Crosswalk
CSA AICM v1.1
Where the corpus maps to CSA AICM v1.1: AI Controls Matrix.
Canonical citation
- Standard ID
- CSA AICM
- Current version
- v1.1
- Publication date
- 2026
- Topic
- AI Controls Matrix
- Upstream check location
- https://
cloudsecurityalliance.org/ artifacts/ ai-controls-matrix (opens in a new tab) - Last verified (UTC)
- 2026-06-30
Coverage, 10 domains
Coverage by domain
From the GRC Library Compliance Alignment Matrix; the main crosswalk table's document counts land here.
Governance, 12 documents
- Records Retention and Destruction StandardMDS-03
- Emergency Authority StandardGRC-15, IAM-18
- Continuous Assurance and Improvement FrameworkGRC-14, GRC-12
- Governance Performance and Improvement FrameworkGRC-14, GRC-11
- Human Capital and Ethical Conduct FrameworkHRS-14
- Metrics, Monitoring and Performance Reporting FrameworkMDS-10, GRC-11, GRC-14
- Sustainability and Responsible Technology FrameworkGRC-10, GRC-11, GRC-12
- ESG and AI Ethics Disclosure GuidelineGRC-14
- Digital Twin and Simulation Governance PolicyGRC-10, GRC-13, GRC-15
- Data Retention ScheduleMDS-03, DSP-20
- Digital Trust and Assurance Metrics RegisterDSP-20, MDS-06, MDS-03
- AI Security Tooling Landscape RegisterMDS-06, TVM-13
Risk, 6 documents
- Enterprise Governance and Risk Management PolicyMDS-10, GRC-11, GRC-15
- Enterprise Risk Management StandardGRC-10, MDS-10
- Third-Party and Supply Chain Risk StandardMDS-04
- Key Risk Indicator CatalogueMDS-10, GRC-11, GRC-10
- Scenario Risk CatalogueMDS-11, AIS-11, DSP-21
- AI-Specific Risk Methodology AnnexGRC-10, GRC-15, DSP-21
Compliance, 1 document
Security, 2 documents
Operations, 2 documents
- Security Monitoring and Alert Management ProcedureGRC-13, MDS-10
- Observability and Telemetry StandardLOG-15, LOG-16
Supply chain, 3 documents
- Supplier Due Diligence ProcedureGRC-11, MDS-03
- Supplier Audit ProcedureGRC-11
- Third-Party AI Due Diligence ProcedureDSP-20, MDS-03, GRC-11
Privacy, 6 documents
- Privacy and Data Governance PolicyDSP-20
- Privacy Impact and Cross-Border Transfer ProcedureGRC-10
- Children's Data FrameworkGRC-10, GRC-15
- Pseudonymization and Anonymization StandardDSP-22
- Automated Decision-Making and Profiling RegisterGRC-11, GRC-13, GRC-15
- DPIA (Data Protection Impact Assessment) TemplateGRC-10, GRC-11
Architecture, 3 documents
- API Design StandardAIS-09, IAM-18
- Architecture Decision Records StandardMDS-03
- Data Architecture StandardDSP-20, DSP-24
Dev security, 2 documents
- AI Coding Assistant Security GuidelineAIS-12, AIS-15, HRS-15
- Secure Development and Engineering PolicyAIS-12
AI, 41 documents
- AI Governance Council CharterGRC-12, GRC-15, GRC-10
- AI Ethics Review Panel CharterGRC-12, GRC-11, GRC-15, GRC-13
- AI Algorithmic Compliance ChecklistGRC-10, GRC-11, GRC-13
- AI Governance and Risk FrameworkGRC-10, GRC-15, DSP-20
- AI Model Documentation and Transparency FrameworkMDS-03, MDS-04, GRC-13
- AI Model Risk FrameworkMDS-06, MDS-10, MDS-12, DSP-20
- AI System Audit and Certification FrameworkGRC-10, MDS-05
- AI Adversarial Test ReferenceMDS-06, AIS-09, AIS-15, TVM-13
- AI Security Technical Implementation GuideAIS-10, AIS-13, TVM-13
- Adversarial Evaluation Suite Development GuidelineMDS-06, AIS-09
- Ethical AI Use GuidelineGRC-09, GRC-11, GRC-13, GRC-15
- AI Incident Response PlanMDS-11, DSP-21, LOG-15, LOG-16
- AI Compliance PolicyGRC-09, GRC-10
- AI Audit ProcedureGRC-10, MDS-05
- AI Evaluation ProcedureMDS-05, GRC-14
- AI Model Lifecycle Management ProcedureMDS-03, MDS-10, MDS-11
- AI Model Risk Assessment ProcedureMDS-06, DSP-20, GRC-13
- AI System Impact Assessment ProcedureGRC-10, GRC-11, GRC-15
- Foundation Model Lifecycle ProcedureMDS-12, MDS-13, DSP-20
- Training Data Governance ProcedureDSP-20, DSP-21, DSP-24
- AI Risk RegisterGRC-10
- Model Context Protocol Server RegisterAIS-11, IAM-18
- Model RegistryMDS-03, MDS-09
- AI Access and Agent Permissions StandardIAM-16, IAM-18, AIS-11
- AI Model Risk StandardMDS-06, MDS-10, MDS-12, DSP-20
- AI Security and Risk StandardAIS-09, AIS-13, DSP-20, TVM-13
- AI Testing, Validation and Documentation StandardMDS-04, MDS-05, GRC-14
- AI Red Team Report TemplateMDS-06
- AI System Register TemplateGRC-10, MDS-03
- AI Vendor Security Questionnaire TemplateMDS-03, DSP-20
- Dataset Datasheet TemplateDSP-20, DSP-24
- Model Card TemplateMDS-03, MDS-04, GRC-13
- System Card TemplateMDS-03, GRC-13, GRC-15
- Agentic Response State Model FrameworkAIS-11, GRC-15
- AI Human-Oversight StandardGRC-15, HRS-14
- AI Maturity Model FrameworkGRC-11, GRC-14
- AI Board Oversight GuideHRS-14
- Integrated AI and Privacy Assessment ProcedureGRC-10
- AI Data Quality and Readiness Validation StandardDSP-23, DSP-24
- AI Model Succession and Identity Continuity StandardMDS-03, MDS-05, MDS-08, MDS-10
- AI Actor Role and Forum Standing CharterGRC-15
Corpus citations, 15
Documents naming it in their framework alignment
Generated from each document's framework alignment list in the taxonomy, through the committed alias map.
- AI Access and Agent Permissions StandardAI
- AI Actor Role and Forum Standing CharterAI
- AI and Agentic Development Security StandardAI
- AI Coding Assistant Security GuidelineDev security
- AI Model Succession and Identity Continuity StandardAI
- AI System Audit and Certification FrameworkAI
- AI Vendor Security Questionnaire TemplateAI
- Developer Security RequirementsDev security
- Emergency Authority StandardGovernance
- Enterprise Governance and Risk Management PolicyRisk
- Enterprise Risk Management StandardRisk
- Human Capital and Ethical Conduct FrameworkGovernance
- Privacy and Data Governance PolicyPrivacy
- Secure Development and Engineering PolicyDev security
- Sustainability and Responsible Technology FrameworkGovernance
Note
What this mapping is
From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion.
From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.
From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.
The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.