genai-security-crosswalk 2.0.0

package/data/entries/ASI08.json

@@ -0,0 +1,788 @@
+{
+  "id": "ASI08",
+  "name": "Cascading Agent Failures",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": 9.1,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0029",
+      "control_name": "Denial of ML Service",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0029",
+      "notes": "Triggering cascading failure propagation to exhaust system resources or degrade service"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0034",
+      "control_name": "Cost Harvesting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0034",
+      "notes": "Crafting inputs that trigger runaway agent loops generating unbounded costs"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Exploit Public-Facing ML Application",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0057",
+      "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-4.1",
+      "control_name": "Risk tolerance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade blast radius defined and accepted per deployment — maximum affected systems documented"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade resilience testing — circuit breaker effectiveness, failover scenarios, chaos engineering"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident response for cascade events — defined suspension procedure, process control fallback"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-3.2",
+      "control_name": "Residual risk",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Residual cascade risk documented — BCP coverage for agent cluster failures"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cascade risks identified and mitigated — blast radius defined",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade scenarios in Art. 9 risk management — maximum affected systems, circuit breaker thresholds"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Human oversight over high-risk AI — ability to pause and stop",
+      "control_name": "Art. 14 — Human oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Circuit breakers and kill switches are Art. 14 human oversight mechanisms"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Technical resilience against cascading failures",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Circuit breakers, fail-safe defaults, and cascade containment architecture are Art. 15 requirements"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade indicators monitored — correlated failure patterns across agent cluster detected before physical impact"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.30",
+      "control_name": "ICT readiness for business continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent cluster failures covered in BCP — RTO/RPO defined, failover tested, circuit breakers as resilience controls"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.24",
+      "control_name": "Information security incident management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade events treated as security incidents — defined response, kill switch activation, operations notification"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.13",
+      "control_name": "Backup",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent state and configuration backed up — recovery to known-good state after cascade incident"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Circuit breakers and blast radius limits as AIMS security design requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.8",
+      "control_name": "Monitoring of AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade indicators monitored in operation — correlated failure patterns detected as AIMS monitoring"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.6.1",
+      "control_name": "Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade blast radius in AI risk register — maximum affected systems formally documented and accepted"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.9",
+      "control_name": "Performance evaluation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade incidents in AIMS performance evaluation — circuit breaker effectiveness, recovery times in management review"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "4.1 Establish secure configuration process",
+      "control_name": "CIS 4 — Secure Configuration",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "12.6 Use network-based URL filters",
+      "control_name": "CIS 12 — Network Infrastructure Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Network controls prevent cascade propagation across agent cluster boundaries"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "17.1 Designate personnel for incident response",
+      "control_name": "CIS 17 — Incident Response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Defined response for cascade events — kill switch activation, process control fallback, operations notification"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.6 Collect DNS query audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent traffic monitored — cascade indicators detected before physical impact"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.1",
+      "control_name": "Verify business logic assumptions documented",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.2",
+      "control_name": "Verify business logic limits prevent abuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Circuit breakers as business logic controls — cascade propagation limited by design"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V13.1.1",
+      "control_name": "Verify API rate limiting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.4.1",
+      "control_name": "Verify error handling does not expose sensitive data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade errors handled gracefully — no sensitive system information in error responses"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 7.6",
+      "control_name": "Denial of service protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Circuit breakers preventing cascade propagation — agent failure contained within defined blast radius"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 7.7",
+      "control_name": "Control system backup",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent system failures cannot affect backup and recovery of OT process control"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade indicators detected and responded to before physical process impact"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.1",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent-to-agent information flows restricted — cascade paths limited by design"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Safety system bypass is the highest severity OT threat"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Safety control inversion must be in OT risk register"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Secure architecture",
