icdev 1.0.0__py3-none-any.whl

icdev/data/context/compliance/iso27001_nist_bridge.json

@@ -0,0 +1,382 @@
+{
+  "metadata": {
+    "title": "ISO/IEC 27001:2022 to NIST SP 800-53 Rev 5 Bidirectional Bridge",
+    "description": "Dual-hub crosswalk bridge enabling control mappings between ISO 27001 Annex A and NIST 800-53 Rev 5. ADR D111: International frameworks hub through ISO 27001, US frameworks hub through NIST 800-53, this bridge connects both.",
+    "version": "1.0",
+    "last_updated": "2026-02-18",
+    "sources": [
+      "NIST SP 800-53 Rev 5 to ISO 27001:2013 mapping (NIST published)",
+      "ISO 27002:2022 cross-reference annex",
+      "NIST Cybersecurity Framework to ISO 27001 crosswalk"
+    ],
+    "adr_reference": "D111"
+  },
+  "bridge_mappings": [
+    {
+      "iso_27001": "A.5.1",
+      "iso_title": "Policies for information security",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["AC-1", "AT-1", "AU-1", "CA-1", "CM-1", "CP-1", "IA-1", "IR-1", "MA-1", "MP-1", "PE-1", "PL-1", "PS-1", "RA-1", "SA-1", "SC-1", "SI-1"],
+      "mapping_type": "superset",
+      "notes": "ISO A.5.1 covers all NIST -1 (policy) controls across families"
+    },
+    {
+      "iso_27001": "A.5.2",
+      "iso_title": "Information security roles and responsibilities",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["PM-2", "PS-7"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.3",
+      "iso_title": "Segregation of duties",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["AC-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.4",
+      "iso_title": "Management responsibilities",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["PM-1", "PM-2"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.5",
+      "iso_title": "Contact with authorities",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["IR-6", "SI-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.6",
+      "iso_title": "Contact with special interest groups",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["PM-15", "SI-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.7",
+      "iso_title": "Threat intelligence",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["RA-3", "PM-16", "SI-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.8",
+      "iso_title": "Information security in project management",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["SA-3", "PL-7"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.9",
+      "iso_title": "Inventory of information and other associated assets",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["CM-8", "PM-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.10",
+      "iso_title": "Acceptable use of information and other associated assets",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["PL-4", "AC-20"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.23",
+      "iso_title": "Information security for use of cloud services",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["SA-9", "AC-20"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.24",
+      "iso_title": "Information security incident management planning and preparation",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["IR-1", "IR-8"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.25",
+      "iso_title": "Assessment and decision on information security events",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["IR-4", "IR-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.26",
+      "iso_title": "Response to information security incidents",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["IR-4", "IR-6"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.29",
+      "iso_title": "Information security during disruption",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["CP-2", "CP-4"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.30",
+      "iso_title": "ICT readiness for business continuity",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["CP-2", "CP-7", "CP-8"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.5.36",
+      "iso_title": "Compliance with policies, rules and standards for information security",
+      "iso_clause": "A.5",
+      "iso_clause_name": "Organizational controls",
+      "nist_800_53": ["CA-2", "CA-7"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.6.1",
+      "iso_title": "Screening",
+      "iso_clause": "A.6",
+      "iso_clause_name": "People controls",
+      "nist_800_53": ["PS-3"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.6.2",
+      "iso_title": "Terms and conditions of employment",
+      "iso_clause": "A.6",
+      "iso_clause_name": "People controls",
+      "nist_800_53": ["PS-6", "PL-4"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.6.3",
+      "iso_title": "Information security awareness, education and training",
+      "iso_clause": "A.6",
+      "iso_clause_name": "People controls",
+      "nist_800_53": ["AT-2", "AT-3"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.6.5",
+      "iso_title": "Responsibilities after termination or change of employment",
+      "iso_clause": "A.6",
+      "iso_clause_name": "People controls",
+      "nist_800_53": ["PS-4", "PS-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.7.1",
+      "iso_title": "Physical security perimeters",
+      "iso_clause": "A.7",
+      "iso_clause_name": "Physical controls",
+      "nist_800_53": ["PE-3"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.7.2",
+      "iso_title": "Physical entry",
+      "iso_clause": "A.7",
