{ "resource": { "title": "Operationalizing the NIST AI RMF for LLM Security Assessments", "version": "1.0", "publication_type": "Implementation Model", "maintainer": "Penaxtra Security Research", "parent_company": "Seccops Cyber Security Technologies Inc.", "framework": "NIST AI Risk Management Framework", "resource_url": "https://penaxtra.com/research/operationalizing-ai-rmf-for-llm-security", "publication_date": "2026-07-14", "last_updated": "2026-07-14", "usage_statement": "Free to use without registration or payment. Redistribution permitted with attribution to Penaxtra Security Research and preservation of the version identifier.", "disclaimer": "This resource is an independent community-developed implementation model maintained by Penaxtra Security Research. Penaxtra is developed and operated by Seccops Cyber Security Technologies Inc. Penaxtra is not affiliated with or endorsed by the National Institute of Standards and Technology. References to NIST and the NIST AI Risk Management Framework are provided for implementation and research purposes. This implementation model does not represent an official NIST profile or a NIST-validated use case, and it does not modify the AI RMF.", "abstract": "This resource converts the NIST AI Risk Management Framework into a repeatable security assessment process for LLM systems. It defines an implementation model, the LLM Security Assessment Operating Model, that moves from system context to assessment evidence, security measurements, and risk treatment decisions using the AI RMF GOVERN, MAP, MEASURE, and MANAGE functions. The model treats an LLM feature as a set of components: model endpoints, prompt and model gateways, RAG pipelines and vector stores, MCP servers and tools, agent runtimes, external providers, service identities, and the downstream systems reached through tools. It includes a governance decision model, a component and trust boundary mapping method with a relationship model for documenting attack paths, twelve evidence classes, a catalog of measurements across inventory, exposure, control, runtime, and change classes, six risk treatment decisions, an event-driven reassessment model, and a worked example of an indirect prompt injection reaching a repository write through a RAG-to-agent path. It is a community resource, not an official NIST profile or a NIST-validated use case.", "keywords": [ "NIST AI RMF", "AI risk management", "LLM security assessment", "AI agent security", "MCP security", "RAG security", "assessment evidence", "AI system mapping", "LLM risk measurement", "security assessment" ], "citation": "Penaxtra Security Research. \"Operationalizing the NIST AI RMF for LLM Security Assessments.\" Version 1.0. Penaxtra. https://penaxtra.com/research/operationalizing-ai-rmf-for-llm-security" }, "assessment_model": { "name": "LLM Security Assessment Operating Model", "stages": [ { "n": 1, "name": "System context", "rmf": "MAP", "detail": "Record the systems in scope and the reason each is being assessed. An LLM feature is treated as a set of related components rather than a single object." }, { "n": 2, "name": "Governance and decision authority", "rmf": "GOVERN", "detail": "Record the owners, the assessment requirement, the risk acceptance authority, and the approvals that already apply to the system: model providers, MCP servers, and agent capabilities." }, { "n": 3, "name": "Component and trust boundary mapping", "rmf": "MAP", "detail": "Enumerate the components, the trust boundaries between them, the effective identities that operations run as, and the paths that connect untrusted input to a consequential operation." }, { "n": 4, "name": "Assessment evidence collection", "rmf": "MAP, MEASURE", "detail": "Collect the records that establish the state of each component: inventory, configuration, identity, network, data flow, dependency, and logging evidence." }, { "n": 5, "name": "Security measurement", "rmf": "MEASURE", "detail": "Apply the inventory, exposure, control, runtime, and change measurements to the mapped components and record results with their interpretation boundaries." }, { "n": 6, "name": "Risk analysis", "rmf": "MEASURE, MANAGE", "detail": "Combine measurement results with system context and impact to determine which conditions represent findings that require a decision." }, { "n": 7, "name": "Treatment decision", "rmf": "MANAGE", "detail": "For each finding, an accountable authority selects a treatment: accept, restrict, isolate, remove, monitor, or reassess, with the rationale recorded." }, { "n": 8, "name": "Change monitoring", "rmf": "MANAGE", "detail": "Watch for the component, identity, capability, and configuration changes that invalidate prior evidence and would change a prior decision." }, { "n": 9, "name": "Reassessment", "rmf": "MANAGE, MAP", "detail": "When a change trigger fires or evidence becomes stale, run the appropriate reassessment scope: full, targeted, evidence refresh, or decision review." } ] }, "governance_model": { "record_fields": [ { "field": "system_id", "description": "Stable identifier for the assessed system." }, { "field": "system_owner", "description": "Accountable owner of the AI use case and its outcomes." }, { "field": "technical_owner", "description": "Team or individual responsible for the system's implementation and configuration." }, { "field": "security_assessment_owner", "description": "Party responsible for performing and maintaining the security assessment." }, { "field": "risk_acceptance_authority", "description": "Role authorized to accept residual risk for this system." }, { "field": "approved_use_case", "description": "The use the system is approved to perform." }, { "field": "deployment_environment", "description": "Where the system runs: environment and hosting model." }, { "field": "data_classification", "description": "Highest classification of data the system processes." }, { "field": "approved_model_providers", "description": "External and internal model services approved for this system." }, { "field": "approved_mcp_servers", "description": "MCP servers approved for connection." }, { "field": "approved_agent_capabilities", "description": "Agent tools and operations approved for use." }, { "field": "assessment_frequency", "description": "Baseline cadence for reassessment independent of change triggers." }, { "field": "last_assessment_date", "description": "Date the most recent assessment completed." }, { "field": "next_review_date", "description": "Scheduled date of the next baseline review." }, { "field": "evidence_owner", "description": "Party responsible for the assessment evidence and its retention." }, { "field": "exception_reference", "description": "Identifier of any accepted exception that applies." } ], "operational_questions": [ "Who identifies the system boundary for assessment.", "Who owns the AI application and its approved use.", "Who owns the service identity that tools and agents run as.", "Who can approve a new external model provider for the system.", "Who can approve a new MCP server connection.", "Who can accept the risk of a high-impact tool capability.", "Who is notified when an agent gains a new operation.", "Who decides whether a change requires reassessment, and at what scope." ] }, "component_types": [ { "id": "llm_application", "description": "An application that constructs prompts and consumes model output." }, { "id": "hosted_model_api", "description": "A model served by an external provider over an API." }, { "id": "self_hosted_model", "description": "A model the organization runs on its own infrastructure." }, { "id": "model_endpoint", "description": "A network interface through which prompts are sent and responses returned." }, { "id": "model_gateway", "description": "A component that fronts one or more model endpoints." }, { "id": "prompt_gateway", "description": "A component that applies policy to prompts and responses in the request path." }, { "id": "rag_pipeline", "description": "The indexing and retrieval path that supplies retrieved context to a model." }, { "id": "vector_store", "description": "A store of embedded content and chunk metadata used for retrieval." }, { "id": "rag_data_source", "description": "A source whose content is indexed for retrieval." }, { "id": "mcp_client", "description": "A client that connects an application or agent to MCP servers." }, { "id": "mcp_server", "description": "A server that exposes tools, resources, and prompts over the Model Context Protocol." }, { "id": "mcp_tool", "description": "A tool exposed by an MCP server that performs an operation." }, { "id": "agent_runtime", "description": "The runtime that plans and invokes tools on behalf of an agent." }, { "id": "agent_tool", "description": "A tool available to an agent." }, { "id": "external_model_provider", "description": "A supplier that processes prompts and returns model output." }, { "id": "service_identity", "description": "The identity a component, tool, or agent authenticates as." }, { "id": "downstream_service", "description": "A system reached through a tool or an agent operation." }, { "id": "logging_source", "description": "A source of runtime records for a component." } ], "relationship_types": [ { "id": "USES_MODEL", "description": "An application uses a model." }, { "id": "CALLS_ENDPOINT", "description": "A component calls a model endpoint." }, { "id": "SENDS_PROMPT_TO", "description": "A component sends prompt content to a model or gateway." }, { "id": "RECEIVES_RESPONSE_FROM", "description": "A component receives model