genai-security-crosswalk 2.0.0

package/data/entries/ASI06.json

@@ -0,0 +1,817 @@
+{
+  "id": "ASI06",
+  "name": "Memory and Context Poisoning",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": 8.7,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0032",
+      "control_name": "Data Poisoning",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0032",
+      "notes": "Injecting malicious content into agent persistent memory or RAG stores"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0063",
+      "control_name": "Embedding Manipulation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0063",
+      "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0020",
+      "control_name": "Backdoor via Poisoned Memory",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0020",
+      "notes": "Establishing persistent trigger-response patterns in agent memory stores"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory treated as sensitive data asset — classification, access controls, retention policy"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory poisoning risk mapped per agent — memory stores, trust levels, access controls, TTL documented"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarial testing of memory integrity — poisoning scenarios, anomaly detection effectiveness"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Response for confirmed memory poisoning — audit procedure, content purge, operational impact assessment"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Data governance applies to all data influencing AI behaviour — including agent memory",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory governance — classification, access controls, integrity validation, retention — is an Art. 10 requirement"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Technical resilience against adversarial memory manipulation",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory integrity monitoring and access controls are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring for memory integrity",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory anomaly detection in post-market monitoring programme"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Access controls on all agent memory stores — only agent and designated administrators can write"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge base"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory store access and content monitored — anomalous write patterns, statistical integrity checks"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "DLP on memory write paths — credential patterns, sensitive content detected before memory write"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.2",
+      "control_name": "Data quality",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory content quality requirements — access controls, integrity verification, TTL as data quality controls"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.3",
+      "control_name": "Data provenance and characteristics",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory provenance tracked — source, write access controls, TTL, modification history in AIMS"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory store access controls and integrity monitoring as AIMS security design requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.8",
+      "control_name": "Monitoring of AI systems",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory integrity monitored in operation — anomalous write patterns, content integrity checks as AIMS monitoring"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "3.11 Encrypt sensitive data at rest",
+      "control_name": "CIS 3 — Data Protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.2 Collect audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory write operations logged — who or what wrote, when, content hash"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.1 Establish secure development standards",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory write validation as secure development requirement — untrusted sources cannot write directly"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "13.3 Deploy a network-based intrusion detection system",
+      "control_name": "CIS 13 — Network Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory store access monitored — bulk read, anomalous write patterns detected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.1.1",
+      "control_name": "Verify all user input validated against allowlist",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All content entering agent memory validated — injection patterns rejected at write boundary"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control enforces least privilege",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V6.1.1",
+      "control_name": "Verify sensitive data encrypted at rest",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V12.1.1",
+      "control_name": "Verify file upload malware scanning",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory content validated for integrity — unauthorised modifications detected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity (monitoring)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Continuous monitoring of agent memory for anomalous content patterns or unexpected modifications"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.1",
+      "control_name": "Timely response to events",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory poisoning indicators treated as security events — agent suspended, memory audited, human notified"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.1",
+      "control_name": "Software and information integrity (baseline)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory baseline established and maintained — deviations from baseline detectable"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Data confidentiality risks in OT",
+      "control_name": "§5.4",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "OT data exfiltration via compromised automation"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Assess outbound data paths from agent"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitor all outbound data from OT zone"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores protected at rest — access controls, encryption, integrity verification"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for anomalous data — memory content integrity checks, unusual write patterns detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.AM-08",
+      "control_name": "Asset Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores inventoried as data assets — content classification, access controls, TTL documented"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.AN-03",
+      "control_name": "Incident Analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory poisoning incidents analysed — affected sessions identified, operational decisions influenced reviewed"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Memory poisoning risk documented in risk assessment — scenarios for RAG, persistent memory, and context window corruption",
+      "control_name": "CC3.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Risk register with memory poisoning entries"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Agent memory stores monitored for unexpected modifications — baseline established, deviations trigger alerts",
+      "control_name": "CC7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory access log, anomaly alert configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Processing based on compromised memory is not authorised — memory integrity controls support PI1 evidence",
+      "control_name": "PI1.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Integrity verification configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Controls on memory store write access — only authorised processes may write to agent memory stores",
+      "control_name": "CC5.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory access policy, write access controls"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "PAN in agent memory protected — primary account numbers truncated or masked if stored in agent context or memory stores",
+      "control_name": "Req 3.4",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory store review, PAN protection evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent memory encryption — CHD in persistent memory stores encrypted using strong cryptography",
+      "control_name": "Req 3.5",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Encryption configuration, key management records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Model and memory changes managed — updates to agent memory stores treated as system changes requiring security review",
+      "control_name": "Req 6.5",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Change management records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Memory poisoning in penetration test scope — test whether adversarial content in memory affects agent behaviour",