+      "iso_clause_name": "Physical controls",
+      "nist_800_53": ["PE-2", "PE-3"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.7.4",
+      "iso_title": "Physical security monitoring",
+      "iso_clause": "A.7",
+      "iso_clause_name": "Physical controls",
+      "nist_800_53": ["PE-6"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.7.7",
+      "iso_title": "Clear desk and clear screen",
+      "iso_clause": "A.7",
+      "iso_clause_name": "Physical controls",
+      "nist_800_53": ["AC-11", "MP-2"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.7.10",
+      "iso_title": "Storage media",
+      "iso_clause": "A.7",
+      "iso_clause_name": "Physical controls",
+      "nist_800_53": ["MP-2", "MP-4", "MP-6"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.1",
+      "iso_title": "User endpoint devices",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["AC-19", "CM-7"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.2",
+      "iso_title": "Privileged access rights",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["AC-6"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.3",
+      "iso_title": "Information access restriction",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["AC-3"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.5",
+      "iso_title": "Secure authentication",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["IA-2", "IA-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.7",
+      "iso_title": "Protection against malware",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SI-3"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.8",
+      "iso_title": "Management of technical vulnerabilities",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["RA-5", "SI-2"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.9",
+      "iso_title": "Configuration management",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["CM-2", "CM-6", "CM-7"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.15",
+      "iso_title": "Logging",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["AU-2", "AU-3", "AU-6"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.16",
+      "iso_title": "Monitoring activities",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["CA-7", "SI-4"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.20",
+      "iso_title": "Networks security",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SC-7"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.24",
+      "iso_title": "Use of cryptography",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SC-12", "SC-13"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.25",
+      "iso_title": "Secure development life cycle",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SA-3", "SA-15"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.26",
+      "iso_title": "Application security requirements",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SA-11", "SA-15"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.28",
+      "iso_title": "Secure coding",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SA-11", "SI-10"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.31",
+      "iso_title": "Separation of development, test and production environments",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["CM-4", "SA-11"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.32",
+      "iso_title": "Change management",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["CM-3", "CM-4", "CM-5"],
+      "mapping_type": "equivalent"
+    },
+    {
+      "iso_27001": "A.8.33",
+      "iso_title": "Test information",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["SA-11"],
+      "mapping_type": "partial"
+    },
+    {
+      "iso_27001": "A.8.34",
+      "iso_title": "Protection of information systems during audit testing",
+      "iso_clause": "A.8",
+      "iso_clause_name": "Technological controls",
+      "nist_800_53": ["CA-8", "AU-6"],
+      "mapping_type": "equivalent"
+    }
+  ],
+  "iso_clause_summary": {
+    "A.5": {"name": "Organizational controls", "control_count": 37, "nist_families": ["AC", "AT", "AU", "CA", "CM", "CP", "IA", "IR", "MA", "MP", "PE", "PL", "PM", "PS", "PT", "RA", "SA", "SC", "SI", "SR"]},
+    "A.6": {"name": "People controls", "control_count": 8, "nist_families": ["AT", "PS", "PL"]},
+    "A.7": {"name": "Physical controls", "control_count": 14, "nist_families": ["PE", "MP", "AC"]},
+    "A.8": {"name": "Technological controls", "control_count": 34, "nist_families": ["AC", "AU", "CA", "CM", "IA", "RA", "SA", "SC", "SI"]}
+  },
+  "coverage_statistics": {
+    "total_iso_controls": 93,
+    "mapped_iso_controls": 42,
+    "coverage_percentage": 45.2,
+    "total_nist_controls_referenced": 78,
+    "notes": "Partial mapping -- covers highest-priority controls. Full 93-control mapping planned for v2.0"
+  }
+}

icdev/data/context/compliance/iso42001_controls.json

@@ -0,0 +1,254 @@
+{
+  "metadata": {
+    "title": "ISO/IEC 42001:2023 — Artificial Intelligence Management System",
+    "source": "International Organization for Standardization, ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system, December 2023",
+    "classification": "CUI // SP-CTI",
+    "version": "1.0",
+    "last_updated": "2026-02-21",
+    "description": "ISO/IEC 42001:2023 AI Management System (AIMS) requirements catalog covering management system clauses (4-10) and Annex A controls. Bridged through ISO 27001 international hub (D111) and crosswalked to NIST 800-53 Rev 5 for multi-regime deduplication (D113)."