output." }, { "id": "RETRIEVES_FROM", "description": "A retrieval step reads content from a store or service." }, { "id": "INDEXES_FROM", "description": "An indexing pipeline reads content from a source." }, { "id": "CONNECTS_TO_MCP", "description": "A client or agent connects to an MCP server." }, { "id": "EXPOSES_TOOL", "description": "An MCP server exposes a tool." }, { "id": "INVOKES_TOOL", "description": "An application or agent invokes a tool." }, { "id": "EXECUTES_AS", "description": "An operation runs under a service identity." }, { "id": "CALLS_SERVICE", "description": "A tool or agent calls a downstream service." }, { "id": "READS_FROM", "description": "An operation reads from a downstream system." }, { "id": "WRITES_TO", "description": "An operation writes to a downstream system." }, { "id": "ADMINISTERS", "description": "An operation performs an administrative action on a system." }, { "id": "LOGS_TO", "description": "A component sends records to a logging source." }, { "id": "DEPENDS_ON", "description": "A component depends on another component or supplier to function." } ], "relationship_example": [ { "source": "RAG indexing pipeline", "relationship": "INDEXES_FROM", "target": "Untrusted document" }, { "source": "LLM application", "relationship": "RETRIEVES_FROM", "target": "Retrieval service" }, { "source": "LLM application", "relationship": "SENDS_PROMPT_TO", "target": "Model endpoint" }, { "source": "LLM application", "relationship": "RECEIVES_RESPONSE_FROM", "target": "Model endpoint" }, { "source": "Agent runtime", "relationship": "CONNECTS_TO_MCP", "target": "MCP server" }, { "source": "MCP server", "relationship": "EXPOSES_TOOL", "target": "Repository tool" }, { "source": "Agent runtime", "relationship": "INVOKES_TOOL", "target": "Repository tool" }, { "source": "Repository tool", "relationship": "EXECUTES_AS", "target": "Service account" }, { "source": "Repository tool", "relationship": "WRITES_TO", "target": "Source control system" } ], "evidence_classes": [ { "id": "inventory", "name": "Inventory Evidence", "purpose": "Establish which AI applications, endpoints, providers, RAG sources, MCP servers, tools, and agents exist and who owns them.", "examples": [ "AI application inventory", "Model endpoint inventory", "External provider records", "MCP server and tool inventory", "Agent and tool inventory" ], "limitation": "An inventory is a reconciliation of several discovery sources. A single source is incomplete, and an entry without an owner cannot be assessed or remediated." }, { "id": "architecture", "name": "Architecture Evidence", "purpose": "Establish how components connect, where trust boundaries sit, and which paths carry untrusted input to consequential operations.", "examples": [ "Component and data flow diagrams", "Trust boundary records", "Attack path records", "Prompt and context boundary description" ], "limitation": "A design diagram records the intended architecture. It should be reconciled against the deployed configuration, which can differ." }, { "id": "configuration", "name": "Configuration Evidence", "purpose": "Establish the settings that determine a component's security boundary independent of its code.", "examples": [ "Model gateway configuration", "Prompt gateway policy", "RAG indexing configuration", "Agent policy configuration" ], "limitation": "Configuration changes without a code change. Evidence reflects the state at collection time and can be stale by the next review." }, { "id": "identity", "name": "Identity Evidence", "purpose": "Establish the identities that components, tools, and agents authenticate as, so effective permission can be reviewed.", "examples": [ "Service principals", "Cloud roles", "API identities", "MCP service identities", "Agent execution identities", "Downstream access policies" ], "limitation": "A documented service identity does not establish effective permission. Downstream role assignment and operation scope must also be reviewed." }, { "id": "network", "name": "Network Evidence", "purpose": "Establish where endpoints and services are reachable from and where organizational data flows.", "examples": [ "Endpoint reachability records", "Network data flow records", "External destination records" ], "limitation": "Reachability observed from one vantage point does not describe reachability from every network position an attacker may hold." }, { "id": "data_flow", "name": "Data Flow Evidence", "purpose": "Establish the data that enters prompts, returns in responses, and moves through retrieval and external transfer.", "examples": [ "Prompt data flow records", "Response data flow records", "Retrieval flow records", "Data classification per destination" ], "limitation": "A data flow record captures known paths. Content that reaches a model through a new integration is outside a record that predates it." }, { "id": "dependency", "name": "Dependency Evidence", "purpose": "Establish the suppliers and components an AI system depends on to function.", "examples": [ "Model provider records", "Model artifact provenance", "SDK and agent framework versions", "MCP server implementation records" ], "limitation": "A dependency list records declared dependencies. Active runtime use of a dependency is a separate question from its presence in a manifest." }, { "id": "test", "name": "Test Evidence", "purpose": "Establish how a control behaved under a defined assessment method.", "examples": [ "Prompt injection test results", "Retrieval authorization test results", "System prompt disclosure test results", "Tool restriction test results" ], "limitation": "A test result describes behavior under the methods used. It does not establish that untested inputs or paths behave the same way." }, { "id": "runtime", "name": "Runtime Evidence", "purpose": "Establish what was observed during operation over a defined period.", "examples": [ "Prompt and response security events", "Tool invocation records", "Agent action records", "Policy decision records" ], "limitation": "Observed activity is evidence of behavior during the observation period. It is not proof that unobserved execution paths do not exist." }, { "id": "logging", "name": "Logging Evidence", "purpose": "Establish which records are generated and available for review, and whether they are sufficient to reconstruct an operation.", "examples": [ "Application log records", "Model gateway logs", "Agent execution logs", "Audit records" ], "limitation": "A log that records only the model endpoint is insufficient for execution review. Completeness is assessed against the fields an investigation needs." }, { "id": "change", "name": "Change Evidence", "purpose": "Establish the component, identity, capability, and configuration changes that affect a prior assessment.", "examples": [ "Configuration change records", "Capability change records", "Dependency version changes", "Baseline records" ], "limitation": "Change evidence is only as good as the change sources it monitors. A change made outside a monitored path is invisible until the next full review." }, { "id": "decision", "name": "Decision Evidence", "purpose": "Establish which findings were reviewed, what was decided, by whom, and under what conditions.", "examples": [ "Risk decision records", "Treatment action records", "Exception records", "Reassessment trigger records" ], "limitation": "A decision record captures the decision at a point in time. A decision made on stale evidence carries the staleness of that evidence." } ], "measurements": [ { "measurement_id": "INV-001", "measurement_class": "Inventory", "title": "AI application inventory coverage", "security_question": "Which LLM and generative AI applications are known and attributed to an owner.", "evidence_source": "AI application inventory reconciled against source dependencies, gateway configuration, and outbound provider destinations.", "measurement_method": "Reconcile discovery sources and compare against the approved inventory.", "result_type": "Count", "interpretation": "A gap between discovered and inventoried applications identifies systems that are running without a security record. It does not by itself indicate a vulnerability.", "limitations": "Discovery based on documented architecture alone misses integrations added during development.", "related_system_components": [ "llm_application" ], "related_ai_rmf_outcomes": [ "Map 1.1", "Map 2.1" ] }, { "measurement_id": "INV-002", "measurement_class": "Inventory", "title": "Model endpoint inventory coverage", "security_question": "Which model endpoints are reachable from applications, agents, and internal networks.", "evidence_source": "Model endpoint inventory, gateway routing configuration, and observed network flows.", "measurement_method": "Enumerate endpoints and associate each with an application, environment, and access boundary.", "result_type": "Count", "interpretation": "Endpoints present in traffic but absent from the inventory are unmanaged interfaces to review. The count sizes the gap, not its severity.", "limitations": "Endpoints introduced during development are missed by configuration review alone; observed flows are needed to close the gap.", "related_system_components": [ "model_endpoint", "model_gateway" ], "related_ai_rmf_outcomes": [ "Map 1.1", "Map 2.1" ] }, { "measurement_id": "INV-003", "measurement_class": "Inventory", "title": "External model provider inventory", "security_question": "Which external model providers process organizational prompts and data.", "evidence_source": "Application-to-provider mapping and outbound network destinations.", "measurement_method": "List