Skip to main content
Coverbase ships a curated Control Set library: ready-to-use control set templates built from the industry frameworks, regulations, and questionnaires our customers assess vendors against. Each template is a starting point — fork it into your organization, tailor the controls, wording, and evaluation guidance, then apply it to vendors, services, or assessments. Templates are versioned and maintained by Coverbase, and administrators can promote additional private templates from an uploaded spreadsheet. The library currently includes 47 templates spanning 3,975 curated controls. This page documents each one in more depth than the in-app picker: its full description, the risk types and domains it addresses, typical use cases, its control count, and a link to the authoritative source it is derived from.
Control counts and wording are Coverbase’s structured interpretation of each source framework, intended to accelerate assessment — they are not a substitute for the official standard. Always consult the linked primary source for authoritative, legally binding text.

​
Cybersecurity & vendor security

Coverbase’s curated set of publicly verifiable security controls based on observable evidence available without vendor cooperation.Official source: Coverbase Content Library
  • Risk types: Information Security, Third-Party Risk
  • Risk domains: Vendor Due Diligence, Risk Governance
  • Typical use cases: Initial vendor screening; Lightweight due diligence; Passive vendor risk assessment; Pre-engagement risk triage
  • Coverage: 28 controls across 5 sections
Cloud Security Alliance Consensus Assessments Initiative Questionnaire v4 — designed to assess cloud service providers against CCM security controls.Official source: CSA Cloud Controls Matrix / CAIQ
  • Risk types: Information Security, Third-Party Risk
  • Risk domains: Cloud Security, Data Protection, Identity & Access Management
  • Typical use cases: Cloud provider due diligence; SaaS vendor security assessment; Cloud security maturity evaluation; CSA STAR certification readiness
  • Coverage: 261 controls across 17 sections
Higher Education Community Vendor Assessment Tool (HECVAT) Full v4 — a comprehensive questionnaire for assessing vendor security in higher education contexts.Official source: EDUCAUSE — HECVAT
  • Risk types: Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Vendor Due Diligence, Data Protection
  • Typical use cases: Higher education vendor assessments; University third-party risk management; EdTech platform security evaluation; FERPA-aligned vendor due diligence
  • Coverage: 227 controls across 18 sections
Higher Education Community Vendor Assessment Tool (HECVAT) Lite v4 — a streamlined questionnaire for lower-risk vendors in higher education environments.Official source: EDUCAUSE — HECVAT
  • Risk types: Third-Party Risk, Information Security
  • Risk domains: Vendor Due Diligence, Data Protection
  • Typical use cases: Lightweight higher education vendor review; Annual vendor reassessments; Low-risk EdTech evaluation; Tiered vendor risk program (education)
  • Coverage: 56 controls across 11 sections
ISO/IEC 27001:2022 Edition 3 — the international standard for information security management systems (ISMS), updated with new controls for cloud security, threat intelligence, and privacy.Official source: ISO/IEC 27001:2022
  • Risk types: Information Security, Regulatory Compliance
  • Risk domains: Risk Governance, Data Protection, Cloud Security
  • Typical use cases: ISO 27001 certification readiness; ISMS implementation assessment; International security compliance; Supply chain security evaluation
  • Coverage: 93 controls across 4 sections
MITRE ATT&CK framework controls mapped to adversary tactics, techniques, and procedures (TTPs) for evaluating threat detection and response capabilities.Official source: MITRE ATT&CK
  • Risk types: Information Security, Operational Risk
  • Risk domains: Threat Intelligence, Incident Response, Network Security
  • Typical use cases: Threat detection capability assessment; Red team readiness evaluation; SOC maturity measurement; Adversary simulation alignment
  • Coverage: 52 controls across 19 sections
The original NIST Cybersecurity Framework covering five core functions: Identify, Protect, Detect, Respond, and Recover. Widely adopted as the foundational cybersecurity standard.Official source: NIST Cybersecurity Framework 1.1
  • Risk types: Information Security, Operational Risk
  • Risk domains: Risk Governance, Network Security, Incident Response
