genai-security-crosswalk 2.0.0

package/data/entries/ASI04.json

@@ -0,0 +1,759 @@
+{
+  "id": "ASI04",
+  "name": "Agentic Supply Chain",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": 8.4,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0056",
+      "control_name": "Adversarial Model Manipulation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0056",
+      "notes": "Tampering with model weights or tool components loaded by agent at runtime"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0048",
+      "control_name": "Model Contamination",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0048",
+      "notes": "Persistent malicious behaviour introduced through dynamically loaded agent components"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0010",
+      "control_name": "Backdoor ML Model",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0010",
+      "notes": "Trigger-based backdoors in MCP servers, prompt templates, or model adapters"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Supply chain governance policy — approved sources for agent tools, MCP servers, and model components"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-5.1",
+      "control_name": "Interdependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent supply chain components mapped — dynamic tool loading inventoried, approved before use"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Supply chain integrity testing — signature verification, descriptor review, backdoor scanning"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-3.2",
+      "control_name": "Residual risk",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Residual supply chain risk documented and treated — third-party component risks in AI risk register"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Supply chain risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent components in Art. 9 risk management — dynamic runtime components explicitly in scope"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Quality management includes supply chain controls",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented supply chain security procedures — component verification, change management"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Providers document obligations; deployers verify",
+      "control_name": "Art. 25 — Value chain responsibilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool and MCP server supply chain obligations distributed along value chain"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.19",
+      "control_name": "Supplier relationships",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements applied to all agent tool and MCP server providers — provenance, integrity, disclosure obligations"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.20",
+      "control_name": "Supplier agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Contractual security requirements for all agent component suppliers — integrity guarantees, vulnerability notification SLA"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.21",
+      "control_name": "Supply chain security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Managing ICT supply chain risks — agent tool and MCP server ecosystem explicitly in scope"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.8",
+      "control_name": "Management of technical vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent component CVEs in vulnerability management — ML libraries, inference runtime, MCP server dependencies"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.1",
+      "control_name": "Third-party AI system acquisition",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent tool and MCP server providers assessed — security obligations, integrity guarantees, disclosure SLA in contracts"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.2",
+      "control_name": "Customer relationships",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Obligations to downstream consumers of agentic systems — what supply chain security is guaranteed"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Component integrity verification as AIMS security design requirement — cryptographic signatures before loading"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.2",
+      "control_name": "Data quality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training data from third-party sources assessed — same data quality criteria as internal data"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "2.1 Establish and maintain software inventory",
+      "control_name": "CIS 2 — Inventory and Control of Software Assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "7.1 Establish vulnerability management process",
+      "control_name": "CIS 7 — Continuous Vulnerability Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent component CVEs in vulnerability management — urgent patching for code execution risks"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.6 Use only up-to-date and trusted third-party components",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approved component list — only sourced from approved vendors, signatures verified"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "15.1 Establish service provider management process",
+      "control_name": "CIS 15 — Service Provider Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool and MCP providers managed as service providers — security assessment before onboarding"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10.2.1",
+      "control_name": "Verify third-party components current and free of vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10.2.2",
+      "control_name": "Verify only minimal approved external libraries",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approved component list — unsigned or unverified agent components rejected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V14.2.2",
+      "control_name": "Verify build pipelines include security checks",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V1.1.2",
+      "control_name": "Verify threat model covers all data flows",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Supply chain threat model documents all agent component sources and trust levels"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.2",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Integrity verification of all agent tools and MCP components before OT deployment"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.6",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Only approved, verified agent components permitted in OT zones — no runtime loading of unapproved tools"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "Supplier security requirements",
+      "control_name": "62443-2-4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements applied to all agent tool and MCP server vendors with OT access"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.2",
+      "control_name": "Software and information integrity (change)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent component updates subject to OT change management — no automatic updates in production"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Lateral movement between control systems"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Assess inter-agent trust as OT risk"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Security controls",
+      "control_name": "§7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Authenticate all automated system-to-system communications"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cybersecurity supply chain risk management programme — all agent component vendors in scope"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-06",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cybersecurity requirements in supplier contracts — integrity guarantees, vulnerability disclosure SLA"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.AM-08",
+      "control_name": "Asset Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent components inventoried — ML SBOM for all tools, MCP servers, model weights, libraries"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-02",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Software managed to reduce risk — component integrity verification, change management"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Third-party agentic components assessed — agent frameworks, tool vendors, model providers subject to vendor risk management",
+      "control_name": "CC9.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vendor assessments, contractual security obligations"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Component changes managed through change management — model updates, framework upgrades, tool changes require security review",
+      "control_name": "CC8.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Change management records, security review sign-offs"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Agentic supply chain risk included in risk assessment — compromised component scenarios documented with treatment",
+      "control_name": "CC3.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk register with supply chain entries"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Integrity checks required before component deployment — cryptographic verification of model weights and tool descriptors",
+      "control_name": "CC5.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Integrity verification configuration, deployment logs"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agentic component vendors with CHD access managed as TPSPs — written agreements, annual confirmation of PCI compliance",
+      "control_name": "Req 12.8",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "TPSP list, written agreements, compliance confirmations"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agentic component CVEs in vulnerability management — ML libraries, agent frameworks, inference runtime dependencies scanned",
+      "control_name": "Req 6.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vulnerability scan results, patch records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Malicious software protection for agent components — integrity verification for model weights and plugin descriptors",