providers, the applications that use them, and the data classification reaching each.", "result_type": "Count", "interpretation": "Each provider is a supplier that processes organizational data. A provider absent from supplier management is a gap in third-party oversight.", "limitations": "A provider relationship can arrive through a dependency or SDK rather than a direct integration.", "related_system_components": [ "external_model_provider", "llm_application" ], "related_ai_rmf_outcomes": [ "Map 1.1", "Govern 6.1" ] }, { "measurement_id": "INV-004", "measurement_class": "Inventory", "title": "Self-hosted model inventory", "security_question": "Which models the organization runs on its own infrastructure and where.", "evidence_source": "Deployment records, model gateway configuration, and container image contents.", "measurement_method": "Record each self-hosted model, its host, and the endpoints that serve it.", "result_type": "Count", "interpretation": "Self-hosted models keep prompts within the organizational boundary but still expose endpoints and artifacts that require the same inventory discipline.", "limitations": "A model artifact present on disk is not necessarily in active serving use.", "related_system_components": [ "self_hosted_model", "model_endpoint" ], "related_ai_rmf_outcomes": [ "Map 1.1", "Map 2.1" ] }, { "measurement_id": "INV-005", "measurement_class": "Inventory", "title": "RAG system and source inventory", "security_question": "Which retrieval pipelines exist and which sources feed their indexes.", "evidence_source": "RAG data source inventory, indexing pipeline configuration, and source ownership records.", "measurement_method": "List retrieval systems and reconcile indexed sources against the indexing configuration.", "result_type": "Count", "interpretation": "Indexes accumulate sources across teams over time. Sources present in the pipeline but absent from the inventory define the content a model can retrieve without a record.", "limitations": "Reconciliation against documentation alone misses sources added directly to the pipeline.", "related_system_components": [ "rag_pipeline", "rag_data_source", "vector_store" ], "related_ai_rmf_outcomes": [ "Map 1.1", "Map 2.1" ] }, { "measurement_id": "INV-006", "measurement_class": "Inventory", "title": "MCP server inventory", "security_question": "Which MCP servers are connected to applications and agents, and where they originate.", "evidence_source": "MCP client configuration and MCP server records.", "measurement_method": "Reconcile connected servers against client configuration and record each server's origin.", "result_type": "Count", "interpretation": "Connected servers extend application capability to whatever they expose and reach downstream. A connected server without a record is unassessed capability.", "limitations": "MCP servers can be added by developers during integration and can proxy to further servers.", "related_system_components": [ "mcp_server", "mcp_client" ], "related_ai_rmf_outcomes": [ "Map 1.1", "Govern 6.1" ] }, { "measurement_id": "INV-007", "measurement_class": "Inventory", "title": "MCP tool inventory", "security_question": "Which tools connected MCP servers expose and what operations they perform.", "evidence_source": "Tool definitions from connected MCP servers.", "measurement_method": "Enumerate tools and record the operation each performs and the server that exposes it.", "result_type": "Count", "interpretation": "The tool set is the operation surface an application or agent can reach through MCP. An unlisted tool is an operation nobody reviewed.", "limitations": "A server can register tools dynamically, so the inventory reflects the tools present at collection time.", "related_system_components": [ "mcp_tool", "mcp_server" ], "related_ai_rmf_outcomes": [ "Map 2.1" ] }, { "measurement_id": "INV-008", "measurement_class": "Inventory", "title": "Agent capability inventory", "security_question": "Which tools each agent can invoke and which operations those tools expose.", "evidence_source": "Agent configuration and tool definitions for each deployed agent.", "measurement_method": "Record the tools available to each agent and the operations reachable through them.", "result_type": "Count", "interpretation": "An agent's operation surface is the union of its tools, not its described role. The inventory establishes what the agent can do.", "limitations": "Tool sets change as agents are extended; the inventory must track the deployed configuration, not the intended design.", "related_system_components": [ "agent_runtime", "agent_tool" ], "related_ai_rmf_outcomes": [ "Map 2.1" ] }, { "measurement_id": "INV-009", "measurement_class": "Inventory", "title": "Effective execution identity inventory", "security_question": "Which identities components, tools, and agents authenticate as.", "evidence_source": "Service principals, cloud roles, API identities, and agent execution identities.", "measurement_method": "Record the identity each component operation runs as and link it to its downstream authorizations.", "result_type": "Count", "interpretation": "The identity is where impact concentrates. An operation's reach is set by the identity it runs as, so the identity inventory is prerequisite to permission review.", "limitations": "An identity record establishes which identity is used, not what it can do; downstream scope is a separate review.", "related_system_components": [ "service_identity", "agent_runtime", "mcp_server" ], "related_ai_rmf_outcomes": [ "Map 2.1" ] }, { "measurement_id": "INV-010", "measurement_class": "Inventory", "title": "Unowned AI asset count", "security_question": "How many AI assets in the inventory have no accountable owner.", "evidence_source": "AI system inventory and ownership records.", "measurement_method": "Count inventory entries without a recorded owner.", "result_type": "Count", "interpretation": "A non-zero value identifies systems requiring ownership resolution. It does not establish technical vulnerability; it establishes that the system cannot yet be assessed or remediated by an accountable party.", "limitations": "Ownership recorded in the inventory may be stale; a named owner is not the same as an owner who accepts the responsibility.", "related_system_components": [ "llm_application" ], "related_ai_rmf_outcomes": [ "Govern 2.1", "Map 1.1" ] }, { "measurement_id": "EXP-001", "measurement_class": "Exposure", "title": "Publicly reachable model endpoints", "security_question": "Which model endpoints are reachable from outside the intended network boundary.", "evidence_source": "Endpoint reachability records and network configuration.", "measurement_method": "Test reachability of each endpoint from its intended and adjacent network positions.", "result_type": "Count", "interpretation": "A publicly reachable endpoint is an interface to review for access control. Reachability is a condition to assess, not a finding on its own.", "limitations": "Reachability observed from one position does not describe reachability from every network position.", "related_system_components": [ "model_endpoint" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-002", "measurement_class": "Exposure", "title": "Model endpoints without expected authentication", "security_question": "Which reachable endpoints lack the authentication their boundary requires.", "evidence_source": "Endpoint authentication configuration and reachability records.", "measurement_method": "For each reachable endpoint, verify the presence and type of the required access control.", "result_type": "Count", "interpretation": "An endpoint reachable without an adequate access boundary is a direct exposure. Rate limiting is not an access boundary and does not close this measurement.", "limitations": "Configuration review establishes declared authentication; a live check confirms it is enforced.", "related_system_components": [ "model_endpoint", "model_gateway" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-003", "measurement_class": "Exposure", "title": "Non-production endpoints reachable outside intent", "security_question": "Which development or test endpoints are reachable beyond their intended boundary.", "evidence_source": "Endpoint inventory tagged by environment and reachability records.", "measurement_method": "Identify non-production endpoints and test their reachability outside the intended scope.", "result_type": "Count", "interpretation": "Non-production endpoints are a recurring exposure because they are often created without production controls and not removed when their use ends.", "limitations": "Environment tagging must be accurate for this measurement to be meaningful.", "related_system_components": [ "model_endpoint" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-004", "measurement_class": "Exposure", "title": "External model provider data egress", "security_question": "Which data classifications leave the organization to external providers.", "evidence_source": "Outbound data flow records and provider processing terms.", "measurement_method": "Map the classification of data sent to each external provider and compare against approvals.", "result_type": "Contextual Finding", "interpretation": "Data crossing the organizational boundary to a provider is governed by that provider's processing and retention terms. Whether it is acceptable depends on classification and provider terms, which are organization-specific.", "limitations": "The provider agreement is part of the control; transport protection alone does not