

package/data/entries/LLM05.json

@@ -0,0 +1,761 @@
+{
+  "id": "LLM05",
+  "name": "Insecure Output Handling",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0037",
+      "control_name": "Output Manipulation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://atlas.mitre.org/techniques/AML.T0037",
+      "notes": "Crafting inputs that produce dangerous outputs consumed by downstream systems"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0040",
+      "control_name": "Unsafe Deserialisation via LLM",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://atlas.mitre.org/techniques/AML.T0040",
+      "notes": "LLM outputs containing serialised payloads executed by downstream components"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — output safety",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Output handling security included in AI evaluation and testing programme"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Output leakage and injection scenarios covered in evaluation"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Incident response for output handling failures defined and tested"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Organisational policy requires secure output handling for all LLM integrations"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Output handling risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Insecure output handling included in risk management system"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Accurate, robust outputs resilient to misuse",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output validation and sanitisation are Art. 15 technical requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Documented procedures covering output quality",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Post-market monitoring of output handling incidents required"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Output encoding, sanitisation, and schema validation as secure coding requirements"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.26",
+      "control_name": "Application security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Security requirements for all interfaces consuming LLM output — specified before development"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Output injection scenarios in security testing — XSS, SQL injection, command injection via LLM output"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Runtime monitoring for output handling incidents — injection attempts in LLM output channels"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output encoding and schema validation as AIMS security design requirements — LLM output treated as untrusted input to downstream systems"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.6",
+      "control_name": "Testing of AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output injection scenarios in AIMS testing — XSS, SQL injection, command injection via LLM output tested before deployment"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.9.1",
+      "control_name": "Use of AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Guidance on AI system use — downstream consumers informed that LLM output must be validated before use"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.8",
+      "control_name": "Operation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Operational controls for LLM deployment — output handling requirements documented as AIMS operational procedures"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.1 Establish secure development standards",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output encoding and sanitisation as secure development requirements"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.2 Collect audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log all LLM outputs — injection attempts in model responses detectable"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "18.1 Establish penetration testing",
+      "control_name": "CIS 18 — Penetration Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output injection scenarios in penetration testing — XSS, SQL injection via LLM output"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.1",
+      "control_name": "Verify output encoding of untrusted data in HTML context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM responses rendered in browser contexts encoded against XSS"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.3.5",
+      "control_name": "Verify output encoding in SQL query context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.5",
+      "control_name": "Verify output encoding in OS command context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated commands validated — never raw output in shell context"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.4",
+      "control_name": "Verify application does not use eval or dynamic code",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "No eval or dynamic code execution of LLM-generated content"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.2.2",
+      "control_name": "Verify anti-CSRF tokens in state-changing operations",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "CSRF protection on endpoints where LLM output triggers state changes"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM output validated before rendering or passing to OT systems"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.3",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output restricted to authorised actions — no raw output directly to control interfaces"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.1",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Communication integrity enforcement on all LLM-to-OT data paths"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Code injection and execution via data paths",
+      "control_name": "Section 5.3 — Threats",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output injection as a new instantiation of this threat at the IT/OT boundary"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Validated data flows across zone boundaries",
+      "control_name": "Section 7.2 — Network segmentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output validated at DMZ boundary before entering control zone display or data systems"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Information Input Validation",
+      "control_name": "SI-10",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM outputs validated before passing to OT systems — schema validation, allowlist enforcement"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Malicious Code Protection",
+      "control_name": "SI-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output scanning for malicious content before OT system ingestion"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Least Functionality",
+      "control_name": "CM-7",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT interfaces that consume LLM output configured to accept only defined, safe input formats"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-04",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure software development practices — output encoding and schema validation as platform security requirements"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-02",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data in transit protected — LLM output validated before passing to downstream systems"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Networks and assets monitored — output injection patterns detected in LLM output channels"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output injection documented as vulnerability class in risk assessment for all LLM integrations"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Policy requiring LLM output validation before use in downstream processing — complete and authorised processing",
+      "control_name": "PI1.1 — Processing integrity policies",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Input validation procedures for all systems consuming LLM output — encoding, schema validation, sanitisation",
+      "control_name": "CC5.2 — Select and develop control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Monitoring for injection patterns in LLM output channels — detect anomalous processing before downstream harm",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Output injection risks identified in LLM risk assessment — XSS, SQL injection, command injection via AI-generated content",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.2.4",
+      "control_name": "Bespoke and custom software",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output handling in LLM integrations addresses all injection vulnerability classes — LLM output treated as untrusted"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.4.1",
+      "control_name": "Public-facing web application protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All interfaces consuming LLM output in PCI scope protected — input validation on all downstream consumers"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "Penetration testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output injection scenarios in penetration testing — SQL injection, command injection via LLM output"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.6.1",