  • Typical use cases: Cybersecurity program baseline; Legacy CSF alignment; Security maturity measurement; NIST CSF 1.1 compliance verification
  • Coverage: 108 controls across 23 sections
NIST Cybersecurity Framework 2.0 — updated in 2024 with a new Govern function, providing comprehensive guidance for managing cybersecurity risk across organizations of any size.Official source: NIST Cybersecurity Framework
  • Risk types: Information Security, Operational Risk
  • Risk domains: Risk Governance, Network Security, Incident Response
  • Typical use cases: Cybersecurity program governance; Board-level security reporting; Regulatory baseline alignment; Third-party risk governance
  • Coverage: 106 controls across 22 sections
The Shared Assessments SIG Core questionnaire — a comprehensive 800+ question vendor risk assessment covering 20 risk domains.Official source: Shared Assessments — SIG
  • Risk types: Information Security, Third-Party Risk, Operational Risk
  • Risk domains: Vendor Due Diligence, Cloud Security, Identity & Access Management
  • Typical use cases: Full third-party vendor due diligence; Enterprise vendor risk assessments; Outsourced service provider evaluations; Regulatory-aligned vendor management
  • Coverage: 755 controls across 33 sections
A streamlined version of the SIG Core questionnaire for lower-risk vendors, covering the most critical risk domains with fewer questions.Official source: Shared Assessments — SIG
  • Risk types: Third-Party Risk, Information Security
  • Risk domains: Vendor Due Diligence, Data Protection
  • Typical use cases: Lower-risk vendor assessments; Annual reassessments of established vendors; Faster onboarding due diligence; Tiered vendor risk programs
  • Coverage: 126 controls across 33 sections
Vendor Security Alliance (VSA) questionnaire 2025 — a comprehensive vendor security assessment covering cloud security, data management, and operational resilience.Official source: Vendor Security Alliance
  • Risk types: Third-Party Risk, Information Security, Operational Risk
  • Risk domains: Vendor Due Diligence, Cloud Security, Operational Continuity
  • Typical use cases: Vendor security program assessment; Cloud and SaaS vendor evaluation; VSA member organization compliance; Enterprise third-party risk management
  • Coverage: 106 controls across 7 sections

​
Compliance, privacy & payments

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) requirements for businesses handling California residents’ personal information.Official source: California OAG — CCPA
  • Risk types: Data Privacy, Regulatory Compliance
  • Risk domains: Privacy Rights, Data Protection
  • Typical use cases: California privacy law compliance; Consumer data rights assessment; Data service provider evaluation; US state privacy law alignment
  • Coverage: 23 controls across 17 sections
COBIT 5/2019 governance and management framework for enterprise IT, covering IT governance, risk management, and information systems controls.Official source: ISACA — COBIT
  • Risk types: Operational Risk, Regulatory Compliance, Financial Controls
  • Risk domains: Risk Governance, Operational Continuity
  • Typical use cases: IT governance program assessment; Enterprise risk management alignment; IT audit readiness; SOX IT controls evaluation
  • Coverage: 30 controls across 7 sections
The customer-side (user entity) controls a SOC 2 report assigns to the organizations that consume a service, organized to mirror the five Trust Services Criteria categories. Use it to track the shared-responsibility controls you must implement for a provider’s SOC 2 controls to operate effectively.Official source: AICPA SOC 2 (Trust Services Criteria)
  • Risk types: Third-Party Risk, Information Security, Regulatory Compliance
  • Risk domains: Vendor Due Diligence, Data Protection, Risk Governance
  • Typical use cases: SOC 2 shared-responsibility tracking; Vendor onboarding CUEC attestation; User-entity control self-assessment; Third-party SOC report review
  • Coverage: 30 controls across 5 sections
EU General Data Protection Regulation (GDPR) standard requirements covering lawful processing, data subject rights, controller obligations, and breach notification.Official source: EU GDPR (Regulation 2016/679)
  • Risk types: Data Privacy, Regulatory Compliance
  • Risk domains: Privacy Rights, Data Protection
  • Typical use cases: EU/EEA data privacy compliance; Data processor assessment; Privacy-by-design evaluation; GDPR vendor due diligence
  • Coverage: 18 controls across 13 sections