address processing terms.", "related_system_components": [ "external_model_provider", "llm_application" ], "related_ai_rmf_outcomes": [ "Govern 6.1" ] }, { "measurement_id": "EXP-005", "measurement_class": "Exposure", "title": "MCP servers reachable outside approved boundary", "security_question": "Which MCP servers are reachable from outside the approved network boundary.", "evidence_source": "MCP server reachability records and network configuration.", "measurement_method": "Test each server's reachability against its approved network boundary.", "result_type": "Count", "interpretation": "A server reachable beyond its approved boundary widens who can drive the operations it exposes and the downstream systems it holds credentials for.", "limitations": "The credentials a server holds downstream are frequently more sensitive than the connection to it; both directions matter.", "related_system_components": [ "mcp_server" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-006", "measurement_class": "Exposure", "title": "Tools exposing administrative operations", "security_question": "Which connected tools can perform administrative operations on downstream systems.", "evidence_source": "Tool definitions and the effective permissions of the identities behind them.", "measurement_method": "Review each tool's reachable operations against the impact of those operations.", "result_type": "Count", "interpretation": "Administrative operations reachable through a tool raise the impact of any manipulation of that tool. The count identifies tools whose effective operations warrant a boundary review.", "limitations": "A tool's declared description does not establish the operations reachable through its parameters and identity.", "related_system_components": [ "mcp_tool", "agent_tool", "service_identity" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-007", "measurement_class": "Exposure", "title": "Agents using high-impact service identities", "security_question": "Which agents run under identities that can perform high-impact operations.", "evidence_source": "Agent execution identity records and downstream authorization records.", "measurement_method": "Compare each agent's execution identity permissions against the operations its function requires.", "result_type": "Contextual Finding", "interpretation": "An agent's risk follows its effective identity. Where the identity can perform operations beyond the agent's function, the gap is the exposure. What counts as high-impact is organization-specific.", "limitations": "Excess permission usually comes from reusing a broad service identity rather than an intentional grant.", "related_system_components": [ "agent_runtime", "service_identity" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-008", "measurement_class": "Exposure", "title": "RAG sources crossing tenant or classification boundaries", "security_question": "Whether retrieval can return content across tenant or classification boundaries.", "evidence_source": "Retrieval authorization design and source classification records.", "measurement_method": "Assess whether retrieval enforces the requester's authorization or runs with a broad service identity.", "result_type": "Observed/Not Observed", "interpretation": "Oversharing appears when retrieval runs with a broad identity and authorization is applied only at the application boundary. The condition is present or absent for a given pipeline.", "limitations": "Assessment requires the identity retrieval executes as, not only the application's front-door controls.", "related_system_components": [ "rag_pipeline", "rag_data_source" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "EXP-009", "measurement_class": "Exposure", "title": "Vector stores reachable outside intended boundary", "security_question": "Which vector stores and their metadata are reachable beyond the intended access boundary.", "evidence_source": "Vector store access configuration and network reachability records.", "measurement_method": "Test store reachability and review read and write access against the intended boundary.", "result_type": "Count", "interpretation": "Chunk metadata can carry source paths and access hints that are sensitive independent of the embeddings. Store exposure includes read, write, and network reach.", "limitations": "Write access to a store also enables poisoning, so read exposure is not the only concern.", "related_system_components": [ "vector_store" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-001", "measurement_class": "Control", "title": "Direct prompt injection resistance", "security_question": "Whether the application preserves its control instructions under adversarial user input.", "evidence_source": "Adversarial prompt test results and prompt construction design.", "measurement_method": "Apply an adversarial prompt suite against the application and score deviations from intended behavior.", "result_type": "Pass/Fail", "interpretation": "The result describes behavior under the methods used. A pass under one method set is not a guarantee against untested phrasings; a fail identifies a boundary that did not hold.", "limitations": "Pattern filtering removes a subset of phrasings and does not establish the boundary.", "related_system_components": [ "llm_application", "prompt_gateway" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Measure 2.1" ] }, { "measurement_id": "CTL-002", "measurement_class": "Control", "title": "Indirect prompt injection resistance", "security_question": "Whether instructions embedded in retrieved or tool-provided content alter application behavior.", "evidence_source": "Adversarial content test results and retrieval handling design.", "measurement_method": "Introduce adversarial content through the ingestion and retrieval path and score its influence on behavior and actions.", "result_type": "Pass/Fail", "interpretation": "The exposure grows with the actions reachable once content is in context. A fail is most consequential where the application can take actions after retrieval.", "limitations": "Coverage depends on exercising the content sources the application actually reads.", "related_system_components": [ "rag_pipeline", "llm_application", "agent_runtime" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Measure 2.1" ] }, { "measurement_id": "CTL-003", "measurement_class": "Control", "title": "System prompt disclosure", "security_question": "Whether application-controlled instructions can be disclosed or reconstructed.", "evidence_source": "Extraction and inference test results and prompt handling design.", "measurement_method": "Attempt disclosure through direct extraction, error paths, and multi-turn inference.", "result_type": "Observed/Not Observed", "interpretation": "Preventing literal extraction is not the same as protecting a secret the prompt contains. Where the prompt carries a credential, disclosure risk remains even when extraction is prevented.", "limitations": "Behavioral inference can reconstruct security-relevant content without literal disclosure.", "related_system_components": [ "llm_application" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-004", "measurement_class": "Control", "title": "Sensitive data in prompt handling", "security_question": "Whether sensitive data placed into prompts is controlled for its classification and destination.", "evidence_source": "Prompt data flow records and redaction configuration.", "measurement_method": "Trace sensitive data into prompts and review controls against the destination that processes it.", "result_type": "Coverage Percentage", "interpretation": "The applicable controls differ between a self-hosted model and an external provider. Coverage is measured against the classified data types that reach prompts.", "limitations": "Coverage reflects the data types the assessment enumerated; an unmapped data path is outside the percentage.", "related_system_components": [ "llm_application", "external_model_provider" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-005", "measurement_class": "Control", "title": "Sensitive data in response handling", "security_question": "Whether sensitive data in responses is controlled for the recipient and destination.", "evidence_source": "Response handling design and output monitoring records.", "measurement_method": "Review response handling and any output controls against the recipients and downstream destinations.", "result_type": "Coverage Percentage", "interpretation": "Output handling is a separate control from input handling. A response safe for one recipient may not be safe to write to a shared log or pass to another system.", "limitations": "A response can carry sensitive data drawn from retrieval or tool output, not only from the model.", "related_system_components": [ "llm_application" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-006", "measurement_class": "Control", "title": "Retrieval authorization", "security_question": "Whether retrieval returns only content the requester is authorized to access.", "evidence_source": "Retrieval authorization test results and access control configuration.", "measurement_method": "Test retrieval as different identities and verify results respect the requester's authorization.", "result_type": "Pass/Fail", "interpretation": "A fail means a user can obtain restricted content through generated answers. The decision point is whether authorization is applied at retrieval or only at the application boundary.", "limitations": "The identity retrieval executes as determines the result