+      "control_name": "§7.1",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Mandatory: safety function must be independent of AI decision layer"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.IR-01",
+      "control_name": "Infrastructure Resilience",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Networks and environments protected for resilience — circuit breakers, blast radius limits, fail-safe defaults"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade indicators detected — correlated failure patterns across agent cluster monitored"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.MI-01",
+      "control_name": "Incident Mitigation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incidents contained — kill switch activated, process control fallback initiated"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RC.RP-01",
+      "control_name": "Incident Recovery",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Recovery plan includes agent cluster failures — BCP covers AI system availability, RTO/RPO defined"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Availability commitments defined for multi-agent system — RTO/RPO documented; cascade failure scenarios in availability risk",
+      "control_name": "A1.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Availability SLA, BCP documentation"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Capacity and performance monitoring — early warning of cascade failure precursors (latency, error rate, queue depth)",
+      "control_name": "A1.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring dashboards, alert configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Cascade failure incidents detected and responded to — incident response procedures for multi-agent failures",
+      "control_name": "CC7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "IR plan covering cascade scenarios, incident records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Cascade failure risk in risk assessment — blast radius analysis, dependency mapping documented",
+      "control_name": "CC3.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk register with cascade failure entries"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Critical agent control failures detected promptly — monitoring for cascade precursors with alert thresholds",
+      "control_name": "Req 10.7",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring configuration, alert records, detection evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Cascade failure risk analysis — targeted risk analysis documents cascade failure likelihood, impact, treatment",
+      "control_name": "Req 12.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk analysis documentation"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Network controls prevent cascade propagation — agent network segments isolated to contain blast radius",
+      "control_name": "Req 1.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Network diagram, segmentation evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Baseline availability configuration for agent infrastructure — capacity and resilience requirements in hardening baseline",
+      "control_name": "Req 2.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening baseline documentation"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Early warning detection of failure propagation across agent ecosystem — AI-specific anomaly detection for cascade signatures"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "IRS",
+      "control_name": "Incident Response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI incident response plan covers cascading agent failures — circuit breaker activation, agent isolation, service recovery procedures"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade failure risk documented in AI risk register — blast radius analysis, circuit breaker design, residual risk"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Business Continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Multi-agent deployment covered by BCM — recovery time and recovery point objectives defined per agent tier"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Safety controls must be layered — no single-point bypass path"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Independent review of every safety control bypass scenario"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Dedicated red team exercise targeting guardrail bypass"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "Alert immediately when output validator is disabled or bypassed"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Advanced",
+      "scope": "Both",
+      "notes": "No production agent deployment without signed safety control architecture review"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Uncontrolled Resource Consumption",
+      "control_name": "CWE-400",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent resource consumption not bounded — enables exhaustion propagation across cluster"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Check or Handling of Exceptional Conditions",
+      "control_name": "CWE-703",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent failures not caught and handled — exception propagates to downstream agents"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Handling of Exceptional Conditions",
+      "control_name": "CWE-755",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cascade fails because upstream agents do not handle failure conditions gracefully"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "OWASP ReDoS",
+      "control_name": "CWE-730",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Regex-based input processing causing runaway computation propagating through pipeline"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Uncontrolled Recursion",
+      "control_name": "CWE-674",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Recursive agent calls without depth limits enabling stack exhaustion cascade"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Circuit breaker trigger and recovery",
+      "control_name": "AVT — Availability",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inject failures to verify circuit breaker activates at threshold; test recovery path"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Blast radius containment",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify failure in one agent cluster does not propagate to adjacent clusters"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Cascade detection alert",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify monitoring raises alert on cascade indicators before physical impact"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "D",