NIST SP 800-18 Revision 2 — guidance for developing and maintaining system security, privacy, and cybersecurity supply-chain risk management (C-SCRM) plans that document a system’s purpose, boundary, categorization, and selected controls across its life cycle.Official source: NIST SP 800-18 Rev 2
  • Risk types: Regulatory Compliance, Information Security, Operational Risk
  • Risk domains: Risk Governance, Data Protection, Supply Chain
  • Typical use cases: System security plan development; RMF authorization package preparation; Privacy and C-SCRM plan alignment; Federal system documentation review
  • Coverage: 39 controls across 11 sections
The PCI 3DS Core Security Standard defines physical and logical security requirements for environments that perform EMV 3-D Secure (3DS) functions — the 3DS Server, 3DS Directory Server, and 3DS Access Control Server. It comprises Part 1 baseline security requirements and Part 2 3DS-specific requirements, and applies to entities that store, process, or transmit 3DS data or that could impact the security of 3DS transactions.Official source: PCI SSC — 3DS
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: EMV 3-D Secure environment security; 3DS Server / DS / ACS assessment; 3DS data and key management; Authentication service compliance
  • Coverage: 37 controls across 12 sections
The prior major version of the Payment Card Industry Data Security Standard, retired in 2024 but retained for legacy audits and contracts that still reference v3.2.1. Use it for historical gap analysis and transition planning toward PCI DSS v4.0.Official source: PCI SSC Document Library (legacy)
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Legacy PCI DSS v3.2.1 assessment; Contract referencing v3.2.1; Historical compliance gap analysis; Transition planning to v4.0
  • Coverage: 89 controls across 12 sections
Payment Card Industry Data Security Standard v4.0 — the security standard for organizations that handle cardholder data, updated with new authentication and monitoring requirements.Official source: PCI SSC Document Library
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Payment processing compliance; Merchant security assessment; Card data environment evaluation; PCI QSA audit preparation
  • Coverage: 63 controls across 12 sections
For card-not-present merchants (e-commerce or mail/telephone-order) that have fully outsourced all cardholder data functions to PCI DSS validated third parties, with no electronic storage, processing, or transmission of cardholder data on the merchant’s systems.Official source: PCI SSC — SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Fully outsourced e-commerce merchant; Mail/telephone-order (MOTO) merchant; No electronic cardholder data storage; All payment functions handled by validated third parties
  • Coverage: 22 controls across 7 sections
For e-commerce merchants that partially outsource payment processing to a PCI DSS validated third party but whose own website can impact the security of the payment transaction, with no electronic storage of cardholder data on merchant systems.Official source: PCI SSC — SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Partially outsourced e-commerce merchant; Merchant website impacts payment transactions; Direct-post or JavaScript-based payment integration; No electronic cardholder data storage
  • Coverage: 90 controls across 12 sections
For merchants that process cardholder data only via imprint machines or standalone, dial-out payment terminals with no electronic cardholder data storage, and that do not transmit cardholder data over the internet.Official source: PCI SSC — SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Imprint-machine merchant; Standalone dial-out terminal merchant; No internet-connected payment processing; No electronic cardholder data storage
  • Coverage: 40 controls across 5 sections
For merchants with payment application systems connected to the internet (for example a POS system on a network with internet access) that do not electronically store cardholder data after a transaction is authorized.Official source: PCI SSC — SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Payment application connected to the internet; Internet-connected POS environment; No electronic cardholder data storage; Segmented merchant location network
  • Coverage: 80 controls across 11 sections