more than the application's front-door controls.", "related_system_components": [ "rag_pipeline", "vector_store" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Measure 2.1" ] }, { "measurement_id": "CTL-007", "measurement_class": "Control", "title": "RAG source provenance", "security_question": "Whether indexed content has recorded provenance and integrity controls.", "evidence_source": "Source provenance records and index write access controls.", "measurement_method": "Review provenance at the source, at insertion, and at re-indexing, and confirm write controls.", "result_type": "Coverage Percentage", "interpretation": "Poisoning frequently exploits a source the pipeline already trusts. Coverage measures the indexed content whose provenance and integrity are established.", "limitations": "Stale content that has been replaced can be as damaging as content that is malicious.", "related_system_components": [ "rag_pipeline", "rag_data_source" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Govern 6.1" ] }, { "measurement_id": "CTL-008", "measurement_class": "Control", "title": "Untrusted retrieved content handling", "security_question": "Whether retrieved content is treated as untrusted input and its influence bounded.", "evidence_source": "Retrieval handling design and action constraints after retrieval.", "measurement_method": "Review whether retrieved content is placed into context as trusted and what actions are reachable afterward.", "result_type": "Observed/Not Observed", "interpretation": "The risk is proportional to what the application can do after retrieval. The condition is whether retrieved content is bounded and observable once in context.", "limitations": "Content from user-writable sources warrants the same scrutiny as direct user input.", "related_system_components": [ "rag_pipeline", "llm_application" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-009", "measurement_class": "Control", "title": "MCP server authentication", "security_question": "Whether MCP servers and connections are authenticated and their credentials managed.", "evidence_source": "MCP authentication configuration and downstream credential inventory.", "measurement_method": "Review authentication in both directions: the client connection and the server's downstream credentials.", "result_type": "Pass/Fail", "interpretation": "A connection established without authenticating the server, or downstream credentials that are unmanaged, are direct gaps. Both directions are in scope.", "limitations": "The credentials a server holds for downstream services are frequently more sensitive than the client connection.", "related_system_components": [ "mcp_server", "mcp_client", "service_identity" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Govern 6.1" ] }, { "measurement_id": "CTL-010", "measurement_class": "Control", "title": "MCP effective permission review", "security_question": "What operations a tool can actually perform, given the identity it runs as.", "evidence_source": "Tool definitions, service identity records, and downstream authorization records.", "measurement_method": "Evaluate effective permission: the service identity, its downstream permissions, and operations reachable through parameters.", "result_type": "Control Gap", "interpretation": "A benign tool description does not establish the execution boundary. The gap is the difference between the tool's declared behavior and its effective permission.", "limitations": "Effective permission must be reviewed against downstream role assignment, not the tool description.", "related_system_components": [ "mcp_tool", "service_identity", "downstream_service" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Map 2.1" ] }, { "measurement_id": "CTL-011", "measurement_class": "Control", "title": "Tool input manipulation constraint", "security_question": "Whether tool invocations are constrained against manipulation through model-generated parameters.", "evidence_source": "Tool parameter handling design and invocation constraint configuration.", "measurement_method": "Review the operations and parameter ranges a tool accepts and whether invocations are recorded.", "result_type": "Observed/Not Observed", "interpretation": "A tool with broad parameters is manipulable even when its permissions are correct. The condition is whether the reachable operations and parameters are constrained.", "limitations": "Least privilege on the identity bounds impact but does not by itself constrain which operation a manipulated call selects.", "related_system_components": [ "mcp_tool", "agent_runtime" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-012", "measurement_class": "Control", "title": "Agent operation restriction", "security_question": "Whether consequential agent operations occur within a defined boundary.", "evidence_source": "Tool execution constraints, operation allowlists, and execution identity records.", "measurement_method": "Review the boundary applied to consequential operations: approval, constrained identity, allowlist, or observable execution.", "result_type": "Control Gap", "interpretation": "Human approval is one boundary among several and is not universally required. The gap is any consequential operation reachable without a boundary appropriate to its impact.", "limitations": "Approval fits rare high-impact operations; constrained identities and allowlists bound frequent operations without making the agent impractical.", "related_system_components": [ "agent_runtime", "agent_tool" ], "related_ai_rmf_outcomes": [ "Measure 2.7", "Govern 3.2" ] }, { "measurement_id": "CTL-013", "measurement_class": "Control", "title": "Effective identity least privilege", "security_question": "Whether the identities behind tools and agents are scoped to required operations.", "evidence_source": "Service identity records and downstream authorization records.", "measurement_method": "Compare granted permissions against required operations for each execution identity.", "result_type": "Control Gap", "interpretation": "The gap between granted and required permission determines the impact of a compromise or manipulation. Excess permission is the finding, not the identity's existence.", "limitations": "A shared identity across agents removes attribution and makes least privilege impractical.", "related_system_components": [ "service_identity", "agent_runtime", "mcp_server" ], "related_ai_rmf_outcomes": [ "Measure 2.7" ] }, { "measurement_id": "CTL-014", "measurement_class": "Control", "title": "Logging completeness for execution review", "security_question": "Whether records are sufficient to reconstruct a prompt, tool, or agent operation.", "evidence_source": "Application, gateway, and agent execution logs.", "measurement_method": "Compare recorded fields against the fields an investigation needs: invoking application, tool, effective identity, operation, target, and result.", "result_type": "Coverage Percentage", "interpretation": "A log that records only the model endpoint is insufficient for execution review. Coverage measures the operations whose records contain the fields an investigation needs.", "limitations": "Records must be attributable across sources on a common request or session identifier to support reconstruction.", "related_system_components": [ "logging_source", "agent_runtime", "mcp_server" ], "related_ai_rmf_outcomes": [ "Measure 3.1", "Manage 4.1" ] }, { "measurement_id": "RUN-001", "measurement_class": "Runtime", "title": "Prompt security events", "security_question": "What prompt manipulation activity was observed during the observation period.", "evidence_source": "Prompt security event records from the runtime path.", "measurement_method": "Review recorded prompt security events over the defined period.", "result_type": "Severity Distribution", "interpretation": "Observed events are evidence of runtime behavior during the period. They do not prove that unobserved injection paths do not exist.", "limitations": "Monitoring observes what reaches the application; it does not establish whether the application's boundaries are correct.", "related_system_components": [ "prompt_gateway", "llm_application" ], "related_ai_rmf_outcomes": [ "Measure 3.1", "Measure 2.4" ] }, { "measurement_id": "RUN-002", "measurement_class": "Runtime", "title": "Response security events", "security_question": "What sensitive-disclosure or policy-violating output was observed in responses.", "evidence_source": "Response security event records from the runtime path.", "measurement_method": "Review recorded response security events over the defined period.", "result_type": "Severity Distribution", "interpretation": "Response monitoring complements input monitoring because some conditions are only visible in the response. Observed events describe the period, not all possible output.", "limitations": "Response monitoring must avoid retaining the sensitive content it detects in a broadly readable store.", "related_system_components": [ "llm_application" ], "related_ai_rmf_outcomes": [ "Measure 3.1", "Measure 2.4" ] }, { "measurement_id": "RUN-003", "measurement_class": "Runtime", "title": "MCP tool invocation records", "security_question": "What tool invocations occurred and whether each is attributable.", "evidence_source": "Tool invocation records including tool, parameters summary, identity, and outcome.", "measurement_method": "Review invocation records for attribution and for operations outside expected use.", "result_type": "Observed/Not Observed", "interpretation": "Attributable invocation