AITBM

TIER 1 · CONTROL VERIFICATION STANDARD

OWASP AISVS to AITBM Mapping

Shows how AISVS control-verification results can supply evidence for AITBM's 23 measured sub-metrics.

Ro-4Tr-4Pr-1Ro-1Cn-1Cn-3Cn-5Pr-2

How to use this crosswalk

External requirements, controls, threats, and practices identify evidence to collect or tests to run. Only measured evidence from the assessed deployment determines AITBM rubric placements, IVP, ORP, ACI, MVT findings, and ERS.

Mapping content last verified 2026-08-13. No endorsement by the external framework owner is implied.

OWASP AISVS

Control verification standard

OWASP AI Security Verification Standard (AISVS) · OWASP Foundation

AISVS 1.0 is a community-driven catalogue of 191 testable AI security requirements across 12 chapters and three verification levels. AITBM can consume verified implementation evidence from those requirements; compliance status alone does not assign an AITBM anchor, ERS, or deployment tier. The numeric effects below are dated scenario results, not values inherent to an AISVS chapter.

AISVS Chapter Primary AITBM Sub-Metrics Evidence Use / Notes
C1 Training Data Integrity & TraceabilityRo-4Tr-4Pr-1Integrity, lineage, leakage, and provenance evidence; measured results govern
C2 Input ValidationRo-1Cn-1Cn-3Injection, scope, and release-gate evidence; no chapter-level score
C5 Access Control & IdentityCn-5Cn-1Pr-2Identity, authorization, and inference-resistance evidence; effectiveness must be tested
C6 Supply Chain Security for Models, Frameworks & DataRo-4Tr-4Artifact-integrity, lineage, and ACI provenance evidence
C9 Orchestration & Agentic SecurityCn-1Cn-2Cn-5Cn-7Observed effectiveness only; no fixed chapter-level ERS reduction
C9.1/C9.3 Resource & Loop ControlsCn-7Direct evidence: C9.1.1/C9.1.2 budgets and C9.3.3/C9.3.4 declaration/runtime enforcement
C9.2 High-Impact Action Approval & Irreversibility ControlsCn-6Direct mapping: C9.2.3 classification, C9.2.4 enforcement by class, C9.2.10 worst-case chain rule
C10 Model Context Protocol (MCP) SecurityCn-5Ro-1Cn-2MCP identity, token-boundary, injection, and privilege evidence
C11 Adversarial RobustnessRo-1Ro-2Pr-2Pr-1Representative adversarial and privacy test evidence
C12 Monitoring, Logging & Anomaly DetectionTr-3Ro-2Cn-2Audit, anomaly, and eligible ACI freshness evidence
Privacy & personal data (distributed — C1.2.3, C8.2–C8.3, C11.2; no dedicated chapter)Pr-1Pr-2Pr-3Pr-4Distributed privacy-control evidence; AITBM privacy tests remain required

Key findings

  • AISVS gives strong coverage of 17/23 AITBM sub-metrics (74%), partial on 2 (Tr-1 explainability, Pr-3 data minimization), and defers the 4 Fairness sub-metrics (Fa-1–Fa-4) by design to ISO 42001 / ISO 23894 / NIST AI RMF.
  • AISVS C9.2 directly supports Cn-6. C9.1.1/C9.1.2 and C9.3.3/C9.3.4 directly support Cn-7, with C11.2.2 as supporting rate-limit evidence; observed test results, not compliance alone, set each score.
  • AISVS C5.1.2, C9.4, and C10.2 directly target controls relevant to Cn-5. C9 and C10 contain 57 requirements in total (34 + 23, or 29.8% of 191). This is strong scope alignment, not an AISVS endorsement or validation of AITBM's numeric weight.
  • The AISVS worked example is retained on its dated 21-sub-metric, pre-GDCP basis. A current assessment must derive Cn-6, Cn-7, Cp, ACI, and ERS under the current specification; compliance alone does not assign the displayed reduction.
  • AITBM uses AISVS levels as one input to its own pathway guidance (L1 to Tier III, L2 to Tier II, L3 to Tier I). C6 and C12 artifacts may support ACI provenance and freshness only when the evidence is applicable, complete, effective, and current.

OWASP AISVS reference →