+      "control_name": "Reliability (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI agent actions",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Cascading agent failure with over-privileged credentials exposes all accessible systems",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Least privilege per agent — cascade blast radius limited by credential scope"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Shared credentials mean cascade in one agent affects all agents sharing the credential",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Unique identity per agent — cascade cannot leverage shared credentials for lateral movement"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived credentials exposed during cascade remain valid for attacker use post-incident",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Short-lived credentials — cascade event triggers automatic revocation of all affected tokens"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Design circuit breakers, step limits, cost budgets, and human approval gates as explicit security requirements for all agentic automation workflows",
+      "control_name": "PW.2.1-PS – Design software to meet security requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ensures cascade prevention is a design-phase requirement"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Conduct adversarial testing of cascade failure paths — test error propagation, hallucination amplification, and runaway automation scenarios",
+      "control_name": "PW.8.2-PS – Test for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validates cascade prevention controls under attack conditions"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Define remediation procedures for cascade failure incidents including automatic circuit breaker activation, workflow suspension, cost cap enforcement, and rollback",
+      "control_name": "RV.2.1-PS – Assess, prioritise, and remediate vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enables rapid response to cascading automation failures"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Define explicit requirements for maximum automation depth, step limits, cost budgets, and mandatory human checkpoints for each agent workflow",
+      "control_name": "PW.1.1-PS – Define security requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establishes automation boundaries as mandatory requirements"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-7",
+      "control_name": "Boundary Protection — inter-agent boundaries",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce boundary protection between agents in multi-agent systems; prevent uncontrolled propagation of failures or attacks across agent boundaries"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — cascade detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor multi-agent systems for cascade indicators — error propagation, resource exhaustion spreading, and anomalous inter-agent communication patterns"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "IR-4",
+      "control_name": "Incident Handling — cascading failure response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define incident handling procedures for cascading agent failures; include automated circuit breakers, agent isolation, and multi-agent system shutdown procedures"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — automation risk",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include cascading automation risk in the organisational risk management strategy; define acceptable multi-agent coupling thresholds and circuit breaker requirements"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 11",
+      "control_name": "Response and Recovery — cascading failure response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define response and recovery procedures for cascading agent failures; include automated circuit breakers, agent isolation, and multi-agent system safe-state transitions"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — cascade indicator monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor multi-agent systems for cascade indicators — error propagation, resource exhaustion spreading, and anomalous inter-agent communication patterns"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 12",
+      "control_name": "Backup Policies — agent system continuity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain backup configurations, memory snapshots, and fallback agent deployments; enable restoration of agent systems to known-good state"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — cascading risk governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include cascading automation risk in ICT risk management; define acceptable multi-agent coupling thresholds and circuit breaker requirements"
+    }
+  ],
+  "tools": [
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "Resilience4j",
+      "type": "open-source",
+      "url": "https://resilience4j.readme.io"
+    },
+    {
+      "name": "LangSmith",
+      "type": "commercial",
+      "url": "https://smith.langchain.com"
+    },
+    {
+      "name": "Claroty",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "Prometheus",
+      "type": "open-source",
+      "url": "https://prometheus.io"
+    },
+    {
+      "name": "Netflix Hystrix",
+      "type": "open-source",
+      "url": "https://github.com/Netflix/Hystrix"
+    },
+    {
+      "name": "LiteLLM",
+      "type": "open-source",
+      "url": "https://github.com/BerriAI/litellm"
+    },
+    {
+      "name": "Kong Gateway",
+      "type": "open-source",
+      "url": "https://github.com/Kong/kong"
+    },
+    {
+      "name": "Istio",
+      "type": "open-source",
+      "url": "https://istio.io"
+    },
+    {
+      "name": "PagerDuty",
+      "type": "commercial",
+      "url": "https://www.pagerduty.com"
+    },
+    {
+      "name": "AgentOps",
+      "url": "https://github.com/AgentOps-AI/agentops",
+      "type": "open-source"
+    },
+    {
+      "name": "Agentic Security",
+      "url": "https://github.com/msoedov/agentic_security",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "AutoGPT and BabyAGI — uncontrolled web browsing and file system access",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-017"
+    },
+    {
+      "name": "Multi-agent prompt injection cascade — demonstrated cross-agent goal propagation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-020"
+    },
+    {
+      "name": "Nassi et al. \"ComPromptMized\" Morris II multi-agent worm",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-023"
+    },
+    {
+      "name": "Multi-agent financial trading system flash crash — cascading autonomous failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-041"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM10",
+      "LLM01",
+      "LLM04"
+    ],
+    "dsgai_2026": [
+      "DSGAI17",
+      "DSGAI05"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}