records support detection and investigation. Their absence means tool activity cannot be reconstructed, independent of whether misuse occurred.", "limitations": "Records reflect invocations that were logged; an unlogged path produces no record.", "related_system_components": [ "mcp_server", "mcp_tool" ], "related_ai_rmf_outcomes": [ "Measure 3.1", "Manage 4.1" ] }, { "measurement_id": "RUN-004", "measurement_class": "Runtime", "title": "Agent action trace completeness", "security_question": "Whether agent actions can be traced from trigger to downstream result.", "evidence_source": "Agent action records linking the invoking application, tool, identity, operation, target, and result.", "measurement_method": "Trace a sample of agent actions end to end and record missing fields.", "result_type": "Coverage Percentage", "interpretation": "A trace that identifies only the model endpoint is insufficient. Coverage measures the actions whose records support end-to-end reconstruction.", "limitations": "Trace completeness depends on the agent and its tools producing attributable records.", "related_system_components": [ "agent_runtime", "agent_tool" ], "related_ai_rmf_outcomes": [ "Measure 3.1", "Manage 4.1" ] }, { "measurement_id": "RUN-005", "measurement_class": "Runtime", "title": "Security policy decision records", "security_question": "What allow and block decisions the runtime path recorded.", "evidence_source": "Policy decision records from the prompt or runtime gateway.", "measurement_method": "Review policy decision records and reason codes over the period.", "result_type": "Count", "interpretation": "Decision records show what the runtime path allowed and blocked. A block record is evidence of a decision, not evidence that the tested control set is complete.", "limitations": "Decision records describe enforcement at runtime, not the correctness of the policy being enforced.", "related_system_components": [ "prompt_gateway" ], "related_ai_rmf_outcomes": [ "Measure 3.1" ] }, { "measurement_id": "RUN-006", "measurement_class": "Runtime", "title": "Downstream operation attribution", "security_question": "Whether downstream operations initiated through tools are attributable to the initiating request.", "evidence_source": "Downstream service logs correlated with tool invocation records.", "measurement_method": "Join downstream operations to the tool invocation and identity that initiated them.", "result_type": "Coverage Percentage", "interpretation": "Attribution across the boundary is what allows a downstream change to be traced back to an agent action. Coverage measures the operations that can be joined.", "limitations": "Correlation quality depends on consistent identifiers across the tool and downstream logs.", "related_system_components": [ "downstream_service", "mcp_server" ], "related_ai_rmf_outcomes": [ "Measure 3.1", "Manage 4.1" ] }, { "measurement_id": "CHG-001", "measurement_class": "Change", "title": "New or changed model endpoint", "security_question": "Whether a new or changed model endpoint has appeared since the last assessment.", "evidence_source": "Endpoint inventory baseline and change records.", "measurement_method": "Compare the current endpoint set against the assessed baseline.", "result_type": "Boolean", "interpretation": "A new endpoint changes the assessed surface. The measurement flags that a targeted reassessment of the endpoint is due; it does not itself judge the endpoint.", "limitations": "Detection depends on the change sources monitored; an endpoint added outside a monitored path is invisible until a full review.", "related_system_components": [ "model_endpoint" ], "related_ai_rmf_outcomes": [ "Manage 4.1" ] }, { "measurement_id": "CHG-002", "measurement_class": "Change", "title": "New or changed model provider", "security_question": "Whether the external model providers in use have changed.", "evidence_source": "Provider inventory baseline and outbound destination records.", "measurement_method": "Compare current providers and provider configuration against the baseline.", "result_type": "Boolean", "interpretation": "A provider change alters where organizational data is processed and under whose terms. It triggers a targeted reassessment of data egress and provider terms.", "limitations": "A provider change can arrive through an SDK or dependency update rather than a configuration change.", "related_system_components": [ "external_model_provider" ], "related_ai_rmf_outcomes": [ "Manage 3.1", "Govern 6.1" ] }, { "measurement_id": "CHG-003", "measurement_class": "Change", "title": "New RAG data source or trust source", "security_question": "Whether a new source has been indexed since the last assessment.", "evidence_source": "RAG source inventory baseline and indexing pipeline change records.", "measurement_method": "Compare the current indexed source set against the baseline.", "result_type": "Boolean", "interpretation": "A new source changes what the model can retrieve and the trust the pipeline places in it. It triggers a targeted reassessment of provenance and retrieval scope.", "limitations": "Sources added directly to the pipeline are missed if only documentation is compared.", "related_system_components": [ "rag_pipeline", "rag_data_source" ], "related_ai_rmf_outcomes": [ "Manage 4.1", "Map 1.1" ] }, { "measurement_id": "CHG-004", "measurement_class": "Change", "title": "Retrieval authorization change", "security_question": "Whether retrieval authorization has changed since the last assessment.", "evidence_source": "Retrieval authorization configuration baseline and change records.", "measurement_method": "Compare current retrieval authorization against the assessed baseline.", "result_type": "Boolean", "interpretation": "A change to retrieval authorization can introduce oversharing without any code change. It triggers a targeted reassessment of the retrieval authorization control.", "limitations": "Authorization applied through a shared service identity can change downstream without a visible pipeline change.", "related_system_components": [ "rag_pipeline" ], "related_ai_rmf_outcomes": [ "Manage 4.1" ] }, { "measurement_id": "CHG-005", "measurement_class": "Change", "title": "New MCP server or tool", "security_question": "Whether a new MCP server or tool has been connected since the last assessment.", "evidence_source": "MCP inventory baseline and client configuration change records.", "measurement_method": "Compare the current server and tool set against the baseline.", "result_type": "Boolean", "interpretation": "A new server or tool extends the operation surface reachable through MCP. It triggers a targeted reassessment of authentication and effective permission.", "limitations": "Servers can proxy to further servers, so a single connection can change more of the surface than it appears.", "related_system_components": [ "mcp_server", "mcp_tool" ], "related_ai_rmf_outcomes": [ "Manage 4.1", "Govern 6.1" ] }, { "measurement_id": "CHG-006", "measurement_class": "Change", "title": "MCP capability change", "security_question": "Whether a connected server changed the tools or permissions it exposes after connection.", "evidence_source": "MCP capability baseline and change records.", "measurement_method": "Compare current exposed capability against the approved baseline.", "result_type": "Boolean", "interpretation": "A server that adds a tool has changed the application's execution surface after review. It triggers a targeted reassessment against the approved configuration.", "limitations": "Capability change is a monitoring concern as well as a change-management concern.", "related_system_components": [ "mcp_server" ], "related_ai_rmf_outcomes": [ "Manage 4.1" ] }, { "measurement_id": "CHG-007", "measurement_class": "Change", "title": "Effective identity or downstream permission change", "security_question": "Whether an execution identity or its downstream permissions have changed.", "evidence_source": "Identity and downstream authorization baseline and change records.", "measurement_method": "Compare current identity permissions against the assessed baseline.", "result_type": "Boolean", "interpretation": "A permission increase on an execution identity raises the impact of any operation that runs as it. It triggers a targeted reassessment of the identity and the operations it reaches.", "limitations": "Downstream permission changes are made outside the AI system and can be missed by AI-scoped monitoring.", "related_system_components": [ "service_identity", "downstream_service" ], "related_ai_rmf_outcomes": [ "Manage 4.1" ] }, { "measurement_id": "CHG-008", "measurement_class": "Change", "title": "Logging loss or degradation", "security_question": "Whether logging for the system has been removed or reduced below the assessed level.", "evidence_source": "Logging configuration baseline and change records.", "measurement_method": "Compare current logging against the assessed completeness baseline.", "result_type": "Boolean", "interpretation": "A loss of logging reduces the evidence available for runtime review and investigation. It triggers an evidence refresh and a review of the logging completeness measurement.", "limitations": "Degradation can be partial: records may still be produced but missing the fields an investigation needs.", "related_system_components": [ "logging_source" ], "related_ai_rmf_outcomes": [ "Manage 4.1" ] }, { "measurement_id": "CHG-009", "measurement_class": "Change", "title": "Assessment evidence staleness", "security_question": "Whether the assessment evidence has