+      "control_name": "Req 11.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Pen test report"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores classified and protected as sensitive AI data assets — integrity verification, access controls, immutable audit log"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "AI system integrity verification includes memory poisoning testing — adversarial inputs designed to corrupt persistent agent state"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores monitored for unexpected modifications — drift detection on persistent context"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Data Protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent memory stores access-controlled — only the owning agent process has write access"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Enumerate all outbound data paths from agent: tools, APIs, generated output"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Test whether agent can be instructed to exfiltrate via each outbound channel"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Alert on unexpected data volumes in tool calls or API responses"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Apply DLP controls to all agent-generated output before delivery"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All agent outputs pass through content inspection before leaving system boundary"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Acceptance of Extraneous Untrusted Data with Trusted Data",
+      "control_name": "CWE-349",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent memory store accepts writes from untrusted sources alongside trusted operational knowledge"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Insufficient Verification of Data Authenticity",
+      "control_name": "CWE-345",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Memory content not integrity-verified before storage or retrieval"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Input Validation",
+      "control_name": "CWE-20",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Content entering agent memory not validated before write"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Access Control",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store and memory databases with insufficient access controls permitting unauthorised writes"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Multiple Releases of Same Resource or Handle",
+      "control_name": "CWE-1341",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Memory TTL not enforced — entries persist beyond intended lifetime"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Memory write path injection",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Attempt to poison memory through every channel that can write to agent memory stores"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Poisoned memory influence detection",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify that behaviour influenced by poisoned memory differs detectably from baseline"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Memory content integrity",
+      "control_name": "DPT — Data Protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify memory store content integrity monitoring detects unauthorised modification"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy (full domain)",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B005",
+      "control_name": "Implement real-time input filtering",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Memory store credentials leaked — attacker writes poisoned content directly",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Scan all paths where memory store credentials could leak — logs, config, agent context"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Memory store credentials in cleartext — trivially extracted",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Secret manager for all memory store credentials — no cleartext anywhere"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived memory store credentials enable persistent access for attacker",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Short-lived credentials for memory store access — rotate on each agent session"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Protect agent memory stores, context databases, and shared state repositories from unauthorised read, write, and modification; enforce access controls per agent identity",
+      "control_name": "PS.1.1-PS – Protect all code from unauthorised access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents direct tampering with agent memory and context"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Maintain versioned, integrity-verified snapshots of agent memory and context stores; enable rollback to pre-poisoning states",
+      "control_name": "PS.3.1-PS – Archive and protect software releases",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ensures recovery capability for memory poisoning incidents"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Review agent behaviour for memory-influenced anomalies — verify that persistent memory and shared context do not introduce unintended behaviour changes across sessions",
+      "control_name": "PW.7.2-PS – Review the software for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Catches memory poisoning effects before they propagate"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "When memory poisoning is detected, conduct forensic analysis to identify the poisoned records, their ingestion source, propagation path, and blast radius across agents",
+      "control_name": "RV.3.1-PS – Analyse root causes",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enables thorough incident response for memory poisoning events"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-28",
+      "control_name": "Protection of Information at Rest — memory store protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Encrypt agent memory stores and context databases at rest; enforce access controls and integrity verification on all memory read and write operations"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-3",
+      "control_name": "Malicious Code Protection — adversarial memory detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Extend malicious content detection to agent memory stores; detect poisoned memories, manipulated context, and adversarial state modifications"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — memory operation audit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log all agent memory operations — reads, writes, deletions — with sufficient detail to detect poisoning and support forensic investigation"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "RA-5",
+      "control_name": "Vulnerability Scanning — memory infrastructure",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent memory stores, context databases, and shared state infrastructure in vulnerability scanning and security assessment"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — memory integrity controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls protecting agent memory stores from poisoning, tampering, and unauthorised modification; enforce access controls and integrity verification"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — memory manipulation detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deploy detection mechanisms for agent memory manipulation; monitor for anomalous writes, content inconsistencies, and cross-session poisoning patterns"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — memory store assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Register agent memory stores, context databases, and shared state systems in the ICT asset inventory; classify by data sensitivity"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — memory poisoning post-mortem",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct post-incident analysis for memory poisoning events; trace poisoned content to source and assess impact on agent decisions"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Weaviate (with RBAC)",
+      "type": "open-source",
+      "url": "https://weaviate.io"
+    },
+    {
+      "name": "LlamaIndex",
+      "type": "open-source",
+      "url": "https://www.llamaindex.ai"
+    },
+    {
+      "name": "Langfuse",
+      "type": "open-source",
+      "url": "https://langfuse.com"
+    },
+    {
+      "name": "Langfuse (audit logging)",
+      "type": "open-source",
+      "url": "https://langfuse.com"
+    },
+    {
+      "name": "Claroty",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "LLM Guard",
+      "type": "open-source",
+      "url": "https://github.com/protectai/llm-guard"
+    },
+    {
+      "name": "Azure AI Content Safety",
+      "type": "commercial",
+      "url": "https://azure.microsoft.com/en-us/products/ai-services/ai-content-safety"
+    },
+    {
+      "name": "Chroma",
+      "type": "open-source",
+      "url": "https://www.trychroma.com"
+    },
+    {
+      "name": "LAAF (LLM Agent Assessment Framework)",
+      "type": "open-source",
+      "url": "https://github.com/OWASP/LAAF"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "Great Expectations",
+      "type": "open-source",
+      "url": "https://greatexpectations.io"
+    },
+    {
+      "name": "Weaviate",
+      "type": "open-source",
+      "url": "https://weaviate.io"
+    },
+    {
+      "name": "LangSmith",
+      "type": "commercial",
+      "url": "https://smith.langchain.com"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "HashiCorp Vault",
+      "type": "commercial",
+      "url": "https://www.vaultproject.io"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "RAG corpus poisoning — embedding-space manipulation to force retrieval",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-016"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    },
+    {
+      "name": "Nassi et al. \"ComPromptMized\" Morris II multi-agent worm",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-023"
+    },
+    {
+      "name": "Crescendo: multi-turn escalation attack (Microsoft)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-029"
+    },
+    {
+      "name": "Adversarial embedding attacks on production RAG systems",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-046"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM04",
+      "LLM08",
+      "LLM02",
+      "LLM03"
+    ],
+    "dsgai_2026": [
+      "DSGAI04",
+      "DSGAI13",
+      "DSGAI06",
+      "DSGAI08"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}