OWASP AIMA to AITBM Mapping

How to use this crosswalk

External requirements, controls, threats, and practices identify evidence to collect or tests to run. Only measured evidence from the assessed deployment determines AITBM rubric placements, IVP, ORP, ACI, MVT findings, and ERS.

Changed-framework carriers reconciled 2026-09-21; stable-framework currency basis carried forward from 2026-09-09. No endorsement by the external framework owner is implied.

AIMA

Maturity model

OWASP AI Maturity Assessment (AIMA) · OWASP Foundation

AIMA describes organizational AI-program maturity. It can identify evidence to collect, but it never converts a maturity level into an AITBM pathway, tier, IVP/ORP value, ACI component, CRM, ERS, severity, or confidence band.

AIMA evidence category	AITBM use	Boundary
Governance and accountability artifacts	Context only	May identify owners, policies, and provenance; assessed-deployment evidence remains required.
Data, model, and system documentation	Context only	Can identify provenance and evidence gaps; it does not establish an AITBM relationship unless one of the retained worksheet-cell routes is demonstrated.
Verification and monitoring practices	Potential evidence input	Requires system-specific measured results and AITBM admissibility checks.
Program maturity level	Context only	Never selects Full, Standard, or Lite and never supplies an ACI or ERS value.

Retained conditional routes

Only eleven audited worksheet cells have conditional routes: 3.1.2.L2.A and 3.1.2.L3.A to Tr-1; 3.3.1.L3.B to Ro-4; 3.4.1.L2.A, 3.4.1.L2.B, 3.4.1.L3.A, and 3.4.1.L3.B to Pr-3; 3.7.1.L2.B to ACI Ec; 3.7.2.L3.A to ACI T_calendar; 3.8.1.L2.A to ORP Rf; and 3.8.2.L3.A to ACI C_monitor. Each needs the corresponding deployment-specific rubric evidence.

AIMA reference →