+      "control_name": "Req 5.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Integrity check configuration, verification records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Secure baseline configuration for agentic infrastructure — hardening standards applied to agent deployment platforms",
+      "control_name": "Req 2.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening baseline documentation"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "SCS",
+      "control_name": "Supply Chain Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agentic component vendors assessed — agent frameworks, tool registries, MCP servers, model providers all subject to SCS practices"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model weight and tool descriptor integrity verification — cryptographic signatures, hash-based baseline"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vendor risk management extended to AI component suppliers — contractual security obligations documented"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Supply Chain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agentic SBOM as software asset inventory — all components inventoried, CVEs monitored"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Explicitly model trust relationships between agents; default deny"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Mutual authentication between all agent-to-agent communication"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Policy governing what agents may instruct other agents to do"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Review and document all agent-to-agent trust grants"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Test whether a compromised sub-agent can escalate through the network"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Download of Code Without Integrity Check",
+      "control_name": "CWE-494",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool components and MCP servers loaded without signature verification"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Inclusion of Functionality from Untrusted Control Sphere",
+      "control_name": "CWE-829",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "MCP servers and plugins from external registries loaded into agent execution context"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Embedded Malicious Code",
+      "control_name": "CWE-506",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model weights and tool components containing hidden backdoor functionality"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Reliance on Insufficiently Trustworthy Component",
+      "control_name": "CWE-1357",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent dependency on third-party MCP servers without security assessment"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Unintended Proxy or Intermediary",
+      "control_name": "CWE-441",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Compromised tool acting as malicious intermediary in agent workflow"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Component integrity verification",
+      "control_name": "SCT — Supply Chain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify cryptographic signatures of all agent components; scan for hidden instructions in descriptors"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Behavioural change detection post-update",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish behavioural baseline before component update; verify no unexpected behaviour change after update"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Runtime component monitoring",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify that component modification at runtime is detected and triggers agent suspension"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party testing of adversarial robustness",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B003",
+      "control_name": "Manage public release of technical details",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B008",
+      "control_name": "Protect model deployment environment",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy (full domain)",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Compromised MCP server holds or can request excessive permissions",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validate all third-party NHIs at connection — revoke tokens from unverified sources"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Malicious components extract credentials from agent memory or config",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential isolation — components cannot access other components' credentials"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Supply chain compromise introduces credential exfiltration code",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Scan all agent components for credential access patterns before deployment"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Vet all third-party agent components — tools, plugins, MCP servers, model weights, orchestration libraries — for provenance, integrity, and security posture before use",
+      "control_name": "PW.4.1-PS – Reuse existing well-secured software",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents introduction of compromised components into agent pipelines"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Verify integrity of all agent artefacts and third-party components using cryptographic signatures and checksums before deployment",
+      "control_name": "PS.2.1-PS – Verify software integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Detects tampering in agent supply chain artefacts"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Maintain a secure, versioned registry of all agent components with provenance records; enable auditability and rollback",
+      "control_name": "PS.3.1-PS – Archive and protect software releases",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ensures traceability and recovery capability for supply chain incidents"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Monitor for newly disclosed vulnerabilities in third-party agent components; establish a triage process for AI-specific supply chain disclosures",
+      "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enables rapid response to supply chain compromises"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-2",
+      "control_name": "Supply Chain Risk Management Plan — agent components",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include all agent components — tools, plugins, MCP servers, model weights, and agent frameworks — in the supply chain risk management plan"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-3",
+      "control_name": "Supply Chain Controls — agent component provenance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify integrity and provenance of all agent supply chain components using cryptographic signatures, checksums, and attestation before deployment"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-9",
+      "control_name": "External Information System Services — third-party agent services",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require third-party agent tool and plugin providers to meet FedRAMP requirements; establish SLAs for security, availability, and incident notification"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-3",
+      "control_name": "System Development Life Cycle — agent SDLC",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Integrate agent-specific security activities into the SDLC — tool integration review, privilege analysis, and adversarial testing at each lifecycle phase"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — agent component vendor oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent tool vendors, plugin providers, MCP server maintainers, and model providers in third-party ICT risk oversight with due diligence and contractual controls"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — agent supply chain assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Identify and classify all agent supply chain components — tools, plugins, MCP servers, model weights, frameworks — in the ICT asset inventory with provenance"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — agent supply chain governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent supply chain risk in the ICT risk management framework; define policies for agent component sourcing, vetting, and lifecycle management"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — supply chain resilience",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent supply chain disruption in resilience testing; test fallback procedures for third-party tool and service failures"
+    }
+  ],
+  "tools": [
+    {
+      "name": "CycloneDX",
+      "type": "open-source",
+      "url": "https://cyclonedx.org"
+    },
+    {
+      "name": "ModelScan",
+      "type": "open-source",
+      "url": "https://github.com/protectai/modelscan"
+    },
+    {
+      "name": "OWASP Dependency-Check",
+      "type": "open-source",
+      "url": "https://owasp.org/www-project-dependency-check/"
+    },
+    {
+      "name": "MCP Inspector",
+      "type": "open-source",
+      "url": "https://github.com/modelcontextprotocol/inspector"
+    },
+    {
+      "name": "Syft",
+      "type": "open-source",
+      "url": "https://github.com/anchore/syft"
+    },
+    {
+      "name": "Snyk",
+      "type": "commercial",
+      "url": "https://snyk.io"
+    },
+    {
+      "name": "Sigstore",
+      "type": "open-source",
+      "url": "https://www.sigstore.dev"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Hugging Face model repository pickle-based malware supply chain",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-009"
+    },
+    {
+      "name": "Hugging Face model card supply chain manipulation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-038"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM03",
+      "LLM08",
+      "LLM05"
+    ],
+    "dsgai_2026": [
+      "DSGAI04",
+      "DSGAI06",
+      "DSGAI19"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}