{ "resource": { "title": "Open LLM Security Posture Mapping for NIST CSF 2.0", "subtitle": "A vendor-neutral mapping of LLM and generative AI security risks to the NIST Cybersecurity Framework 2.0.", "version": "1.0", "type": "Security Mapping", "maintainer": "Penaxtra Security Research", "framework": "NIST Cybersecurity Framework 2.0", "status": "Published", "resource_url": "https://penaxtra.com/research/llm-security-posture-mapping", "index_url": "https://penaxtra.com/research", "usage_statement": "Free to use without registration or payment. Redistribution permitted with attribution to Penaxtra Security Research and preservation of the version identifier.", "last_updated": "2026-07-13", "abstract": "This resource maps the security risks of LLM and generative AI systems to the outcomes of the NIST Cybersecurity Framework 2.0. It defines a taxonomy of 49 security concerns with stable identifiers, organized into nine categories that span AI asset inventory, model endpoint exposure, shadow AI, prompt injection, system prompt exposure, sensitive data in prompt and response flows, retrieval-augmented generation security, Model Context Protocol server and tool security, AI agent execution, monitoring, and response. Each concern is related to NIST CSF 2.0 outcomes through two labeled relationship types, primary and supporting, with a rationale for each of the 145 relationships. The mapping uses official CSF 2.0 Function, Category, and Subcategory identifiers and is presented as a community resource for security assessment. It is not an official NIST crosswalk. Its purpose is to let an organization assess LLM and generative AI exposure with the framework it already applies to the rest of its environment, supported by an explicit model of the assessment evidence that demonstrates each outcome.", "keywords": [ "LLM security", "generative AI security", "NIST Cybersecurity Framework 2.0", "AI security posture", "prompt injection", "RAG security", "MCP security", "AI agent security", "model endpoint", "security assessment" ], "disclaimer": "This resource is an independent community-developed mapping maintained by Penaxtra Security Research. Penaxtra is not affiliated with or endorsed by the National Institute of Standards and Technology. References to NIST and the NIST Cybersecurity Framework are provided for mapping and implementation purposes. This resource does not modify the NIST Cybersecurity Framework 2.0 and does not create NIST requirements or certification.", "citation": "Penaxtra Security Research. \"Open LLM Security Posture Mapping for NIST CSF 2.0.\" Version 1.0. Penaxtra. https://penaxtra.com/research/llm-security-posture-mapping" }, "taxonomy": [ { "id": "PNX-LLM-AM-01", "category": "Asset Management", "title": "AI Asset Inventory", "security_objective": "Maintain an inventory of LLM applications, model endpoints, agent runtimes, RAG systems, MCP servers, and the external model services they depend on.", "description": "An organization cannot assess LLM exposure without identifying the systems, endpoints, data stores, and external services involved. An AI asset inventory records each LLM application and its supporting components, the environment it runs in, its owner, and the authentication boundary that governs access to it.", "risk_condition": "AI systems are deployed by product and engineering teams without a corresponding security inventory, so the model endpoints, agents, and integrations in production are not fully known to the teams responsible for assessing them.", "expected_outcome": "The set of LLM applications and their supporting components is identified, attributed to an owner, and kept current as systems are added, changed, and retired.", "assessment_evidence": [ "AI application inventory", "Model endpoint inventory", "Agent and MCP server inventory", "Ownership and environment records", "System lifecycle records" ], "implementation_considerations": "Different discovery methods reveal different parts of the surface. Cloud service inventory, source dependencies, API gateway configuration, and DNS each expose a subset. Treat the inventory as a reconciliation of several sources rather than the output of one.", "primary_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "The inventory records the LLM software, services, and systems the organization operates." } ], "supporting_mapping": [ { "csf_identifier": "ID.AM-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "mapping_rationale": "Inventoried AI systems are prioritized by classification and criticality." }, { "csf_identifier": "ID.AM-08", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Systems, hardware, software, services, and data are managed throughout their life cycles", "mapping_rationale": "AI systems are tracked through addition, change, and retirement." } ] }, { "id": "PNX-LLM-AM-02", "category": "Asset Management", "title": "Model Endpoint Discovery", "security_objective": "Identify the model API endpoints reachable from applications, agents, and internal networks, including test, development, and administrative endpoints.", "description": "A model endpoint is the network interface through which an application submits prompts and receives responses. Endpoints exist for hosted provider APIs, self-hosted models, and model gateways. Discovery establishes which endpoints exist, where they are reachable from, and how they authenticate.", "risk_condition": "Model endpoints are exposed on internal or public networks without a record of their existence, or non-production endpoints remain reachable after their intended use has ended.", "expected_outcome": "Reachable model endpoints are enumerated and associated with an application, an environment, and