For all other merchants not addressed by SAQ types A through C, and for all service providers eligible to complete an SAQ. This SAQ covers substantially the full set of PCI DSS v4.0 requirements.Official source: PCI SSC — SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Merchant storing cardholder data electronically; Service provider eligible for SAQ; Full-scope PCI DSS environment; Complex payment processing environment
  • Coverage: 130 controls across 12 sections
Full defined-requirement-level coverage of PCI DSS v4.0 across all 12 requirements, with one control per numbered requirement for organizations that store, process, or transmit cardholder data. Intended for in-depth, QSA-grade assessment of the entire cardholder data environment.Official source: PCI SSC Document Library
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Full PCI DSS v4.0 audit preparation; Level 1 merchant/service provider assessment; QSA-led compliance evaluation; Cardholder data environment deep review
  • Coverage: 249 controls across 12 sections
The PCI PIN Security Requirements define controls for the secure management, processing, and transmission of personal identification number (PIN) data during online and offline payment transactions on ATMs and attended/unattended POS terminals. They apply to acquirers, processors, and any entity that manages PINs or the cryptographic keys used to protect them.Official source: PCI SSC — PIN Security
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: PIN encryption and key management; ATM and POS terminal security; Cryptographic key lifecycle governance; Acquirer and processor PIN compliance
  • Coverage: 33 controls across 7 sections
The PCI Point-to-Point Encryption (P2PE) Standard defines security requirements for solutions that encrypt account data at the point of interaction and decrypt it only within a secure environment, so that clear-text account data is never present in the merchant environment. It applies to P2PE solution providers, component providers, and merchants seeking to reduce PCI DSS scope through a validated P2PE solution.Official source: PCI SSC — P2PE
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: Point-to-point encryption solution validation; POI device and key-injection management; Merchant PCI DSS scope reduction; Decryption environment (HSM) security
  • Coverage: 38 controls across 6 sections
The PCI Software Security Framework comprises the Secure Software Standard and the Secure Software Lifecycle (Secure SLC) Standard, defining security requirements and assessment procedures for payment software and for the processes used to design, develop, and maintain it. It applies to software vendors and their payment software products, and serves as the successor to the legacy PA-DSS program.Official source: PCI SSC — Software Security Framework
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: Secure payment software validation; Secure software lifecycle governance; Software vulnerability and threat management; PA-DSS successor compliance
  • Coverage: 40 controls across 20 sections
SOC 2 Type II standard requirements covering the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.Official source: AICPA SOC 2 (Trust Services Criteria)
  • Risk types: Audit Readiness, Information Security, Regulatory Compliance
  • Risk domains: Data Protection, Operational Continuity, Risk Governance
  • Typical use cases: SOC 2 audit preparation; Customer security questionnaire responses; Service provider compliance verification; SaaS security due diligence
  • Coverage: 18 controls across 1 sections

​
Financial services & banking

Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) controls covering customer due diligence, suspicious activity reporting, and transaction monitoring.Official source: FinCEN — Bank Secrecy Act
  • Risk types: Regulatory Compliance, Financial Controls
  • Risk domains: Banking & Finance, Financial Reporting
  • Typical use cases: BSA/AML compliance program assessment; FinCEN regulatory alignment; Financial crime risk management; AML vendor evaluation
  • Coverage: 35 controls across 24 sections
EU Digital Operational Resilience Act (DORA) controls for financial entities, covering ICT risk management, incident reporting, third-party risk, and resilience testing.Official source: EU DORA (Regulation 2022/2554)
  • Risk types: Regulatory Compliance, Operational Risk, Third-Party Risk
  • Risk domains: Resilience, Banking & Finance, Supply Chain
  • Typical use cases: EU financial institution DORA compliance; ICT third-party risk assessment; Digital resilience program evaluation; Financial sector operational continuity
  • Coverage: 25 controls across 6 sections