passed its validity period.", "evidence_source": "Evidence collection dates and validity periods.", "measurement_method": "Compare evidence collection dates against the defined validity period for each evidence class.", "result_type": "Boolean", "interpretation": "Evidence past its validity period can no longer support a current decision. It triggers an evidence refresh for the affected classes and a review of the decisions that relied on it.", "limitations": "Validity periods are organization-specific and depend on how quickly the underlying component changes.", "related_system_components": [ "llm_application" ], "related_ai_rmf_outcomes": [ "Manage 4.1", "Measure 3.1" ] } ], "treatment_decisions": [ { "id": "ACCEPT", "definition": "The identified condition remains within documented risk tolerance and no additional treatment is selected at the time of review.", "note": "Acceptance is recorded against a named authority and a review date. It is a decision, not the absence of one." }, { "id": "RESTRICT", "definition": "Reduce the operations, permissions, data scope, endpoints, sources, or execution capability available to the component.", "note": "Restriction targets effective capability. Reducing a tool's parameters or narrowing a service identity are both restrictions." }, { "id": "ISOLATE", "definition": "Separate the component or execution path from the systems, data, identities, or network boundaries that create unacceptable impact.", "note": "Isolation changes what a compromised or manipulated path can reach, without removing the component." }, { "id": "REMOVE", "definition": "Remove the component, dependency, integration, capability, data source, tool, or endpoint from the approved system context.", "note": "Removal ends the exposure. It also ends the function the component provided, so it is a use-case decision as well as a security one." }, { "id": "MONITOR", "definition": "Continue operation under explicitly defined evidence and change conditions.", "note": "Monitoring is only a treatment when the records it depends on exist and a change condition is defined. Without those, it is deferral." }, { "id": "REASSESS", "definition": "Perform a new or targeted assessment because system context, evidence, or capability has materially changed.", "note": "Reassessment is selected when the current evidence can no longer support a decision, not as a way to postpone one." } ], "reassessment_triggers": [ { "trigger_id": "TRG-01", "trigger_type": "Model provider change", "affected_component_type": "external_model_provider", "response_type": "Targeted reassessment", "required_evidence": "Data egress and provider terms evidence" }, { "trigger_id": "TRG-02", "trigger_type": "Deployment environment change", "affected_component_type": "llm_application", "response_type": "Targeted reassessment", "required_evidence": "Configuration and network evidence" }, { "trigger_id": "TRG-03", "trigger_type": "New model endpoint", "affected_component_type": "model_endpoint", "response_type": "Targeted reassessment", "required_evidence": "Endpoint reachability and authentication evidence" }, { "trigger_id": "TRG-04", "trigger_type": "Authentication boundary change", "affected_component_type": "model_endpoint", "response_type": "Targeted reassessment", "required_evidence": "Authentication configuration evidence" }, { "trigger_id": "TRG-05", "trigger_type": "New RAG data source", "affected_component_type": "rag_data_source", "response_type": "Targeted reassessment", "required_evidence": "Source provenance and classification evidence" }, { "trigger_id": "TRG-06", "trigger_type": "New indexed content trust source", "affected_component_type": "rag_pipeline", "response_type": "Targeted reassessment", "required_evidence": "Indexing configuration and provenance evidence" }, { "trigger_id": "TRG-07", "trigger_type": "Retrieval authorization change", "affected_component_type": "rag_pipeline", "response_type": "Targeted reassessment", "required_evidence": "Retrieval authorization test evidence" }, { "trigger_id": "TRG-08", "trigger_type": "New MCP server", "affected_component_type": "mcp_server", "response_type": "Targeted reassessment", "required_evidence": "Server origin, authentication, and effective permission evidence" }, { "trigger_id": "TRG-09", "trigger_type": "New MCP tool", "affected_component_type": "mcp_tool", "response_type": "Targeted reassessment", "required_evidence": "Tool definition and effective permission evidence" }, { "trigger_id": "TRG-10", "trigger_type": "MCP capability definition change", "affected_component_type": "mcp_server", "response_type": "Targeted reassessment", "required_evidence": "Capability baseline and change evidence" }, { "trigger_id": "TRG-11", "trigger_type": "Service identity change", "affected_component_type": "service_identity", "response_type": "Targeted reassessment", "required_evidence": "Identity and downstream authorization evidence" }, { "trigger_id": "TRG-12", "trigger_type": "Downstream permission increase", "affected_component_type": "downstream_service", "response_type": "Targeted reassessment", "required_evidence": "Downstream role and scope evidence" }, { "trigger_id": "TRG-13", "trigger_type": "New agent tool", "affected_component_type": "agent_tool", "response_type": "Targeted reassessment", "required_evidence": "Agent capability and identity evidence" }, { "trigger_id": "TRG-14", "trigger_type": "New administrative operation reachable", "affected_component_type": "agent_tool", "response_type": "Targeted reassessment", "required_evidence": "Operation restriction and impact evidence" }, { "trigger_id": "TRG-15", "trigger_type": "Network exposure change", "affected_component_type": "model_endpoint", "response_type": "Targeted reassessment", "required_evidence": "Reachability evidence" }, { "trigger_id": "TRG-16", "trigger_type": "Data classification change", "affected_component_type": "llm_application", "response_type": "Decision review", "required_evidence": "Data classification record" }, { "trigger_id": "TRG-17", "trigger_type": "Logging loss or degradation", "affected_component_type": "logging_source", "response_type": "Evidence refresh", "required_evidence": "Logging completeness evidence" }, { "trigger_id": "TRG-18", "trigger_type": "Security incident involving the system", "affected_component_type": "llm_application", "response_type": "Full reassessment", "required_evidence": "Incident record and affected-path evidence" }, { "trigger_id": "TRG-19", "trigger_type": "Material prompt architecture change", "affected_component_type": "prompt_gateway", "response_type": "Targeted reassessment", "required_evidence": "Prompt and context boundary evidence" }, { "trigger_id": "TRG-20", "trigger_type": "Risk exception expiration", "affected_component_type": "llm_application", "response_type": "Decision review", "required_evidence": "Exception record" }, { "trigger_id": "TRG-21", "trigger_type": "Assessment evidence past validity period", "affected_component_type": "llm_application", "response_type": "Evidence refresh", "required_evidence": "Prior evidence and validity records" } ], "worked_example": { "title": "Indirect Prompt Injection Through a RAG-to-Agent Execution Path", "note": "This example describes a generalized enterprise assessment environment. It does not represent a specific Penaxtra customer or claim deployment within a named organization. Where a value is shown, it is illustrative and labeled as an assessment result, not telemetry.", "path": [ { "source": "RAG indexing pipeline", "relationship": "INDEXES_FROM", "target": "Untrusted document" }, { "source": "LLM application", "relationship": "RETRIEVES_FROM", "target": "Retrieval service" }, { "source": "LLM application", "relationship": "SENDS_PROMPT_TO", "target": "Model endpoint" }, { "source": "LLM application", "relationship": "RECEIVES_RESPONSE_FROM", "target": "Model endpoint" }, { "source": "Agent runtime", "relationship": "CONNECTS_TO_MCP", "target": "MCP server" }, { "source": "MCP server", "relationship": "EXPOSES_TOOL", "target": "Repository tool" }, { "source": "Agent runtime", "relationship": "INVOKES_TOOL", "target": "Repository tool" }, { "source": "Repository tool", "relationship": "EXECUTES_AS", "target": "Service account" }, { "source": "Repository tool", "relationship": "WRITES_TO", "target": "Source control system" } ], "governance": [ { "field": "System owner", "value": "Owner of the internal engineering assistant use case." }, { "field": "Technical owner", "value": "Team operating the assistant and its agent runtime." }, { "field": "Security assessment owner", "value": "Team performing the assessment." }, { "field": "Risk acceptance authority", "value": "Authority authorized to accept residual risk for the assistant." }, { "field": "Approved use case", "value": "Answer engineering questions and open pull requests on approved repositories." }, { "field": "Approved MCP capability", "value": "Read repository metadata and open pull requests on a named repository set." }, { "field": "Approved repository scope", "value": "The named repositories the use case requires." }, { "field": "Assessment requirement", "value": "Assess the complete retrieval-to-tool path, not the model in isolation." }, { "field": "Evidence responsibility", "value": "Assessment owner collects and retains the path evidence." } ], "governance_note": "Capability approval and effective permission are reviewed separately. The approval names a repository set; the effective permission is whatever the service account can reach, which the MAP stage establishes