an access boundary.", "assessment_evidence": [ "Model endpoint inventory", "Network reachability records", "Endpoint authentication configuration", "Gateway routing configuration" ], "implementation_considerations": "Endpoint discovery based only on documented architecture will miss endpoints introduced during development. Combine configuration review with observed network flows where available.", "primary_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "Enumerated model endpoints are recorded as part of the system inventory." } ], "supporting_mapping": [ { "csf_identifier": "ID.AM-03", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Representations of the organization's authorized network communication and internal and external network data flows are maintained", "mapping_rationale": "Endpoint discovery documents the data flows between applications and models." }, { "csf_identifier": "ID.RA-01", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "mapping_rationale": "Unmanaged or stale endpoints are recorded as exposure to be assessed." } ] }, { "id": "PNX-LLM-AM-03", "category": "Asset Management", "title": "External Model Service Identification", "security_objective": "Identify external model providers and hosted AI services that process organizational prompts and data.", "description": "Applications commonly send prompts to external model providers. Each provider is a supplier that processes organizational data. Identification records which providers are in use, which applications use them, and what data classification reaches them.", "risk_condition": "External model providers are integrated at the application layer without being recorded as suppliers, so the data that leaves the organization and the terms that govern it are not tracked.", "expected_outcome": "External model providers and hosted AI services are identified, attributed to the applications that use them, and treated as suppliers within existing supplier management.", "assessment_evidence": [ "External model provider inventory", "Application-to-provider mapping", "Data classification reaching each provider", "Provider agreement references" ], "implementation_considerations": "A single application may call several providers, and a provider relationship may be introduced through a dependency or an SDK rather than a direct integration. Reconcile the provider list against outbound network destinations.", "primary_mapping": [ { "csf_identifier": "ID.AM-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of services provided by suppliers are maintained", "mapping_rationale": "External model providers are recorded as services provided by suppliers." } ], "supporting_mapping": [ { "csf_identifier": "GV.SC-04", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "Suppliers are known and prioritized by criticality", "mapping_rationale": "Model providers are identified as suppliers and prioritized by criticality." }, { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "Provider integrations are reflected in the system inventory." } ] }, { "id": "PNX-LLM-AM-04", "category": "Asset Management", "title": "Shadow AI Identification", "security_objective": "Identify LLM and generative AI usage that is not recorded in the approved inventory.", "description": "Shadow AI is the use of model APIs, embedded SDKs, browser-based AI services, SaaS AI features, application plugins, or developer tooling that is not recorded in the approved inventory. It is defined by the absence of a governance and security record rather than by the identity of the service.", "risk_condition": "Model integrations reach production through SaaS features, embedded SDKs, plugins, or undocumented endpoints referenced in code and configuration, and these integrations are not represented in the inventory used for assessment.", "expected_outcome": "Previously unrecorded AI usage is identified, evaluated, and either brought under management or removed.", "assessment_evidence": [ "Source and configuration references to model endpoints", "SaaS AI feature inventory", "Dependency and SDK inventory", "Outbound connections to model provider domains", "Browser and endpoint telemetry where available" ], "implementation_considerations": "Scoping matters. Treating all consumer use of a public assistant as shadow AI produces noise. Focus on integrations that process organizational data or connect to organizational systems.", "primary_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "Identified but unmanaged AI integrations are added to the software and service inventory." } ], "supporting_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Runtime and endpoint monitoring surfaces model integrations that discovery missed." }, { "csf_identifier": "ID.AM-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of services provided by suppliers are maintained", "mapping_rationale": "External AI services found through discovery are recorded as supplier services." } ] }, { "id": "PNX-LLM-AM-05", "category": "Asset Management", "title": "AI Dependency Inventory", "security_objective": "Maintain an inventory of the software dependencies that compose LLM systems, including SDKs, agent frameworks, MCP servers, and model gateways.", "description": "LLM systems are assembled from model provider SDKs, agent frameworks, MCP server implementations, model gateways, and supporting libraries. A dependency inventory records these components and their versions so that a known vulnerability or a compromised package can be traced to the systems that use it.", "risk_condition": "AI-specific dependencies are introduced without inventory, so a vulnerability disclosure in an agent framework or an MCP implementation cannot be mapped