Federal Financial Institutions Examination Council (FFIEC) guidance on managing third-party service provider relationships for financial institutions.Official source: FFIEC IT Handbook — Outsourcing
  • Risk types: Regulatory Compliance, Third-Party Risk, Financial Controls
  • Risk domains: Banking & Finance, Supply Chain, Risk Governance
  • Typical use cases: Financial institution third-party oversight; Bank vendor due diligence; FFIEC regulatory compliance; Financial services outsourcing review
  • Coverage: 30 controls across 13 sections
Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (16 CFR Part 313) requirements for financial institutions protecting customer financial information.Official source: 16 CFR Part 313 (eCFR)
  • Risk types: Regulatory Compliance, Data Privacy, Financial Controls
  • Risk domains: Banking & Finance, Data Protection
  • Typical use cases: GLBA compliance for financial services; Customer financial data protection; Financial institution privacy program; FTC Safeguards Rule alignment
  • Coverage: 20 controls across 3 sections
Detailed interagency guidance on third-party relationships for banking organizations, with comprehensive controls across the full vendor lifecycle.Official source: Interagency Guidance on Third-Party Relationships
  • Risk types: Regulatory Compliance, Third-Party Risk, Operational Risk
  • Risk domains: Banking & Finance, Supply Chain, Risk Governance
  • Typical use cases: Comprehensive bank vendor oversight; Critical third-party assessments; OCC/Fed/FDIC regulatory alignment; Senior management reporting on TPRM
  • Coverage: 156 controls across 12 sections
Interagency guidance on third-party relationships for banking organizations, covering risk management expectations for vendor lifecycle management.Official source: Interagency Guidance on Third-Party Relationships
  • Risk types: Regulatory Compliance, Third-Party Risk
  • Risk domains: Banking & Finance, Supply Chain
  • Typical use cases: Bank third-party risk program; Federal banking agency compliance; Vendor lifecycle risk management; Regulatory examination preparation
  • Coverage: 44 controls across 13 sections
National Credit Union Administration (NCUA) Information Security Examination (ISE) program covering cybersecurity maturity for credit unions.Official source: NCUA — Information Security Examination
  • Risk types: Regulatory Compliance, Information Security
  • Risk domains: Banking & Finance, Risk Governance
  • Typical use cases: Credit union security examination; NCUA regulatory compliance; Credit union cybersecurity maturity; NCUA examination preparation
  • Coverage: 30 controls across 17 sections
Sarbanes-Oxley Act (SOX) controls based on the COSO internal control framework, covering financial reporting accuracy and IT general controls for public companies.Official source: COSO — Internal Control Framework
  • Risk types: Financial Controls, Regulatory Compliance, Audit Readiness
  • Risk domains: Financial Reporting, Risk Governance
  • Typical use cases: SOX compliance program assessment; Public company internal controls review; IT general controls evaluation; External auditor readiness
  • Coverage: 56 controls across 12 sections

​
Healthcare & life sciences

Good Practice (GxP) controls for life sciences — covering GMP, GLP, and GCP requirements for pharmaceutical, biotech, and medical device companies.Official source: FDA — GxP Compliance
  • Risk types: Life Sciences, Regulatory Compliance, Operational Risk
  • Risk domains: Pharmaceutical, Data Protection
  • Typical use cases: Pharma/biotech supplier qualification; FDA/EMA compliance assessment; Clinical trial data integrity; GxP-regulated vendor due diligence
  • Coverage: 83 controls across 11 sections
Health Insurance Portability and Accountability Act (HIPAA) security and privacy rules covering administrative, physical, and technical safeguards for protected health information (PHI).Official source: HHS — HIPAA Security Rule
  • Risk types: Healthcare, Data Privacy, Regulatory Compliance
  • Risk domains: Healthcare Compliance, Data Protection
  • Typical use cases: HIPAA Business Associate assessment; Healthcare data security evaluation; PHI vendor due diligence; Healthcare compliance auditing
  • Coverage: 42 controls across 10 sections

​
AI governance

AIUC-1 — the AI Usage & Controls standard for AI agents, covering security, safety, reliability, data & privacy, accountability, and societal risk. Its 51 controls span six domains (A Data & Privacy, B Security, C Safety, D Reliability, E Accountability, F Society) and crosswalk to the EU AI Act, NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, and OWASP.Official source: AIUC-1