independently.", "components": [ { "name": "Untrusted document", "type": "rag_data_source", "note": "Untrusted; content originates outside the organization's control." }, { "name": "RAG indexing pipeline", "type": "rag_pipeline", "note": "Reads the document and writes it into the retrieval store." }, { "name": "Retrieval service", "type": "rag_pipeline", "note": "Returns retrieved content as model context." }, { "name": "LLM application", "type": "llm_application", "note": "Constructs prompts, retrieves context, and consumes model output." }, { "name": "Model endpoint", "type": "model_endpoint", "note": "The interface the application sends prompts to and receives responses from." }, { "name": "Agent runtime", "type": "agent_runtime", "note": "Plans and invokes tools based on model output." }, { "name": "MCP server", "type": "mcp_server", "note": "Exposes the repository tool to the agent." }, { "name": "Repository tool", "type": "mcp_tool", "note": "Reads metadata and opens pull requests; the component that performs the repository operation." }, { "name": "Service account", "type": "service_identity", "note": "The identity the repository tool runs as." }, { "name": "Source control system", "type": "downstream_service", "note": "The repository system the operation reaches." }, { "name": "Logging sources", "type": "logging_source", "note": "Records for the retrieval, tool, and repository operations." } ], "attack_path": [ "Untrusted document content is indexed and later retrieved as context.", "Retrieved content influences how the model or agent processes instructions.", "The influenced processing reaches an available tool decision boundary.", "A repository operation is invoked through the tool.", "The operation executes under the service account identity.", "Repository state may change within whatever the service account can reach." ], "measurements": [ { "measurement": "Document source provenance coverage (CTL-007)", "result": "Illustrative result: provenance recorded for approved sources; the affected source set is not covered." }, { "measurement": "RAG source approval status (INV-005, CHG-003)", "result": "Illustrative result: the source is present in the index but not in the approved source inventory." }, { "measurement": "Indirect prompt injection resistance (CTL-002)", "result": "Illustrative result: Fail on the retrieval-to-agent path under the method used." }, { "measurement": "Retrieved content trust boundary documented (CTL-008)", "result": "Illustrative result: Not Observed; retrieved content is placed into context as trusted." }, { "measurement": "Agent tool inventory coverage (INV-008)", "result": "Illustrative result: the repository tool is inventoried." }, { "measurement": "MCP effective permission review (CTL-010)", "result": "Illustrative result: 2 repositories within approved scope; 11 additional repositories reachable through the same service identity." }, { "measurement": "Repository operation restriction coverage (CTL-011)", "result": "Illustrative result: the tool exposes write operations without an operation constraint." }, { "measurement": "Service identity repository scope (CTL-013, EXP-007)", "result": "Illustrative result: the service account holds write across a broader repository set than the use case requires." }, { "measurement": "Tool invocation logging completeness (CTL-014, RUN-003)", "result": "Illustrative result: invocations are recorded with tool and identity; the target repository is not consistently recorded." }, { "measurement": "Downstream operation attribution (RUN-006)", "result": "Illustrative result: repository operations can be joined to the tool invocation for the approved repositories only." } ], "treatment": "RESTRICT", "rationale": "The path connects an untrusted source to a repository write under a service identity whose scope exceeds the approved repository set. The impact is set by the identity's effective reach, not by the tool's description. Restriction reduces that reach and constrains the reachable operation while the assistant continues to serve its use case.", "treatment_actions": [ "Separate the read identity from the write identity so retrieval and metadata reads do not run as an identity that can write.", "Limit the service account to the approved repository set so the reachable operation cannot extend beyond the use case.", "Constrain the repository tool to the specific operations the use case requires.", "Record MCP capability changes so a new tool or permission triggers reassessment.", "Record the target repository on every tool invocation so downstream operations are attributable.", "Require a targeted reassessment when the repository scope or the service identity changes, and retest the complete retrieval-to-agent path." ] }, "ai_rmf_outcomes": [ { "id": "Govern 2.1", "function": "GOVERN", "text": "Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.", "used_by": [ "INV-010" ] }, { "id": "Govern 3.2", "function": "GOVERN", "text": "Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.", "used_by": [ "CTL-012" ] }, { "id": "Govern 6.1", "function": "GOVERN", "text": "Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.", "used_by": [ "INV-003", "INV-006", "EXP-004", "CTL-007", "CTL-009", "CHG-002", "CHG-005" ] }, { "id": "Map 1.1", "function": "MAP", "text": "Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.", "used_by": [ "INV-001", "INV-002", "INV-003", "INV-004", "INV-005", "INV-006", "INV-010", "CHG-003" ] }, { "id": "Map 2.1", "function": "MAP", "text": "The specific tasks and methods used to implement the tasks that the AI system will support are defined.", "used_by": [ "INV-001", "INV-002", "INV-004", "INV-005", "INV-007", "INV-008", "INV-009", "CTL-010" ] }, { "id": "Measure 2.1", "function": "MEASURE", "text": "Test sets, metrics, and details about the tools used during Test, Evaluation, Validation, and Verification (TEVV) are documented.", "used_by": [ "CTL-001", "CTL-002", "CTL-006" ] }, { "id": "Measure 2.4", "function": "MEASURE", "text": "The functionality and behavior of the AI system and its components, as identified in the MAP function, are monitored when in production.", "used_by": [ "RUN-001", "RUN-002" ] }, { "id": "Measure 2.7", "function": "MEASURE", "text": "AI system security and resilience, for example, resistance to adversarial attacks, are evaluated and documented.", "used_by": [ "EXP-001", "EXP-002", "EXP-003", "EXP-005", "EXP-006", "EXP-007", "EXP-008", "EXP-009", "CTL-001", "CTL-002", "CTL-003", "CTL-004", "CTL-005", "CTL-006", "CTL-007", "CTL-008", "CTL-009", "CTL-010", "CTL-011", "CTL-012", "CTL-013" ] }, { "id": "Measure 3.1", "function": "MEASURE", "text": "Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.", "used_by": [ "CTL-014", "RUN-001", "RUN-002", "RUN-003", "RUN-004", "RUN-005", "RUN-006", "CHG-009" ] }, { "id": "Manage 3.1", "function": "MANAGE", "text": "AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.", "used_by": [ "CHG-002" ] }, { "id": "Manage 4.1", "function": "MANAGE", "text": "Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.", "used_by": [ "CTL-014", "RUN-003", "RUN-004", "RUN-006", "CHG-001", "CHG-003", "CHG-004", "CHG-005", "CHG-006", "CHG-007", "CHG-008", "CHG-009" ] } ], "references": [ { "title": "Artificial Intelligence Risk Management Framework (AI RMF 1.0)", "publisher": "National Institute of Standards and Technology", "identifier": "NIST AI 100-1", "url": "https://doi.org/10.6028/NIST.AI.100-1", "note": "Source of the AI RMF Core functions, categories, and subcategory outcomes referenced in this model. AI RMF 1.0 (2023) is the published version; NIST has stated the framework is subject to ongoing update." }, { "title": "NIST AI RMF Core", "publisher": "National Institute of Standards and Technology (AIRC)", "identifier": "", "url": "https://airc.nist.gov/airmf-resources/airmf/5-sec-core/", "note": "Source of truth for the GOVERN, MAP, MEASURE, and MANAGE subcategory identifiers and wording used here." }, { "title": "NIST AI RMF Playbook", "publisher": "National Institute of Standards and Technology (AIRC)", "identifier": "", "url": "https://airc.nist.gov/airmf-resources/playbook/", "note": "Companion voluntary resource with suggested actions for the AI RMF subcategories. The Playbook is not a mandatory sequential checklist and is subject to update." }, { "title": "NIST AIRC AI RMF Use Cases", "publisher": "National Institute of Standards and Technology (AIRC)", "identifier": "", "url": "https://airc.nist.gov/airmf-resources/usecases/", "note": "AIRC page describing AI RMF use cases and the submission channel. NIST does not validate or endorse individual organizations or their approaches to using the AI RMF." }, { "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "publisher": "National Institute of Standards and Technology", "identifier": "NIST AI 600-1", "url": "https://doi.org/10.6028/NIST.AI.600-1", "note": "Cross-sectoral profile referenced for generative AI risk context." }, { "title": "Open LLM Security Posture Mapping for NIST CSF 2.0", "publisher": "Penaxtra Security Research", "identifier": "Version 1.0", "url": "https://penaxtra.com/research/llm-security-posture-mapping", "note": "Related Penaxtra Security Research. A community mapping of LLM security concerns to NIST Cybersecurity Framework 2.0 outcomes, and a source of an existing LLM security taxonomy. It is not a NIST publication." } ], "version_history": [ { "version": "1.0", "date": "2026-07-14", "change": "Initial publication of the NIST AI RMF implementation model for LLM security assessments." } ] }