+      "control_name": "Audit log review",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring for injection patterns in LLM output channels within CDE"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Secure Development",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output encoding and schema validation as L1 secure development requirements — LLM output treated as untrusted"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI-specific output validation — schema enforcement, injection pattern detection before downstream consumption"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Runtime monitoring of LLM output channels — injection patterns in model responses detected"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Application Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DAST on all interfaces consuming LLM output as L1 application security practice"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output encoding and schema validation as explicit security requirements before development"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output validation implemented in code — LLM output treated as untrusted, reviewed in code review"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-RT",
+      "control_name": "Requirements-Driven Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output security requirements verified in testing — XSS, SQL injection via LLM output tested"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DAST on all interfaces consuming LLM output as penetration testing activity"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "T",
+      "control_name": "Output Tampering into Downstream Systems",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "E",
+      "control_name": "Privilege Escalation via Output Injection",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-79",
+      "control_name": "CWE-79",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/79.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-89",
+      "control_name": "CWE-89",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/89.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-78",
+      "control_name": "CWE-78",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/78.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Output injection into downstream systems",
+      "control_name": "OHT — Output Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify LLM-generated content is sanitised before insertion into HTML, SQL, shell commands, URLs, and other interpreters"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Crafted inputs designed to produce malicious outputs",
+      "control_name": "IHT — Input Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Craft inputs designed to coerce the LLM into generating content that will be interpreted as code or commands by downstream systems"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Downstream system access controls",
+      "control_name": "ACT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that downstream systems do not grant LLM outputs excessive permissions or execute LLM-generated commands without validation"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B005",
+      "control_name": "Implement real-time input filtering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B009",
+      "control_name": "Validate AI-generated content",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "C",
+      "control_name": "Safety domain (harm prevention)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Credentials appearing in model outputs passed to executors",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential detection in output pipeline before execution"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Downstream service credentials with excessive scope",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply least-privilege to all credentials used in downstream processing"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.4.1-PS",
+      "control_name": "Reuse existing well-secured software — third-party AI model and dataset vetting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vet all third-party model weights, datasets, plugins, and libraries before use; verify provenance, licence, and security posture"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.2.1-PS",
+      "control_name": "Verify software integrity — model and library supply chain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify integrity of all model artefacts and third-party components using cryptographic signatures and checksums before deployment"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — model registry",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain a secure, versioned model registry with provenance records for all components; enable auditability and rollback"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.1.1-PS",
+      "control_name": "Identify and confirm vulnerabilities — supply chain monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor for newly disclosed vulnerabilities in third-party AI components; establish a triage process for AI-specific CVEs"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-2",
+      "control_name": "Supply Chain Risk Management Plan — AI components",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include all AI components — models, datasets, adapters, libraries, plugins — in the supply chain risk management plan with provenance and risk assessment"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-3",
+      "control_name": "Supply Chain Controls — model provenance verification",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement integrity verification for all AI supply chain components using cryptographic signatures, checksums, and attestation before deployment"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-9",
+      "control_name": "External Information System Services — third-party AI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require third-party AI service providers to meet FedRAMP requirements; establish SLAs covering model security, data handling, and incident notification"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-3",
+      "control_name": "System Development Life Cycle — AI SDLC",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Integrate AI-specific security activities into the SDLC — model security review, adversarial testing, supply chain verification at each lifecycle phase"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — AI vendor oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI model providers, dataset vendors, and ML library maintainers in third-party ICT risk management; conduct due diligence, contractual oversight, and ongoing monitoring"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — AI supply chain assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Identify and classify all AI supply chain components — models, datasets, adapters, libraries, plugins — in the ICT asset inventory with provenance records"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — AI supply chain governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI supply chain risk in the ICT risk management framework; define policies for AI component sourcing, vetting, and lifecycle management"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — supply chain resilience",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI supply chain disruption scenarios in resilience testing; test fallback procedures for third-party AI service failures"
+    }
+  ],
+  "tools": [
+    {
+      "name": "OWASP ZAP",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "DOMPurify",
+      "type": "open-source",
+      "url": "https://github.com/cure53/DOMPurify"
+    },
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://semgrep.dev"
+    },
+    {
+      "name": "CycloneDX",
+      "type": "open-source",
+      "url": "https://cyclonedx.org"
+    },
+    {
+      "name": "ModelScan",
+      "type": "open-source",
+      "url": "https://github.com/protectai/modelscan"
+    },
+    {
+      "name": "OWASP Dependency-Check",
+      "type": "open-source",
+      "url": "https://owasp.org/www-project-dependency-check/"
+    },
+    {
+      "name": "Sigstore",
+      "type": "open-source",
+      "url": "https://www.sigstore.dev"
+    },
+    {
+      "name": "Vigil",
+      "url": "https://github.com/deadbits/vigil-llm",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "GitHub Copilot Workspace prompt injection via repository content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-025"
+    },
+    {
+      "name": "Azure OpenAI content filter bypass via structured output mode",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-037"
+    },
+    {
+      "name": "Hugging Face model card supply chain manipulation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-038"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI02",
+      "ASI05",
+      "ASI04",
+      "ASI10"
+    ],
+    "dsgai_2026": [
+      "DSGAI05",
+      "DSGAI12",
+      "DSGAI04",
+      "DSGAI19"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}