+  },
+  "clause_categories": [
+    {
+      "code": "5",
+      "name": "Leadership",
+      "requirement_count": 2,
+      "description": "Leadership commitment and AI policy establishment for the AI management system"
+    },
+    {
+      "code": "6",
+      "name": "Planning",
+      "requirement_count": 2,
+      "description": "Actions to address AI risks and opportunities, and planning of AI management system objectives"
+    },
+    {
+      "code": "7",
+      "name": "Support",
+      "requirement_count": 2,
+      "description": "Resources, competence, awareness, and communication for the AI management system"
+    },
+    {
+      "code": "8",
+      "name": "Operation",
+      "requirement_count": 2,
+      "description": "Operational planning, control, and AI system lifecycle processes"
+    },
+    {
+      "code": "9",
+      "name": "Performance Evaluation",
+      "requirement_count": 1,
+      "description": "Monitoring, measurement, analysis, and evaluation of the AI management system"
+    },
+    {
+      "code": "10",
+      "name": "Improvement",
+      "requirement_count": 1,
+      "description": "Continual improvement of the AI management system"
+    },
+    {
+      "code": "A",
+      "name": "Annex A Controls",
+      "requirement_count": 8,
+      "description": "Reference control objectives and controls specific to AI systems"
+    }
+  ],
+  "requirements": [
+    {
+      "id": "ISO42001-5.1",
+      "family": "Leadership",
+      "title": "Leadership and Commitment",
+      "description": "Top management shall demonstrate leadership and commitment with respect to the AI management system by establishing the AI policy, ensuring integration of AIMS requirements into business processes, ensuring resources are available, communicating the importance of effective AI management, directing and supporting persons to contribute to AIMS effectiveness, and promoting continual improvement.",
+      "evidence_required": "Documented AI policy endorsed by top management, management review meeting minutes, resource allocation evidence, AIMS integration into business processes.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "5.1",
+      "nist_800_53_crosswalk": ["PM-1", "PM-9"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-5.2",
+      "family": "Leadership",
+      "title": "AI Policy",
+      "description": "Top management shall establish an AI policy that is appropriate to the purpose of the organization, provides a framework for setting AI objectives, includes a commitment to satisfy applicable requirements, includes a commitment to responsible AI principles (fairness, transparency, accountability, safety), and is communicated within the organization and available to interested parties as appropriate.",
+      "evidence_required": "Documented AI policy covering responsible AI principles, evidence of policy communication, periodic policy review records.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "5.2",
+      "nist_800_53_crosswalk": ["PL-1", "PM-1", "PM-11"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-6.1",
+      "family": "Planning",
+      "title": "Actions to Address AI Risks and Opportunities",
+      "description": "The organization shall determine AI-specific risks and opportunities that need to be addressed to ensure the AIMS can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. Risk assessment shall consider AI-specific factors including bias, fairness, data quality, adversarial threats, model robustness, explainability limitations, and societal impact. Risk treatment plans shall be established and implemented.",
+      "evidence_required": "AI risk assessment documentation, risk treatment plans, risk register with AI-specific risk categories, opportunity assessment records.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "6.1",
+      "nist_800_53_crosswalk": ["RA-1", "RA-3", "PM-9"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-6.2",
+      "family": "Planning",
+      "title": "AI Objectives and Planning to Achieve Them",
+      "description": "The organization shall establish AI objectives at relevant functions, levels, and processes. AI objectives shall be consistent with the AI policy, measurable, take into account applicable requirements and risk assessment results, be monitored, communicated, and updated as appropriate. The organization shall determine what will be done, what resources will be required, who will be responsible, when it will be completed, and how results will be evaluated.",
+      "evidence_required": "Documented AI objectives with measurable targets, action plans with timelines and responsibilities, progress monitoring records, objective achievement evidence.",
+      "priority": "P2",
+      "iso_27001_crosswalk": "6.2",
+      "nist_800_53_crosswalk": ["PM-4", "PL-2"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-7.1",
+      "family": "Support",
+      "title": "Resources and Competence for AI",
+      "description": "The organization shall determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the AIMS. This includes AI-specific infrastructure (compute resources, model training environments, LLM providers), personnel with AI competencies, and tools for AI development, testing, and monitoring. The organization shall ensure that persons doing work under its control that affects AI system performance are competent on the basis of appropriate education, training, or experience.",
+      "evidence_required": "Resource allocation records for AI infrastructure, AI competency requirements, training records for AI personnel, AI tool and platform inventory.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "7.1",
+      "nist_800_53_crosswalk": ["PM-2", "AT-2", "AT-3"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-7.2",
+      "family": "Support",
+      "title": "AI Awareness and Communication",