  • Risk types: AI Risk, Information Security, Third-Party Risk, Regulatory Compliance
  • Risk domains: AI Governance, Data Protection
  • Typical use cases: AI agent vendor due diligence; AI safety and security assessment; Generative AI supplier evaluation; AI governance readiness
  • Coverage: 51 controls across 6 sections
Cloud Security Alliance AI Controls Matrix (AICM) 2025 — a framework of security controls specifically designed for AI/ML systems and platforms.Official source: CSA AI Controls Matrix
  • Risk types: AI Risk, Information Security, Regulatory Compliance
  • Risk domains: AI Governance, Cloud Security, Data Protection
  • Typical use cases: AI/ML platform security assessment; Cloud AI vendor evaluation; AI security controls gap analysis; Emerging AI regulatory alignment
  • Coverage: 243 controls across 19 sections
EU AI Act (Regulation (EU) 2024/1689) — the European Union’s horizontal regulation for artificial intelligence. This template organizes the Act’s core obligations by theme: prohibited practices, risk classification, high-risk system requirements, provider and deployer duties, transparency, general-purpose AI models, and post-market governance.Official source: Regulation (EU) 2024/1689
  • Risk types: AI Risk, Regulatory Compliance, Data Privacy
  • Risk domains: AI Governance, Risk Governance
  • Typical use cases: EU AI Act readiness assessment; High-risk AI system conformity review; AI vendor regulatory due diligence; GPAI model obligation mapping
  • Coverage: 22 controls across 8 sections
ISO/IEC 42001:2023 — the international management-system standard for artificial intelligence (AIMS). This template covers the Annex A reference controls across nine control objectives, from AI policy and impact assessment to data governance and third-party relationships.Official source: ISO/IEC 42001:2023
  • Risk types: AI Risk, Regulatory Compliance, Audit Readiness
  • Risk domains: AI Governance, Risk Governance
  • Typical use cases: AI management system (AIMS) assessment; ISO/IEC 42001 readiness and gap analysis; AI vendor due diligence; Responsible AI program evaluation
  • Coverage: 38 controls across 9 sections
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) — a knowledge base of adversary tactics and techniques against AI/ML systems, modeled on MITRE ATT&CK. This template turns the ATLAS tactics into a defensive assessment of a vendor’s resilience to adversarial machine-learning attacks.Official source: MITRE ATLAS
  • Risk types: AI Risk, Information Security, Third-Party Risk
  • Risk domains: AI Governance, Threat Intelligence
  • Typical use cases: Adversarial ML threat assessment; AI/ML security vendor evaluation; AI red-team and threat-model scoping; AI supply-chain security review
  • Coverage: 14 controls across 1 section
NIST AI Risk Management Framework (AI RMF 1.0) — a voluntary framework for managing risks of AI systems across four core functions: Govern, Map, Measure, and Manage.Official source: NIST AI Risk Management Framework
  • Risk types: AI Risk, Operational Risk, Regulatory Compliance
  • Risk domains: AI Governance, Risk Governance
  • Typical use cases: AI system risk assessment; Responsible AI program evaluation; AI vendor due diligence; AI governance readiness
  • Coverage: 72 controls across 4 sections
NIST SP 800-53 controls adapted for AI systems, providing a comprehensive catalog of security and privacy controls for AI risk management in federal and enterprise contexts.Official source: NIST SP 800-53 Rev 5
  • Risk types: AI Risk, Information Security, Regulatory Compliance
  • Risk domains: AI Governance, Risk Governance, Data Protection
  • Typical use cases: Federal AI system compliance; AI risk control catalog alignment; Enterprise AI security program; FedRAMP-adjacent AI assessments
  • Coverage: 17 controls across 4 sections
OWASP Top 10 for Large Language Model Applications (2025) — the ten most critical security risks for LLM and generative-AI applications, from prompt injection and sensitive-information disclosure to excessive agency and unbounded consumption. Used to assess the security posture of AI/LLM vendors.Official source: OWASP Top 10 for LLM Apps
  • Risk types: AI Risk, Information Security, Third-Party Risk
  • Risk domains: AI Governance, Data Protection
  • Typical use cases: LLM application security assessment; Generative AI vendor security review; AI red-team scoping; Secure AI development gap analysis
  • Coverage: 10 controls across 1 section