+      "description": "The organization shall ensure that persons doing work under the organization's control are aware of the AI policy, their contribution to AIMS effectiveness, the implications of not conforming with AIMS requirements, and AI-specific ethical considerations. Internal and external communications relevant to the AIMS shall be determined and managed, including communication with affected stakeholders about AI system capabilities and limitations.",
+      "evidence_required": "AI awareness program documentation, communication plan for AIMS, stakeholder communication records, evidence of ethical AI training.",
+      "priority": "P2",
+      "iso_27001_crosswalk": "7.3",
+      "nist_800_53_crosswalk": ["AT-1", "AT-2", "PM-15"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-8.1",
+      "family": "Operation",
+      "title": "Operational Planning and Control",
+      "description": "The organization shall plan, implement, and control the processes needed to meet AIMS requirements and to implement AI risk treatment actions. Operational controls for AI systems shall address the AI system development lifecycle, data governance (collection, preparation, labeling, storage, disposal), model training, validation and verification, deployment procedures, and ongoing operation. AI security gates shall be configured and enforced throughout the lifecycle.",
+      "evidence_required": "AI development lifecycle documentation, data governance procedures, model training records, validation and verification evidence, deployment checklists, security gate configuration.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "8.1",
+      "nist_800_53_crosswalk": ["SA-3", "SA-8", "SA-11", "CM-3"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-8.4",
+      "family": "Operation",
+      "title": "AI System Impact Assessment",
+      "description": "The organization shall conduct an AI impact assessment for AI systems to identify and evaluate impacts on individuals, groups, communities, and society. The impact assessment shall consider potential harms from AI system outputs, fairness and non-discrimination impacts, privacy implications of data processing, environmental impact of AI training and operation, effects on human autonomy and decision-making, and impacts on labor and employment. Impact assessments shall be reviewed when significant changes occur.",
+      "evidence_required": "AI impact assessment reports, harm evaluation documentation, fairness assessment results, privacy impact analysis, environmental impact consideration, periodic review records.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "8.2",
+      "nist_800_53_crosswalk": ["RA-3", "RA-5", "RA-8"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-9.1",
+      "family": "Performance Evaluation",
+      "title": "Monitoring, Measurement, and Analysis of AI Systems",
+      "description": "The organization shall determine what needs to be monitored and measured for AI systems, the methods for monitoring, measurement, analysis, and evaluation, when monitoring and measuring shall be performed, and who shall analyze and evaluate the results. AI-specific monitoring shall include model performance metrics, bias and fairness metrics, system availability and reliability, data quality metrics, and AI-related security events including adversarial attack detection.",
+      "evidence_required": "AI monitoring framework documentation, performance metric definitions, monitoring dashboards or reports, bias tracking records, security event logs for AI systems.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "9.1",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4", "AU-6"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-10.1",
+      "family": "Improvement",
+      "title": "Continual Improvement of AI Management",
+      "description": "The organization shall continually improve the suitability, adequacy, and effectiveness of the AI management system. This includes incorporating lessons learned from AI incidents, updating risk assessments based on emerging AI threats and vulnerabilities, improving AI development processes based on performance data, and adopting new best practices for responsible AI. The organization shall leverage internal and external intelligence sources to identify improvement opportunities for AI capabilities and risk management.",
+      "evidence_required": "Improvement action records, lessons learned documentation from AI incidents, updated risk assessments, process improvement evidence, innovation tracking records.",
+      "priority": "P2",
+      "iso_27001_crosswalk": "10.1",
+      "nist_800_53_crosswalk": ["PM-4", "CA-5", "PM-16"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.2",
+      "family": "Annex A",
+      "title": "AI Impact Assessment",
+      "description": "The organization shall perform and document an impact assessment for AI systems covering potential effects on individuals, groups, communities, and the broader society. The assessment shall evaluate risks of harm from AI outputs, potential for discriminatory outcomes, privacy implications, transparency and explainability needs, and environmental considerations. Results of the impact assessment shall inform risk treatment decisions.",
+      "evidence_required": "AI impact assessment reports, discrimination risk analysis, privacy assessment, transparency evaluation, environmental impact documentation.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "A.5.7",
+      "nist_800_53_crosswalk": ["RA-3", "RA-5"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.3",
+      "family": "Annex A",
+      "title": "AI System Lifecycle Management",
+      "description": "The organization shall manage the AI system throughout its lifecycle from conception through retirement. Lifecycle stages shall include requirements definition, design, development, testing, deployment, operation, monitoring, and decommissioning. Each stage shall have defined processes, quality criteria, and approval gates. Model versioning, configuration management, and change control shall be implemented.",
+      "evidence_required": "AI lifecycle management framework, stage gate documentation, model version control records, change management logs, decommissioning procedures.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "A.5.8",
+      "nist_800_53_crosswalk": ["SA-3", "SA-8", "CM-3", "CM-9"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.4",
+      "family": "Annex A",
+      "title": "AI Data Quality and Governance",
+      "description": "The organization shall establish data quality and governance processes for AI systems covering data collection, labeling, preprocessing, storage, and disposal. Data provenance shall be documented. Training data shall be assessed for representativeness, bias, completeness, and accuracy. Data handling shall comply with applicable privacy and data protection requirements. Synthetic data usage shall be documented and validated.",
+      "evidence_required": "Data governance policy, data provenance documentation, training data quality assessment, bias analysis of data, privacy compliance evidence, synthetic data validation records.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "A.5.10",
+      "nist_800_53_crosswalk": ["SI-12", "SA-3", "PM-25"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.5",
+      "family": "Annex A",
+      "title": "AI Transparency and Explainability",
+      "description": "The organization shall provide appropriate transparency about AI systems to relevant stakeholders. Information provided shall include the purpose and intended use of the AI system, the type of AI technology used, the role of AI in decision-making, known limitations and failure modes, and how to contest AI-assisted decisions. Explainability methods appropriate to the AI system's risk level and stakeholder needs shall be implemented.",
+      "evidence_required": "AI transparency disclosures, system documentation for stakeholders, explainability method implementation, known limitations documentation, contestation mechanisms.",
+      "priority": "P2",
+      "iso_27001_crosswalk": "A.5.13",
+      "nist_800_53_crosswalk": ["PL-2", "AC-4", "AU-2"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.6",
+      "family": "Annex A",
+      "title": "AI Data Management and Classification",
+      "description": "The organization shall classify and manage data used by AI systems according to its sensitivity, confidentiality requirements, and applicable regulations. AI training data, model weights, inference inputs, and outputs shall be classified using the organization's data classification scheme. Data handling procedures shall be defined for each classification level. Cross-border data transfer requirements shall be addressed.",
+      "evidence_required": "Data classification scheme applied to AI data, data handling procedures per classification level, classification manager configuration, cross-border transfer documentation.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "A.5.12",
+      "nist_800_53_crosswalk": ["RA-2", "SC-16", "MP-4"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.7",
+      "family": "Annex A",
+      "title": "AI Security and Robustness",
+      "description": "The organization shall implement security controls specific to AI systems including protection against adversarial attacks (prompt injection, data poisoning, model extraction, membership inference), model integrity verification, secure model storage and distribution, access control for AI models and training data, and secure API interfaces. AI systems shall be tested for robustness against adversarial inputs.",
+      "evidence_required": "AI security controls documentation, adversarial testing results, model integrity verification records, access control configuration for AI assets, secure API configuration.",
+      "priority": "P1",
+      "iso_27001_crosswalk": "A.8.9",
+      "nist_800_53_crosswalk": ["SI-3", "SI-7", "SI-10", "SC-7"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.8",
+      "family": "Annex A",
+      "title": "AI Fairness and Bias Management",
+      "description": "The organization shall establish processes to identify, assess, and mitigate bias in AI systems throughout the lifecycle. Bias evaluation shall consider training data bias, algorithmic bias, and outcome bias across protected attributes. Fairness metrics appropriate to the application context shall be defined, monitored, and reported. Remediation actions shall be implemented when unacceptable bias is detected.",
+      "evidence_required": "Bias assessment methodology, fairness metric definitions, bias evaluation results, remediation action records, ongoing bias monitoring configuration.",
+      "priority": "P2",
+      "iso_27001_crosswalk": "A.5.9",
+      "nist_800_53_crosswalk": ["PM-25", "CA-2", "SI-4"],
+      "ai_specific": true
+    },
+    {
+      "id": "ISO42001-A.9",
+      "family": "Annex A",
+      "title": "AI Third-Party and Supply Chain Management",
+      "description": "The organization shall manage risks associated with third-party AI components, services, and data sources. Due diligence shall be performed on AI model providers, data suppliers, and cloud AI service providers. Contractual agreements shall address AI-specific requirements including data usage rights, model performance guarantees, liability for AI-related harms, and compliance obligations. Third-party AI components shall be inventoried and monitored.",
+      "evidence_required": "Third-party AI component inventory, vendor due diligence records, contractual agreements with AI provisions, supply chain risk assessment, ongoing monitoring evidence.",
+      "priority": "P2",
+      "iso_27001_crosswalk": "A.5.19",
+      "nist_800_53_crosswalk": ["SA-9", "SR-3", "SR-5", "PM-30"],
+      "ai_specific": true
+    }
+  ]
+}