to affected systems.", "expected_outcome": "The components that compose LLM systems are inventoried at a version granularity that supports vulnerability and change tracking.", "assessment_evidence": [ "Dependency manifests", "Agent framework and SDK versions", "MCP server implementation records", "Model gateway component records", "Container image contents" ], "implementation_considerations": "AI dependencies change quickly and are sometimes pinned to pre-release versions. Record the resolved versions in use rather than only the declared ranges.", "primary_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "AI system dependencies are recorded within the software inventory." } ], "supporting_mapping": [ { "csf_identifier": "GV.SC-04", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "Suppliers are known and prioritized by criticality", "mapping_rationale": "Component suppliers are identified and prioritized by criticality." }, { "csf_identifier": "ID.RA-09", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "mapping_rationale": "Component authenticity and integrity are assessed before use." } ] }, { "id": "PNX-LLM-RA-01", "category": "Risk Assessment", "title": "LLM Application Risk Assessment", "security_objective": "Assess the security risk of an LLM application based on its function, data exposure, integrations, and execution capability.", "description": "An LLM application risk assessment combines the sensitivity of the data it processes, the systems it can reach, the actions it can take, and the trust placed in its inputs. The result informs the depth of testing and the controls applied.", "risk_condition": "LLM applications are deployed at uniform assurance regardless of the data they process or the actions they can perform, so high-impact applications receive the same review as low-impact ones.", "expected_outcome": "Each LLM application has a recorded risk determination that reflects data exposure, integration reach, and execution capability, and that determination guides control selection.", "assessment_evidence": [ "Application data flow records", "Integration and tool inventory", "Execution capability records", "Recorded risk determination" ], "implementation_considerations": "Risk changes when an application gains a new tool, a new data source, or a new agent capability. Reassessment should be tied to those changes rather than to a fixed calendar alone.", "primary_mapping": [ { "csf_identifier": "ID.RA-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "mapping_rationale": "Threats, impacts, and likelihoods are combined into an inherent risk determination for the application." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-03", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Internal and external threats to the organization are identified and recorded", "mapping_rationale": "Threats to the application are identified and recorded." }, { "csf_identifier": "ID.RA-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "mapping_rationale": "Impacts and likelihoods of identified threats are recorded." } ] }, { "id": "PNX-LLM-RA-02", "category": "Risk Assessment", "title": "Model Endpoint Exposure", "security_objective": "Assess the exposure of model endpoints, including reachability, authentication strength, and the presence of test or administrative interfaces.", "description": "Model endpoint exposure describes the conditions under which an endpoint can be reached and used. It covers public and internal reachability, the strength of the access boundary, and the presence of development or administrative endpoints that were not intended for production traffic.", "risk_condition": "A model endpoint is reachable without an adequate access boundary, or a test, development, or administrative endpoint is exposed on a network segment that untrusted parties can reach.", "expected_outcome": "Model endpoint reachability and access boundaries are assessed and recorded, and endpoints without an adequate boundary are remediated.", "assessment_evidence": [ "Endpoint reachability records", "Authentication and authorization configuration", "Gateway exposure configuration", "Rate and quota configuration" ], "implementation_considerations": "Rate control limits abuse but does not establish an access boundary. Treat quotas as supporting evidence alongside authentication and authorization rather than as a replacement for them.", "primary_mapping": [ { "csf_identifier": "ID.RA-01", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "mapping_rationale": "Endpoint exposure conditions are identified, validated, and recorded as vulnerabilities." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least-privilege access permissions govern which callers may use the endpoint." }, { "csf_identifier": "PR.IR-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Technology Infrastructure Resilience", "csf_category_code": "PR.IR", "csf_subcategory": "Networks and environments are protected from unauthorized logical access and usage", "mapping_rationale": "The environment hosting the endpoint is protected from unauthorized logical access." } ] }, { "id": "PNX-LLM-RA-03", "category": "Risk Assessment", "title": "AI Attack Path Analysis", "security_objective": "Analyze how an input source, an LLM application, an agent, its tools, and downstream systems combine into a reachable path to a sensitive operation.", "description": "AI attack path analysis treats the LLM system as a graph. It examines how an entry point, a prompt or content source, an agent, its available tools, the identity those tools run as, and a downstream system connect. The analysis identifies paths where untrusted input can reach a consequential operation.", "risk_condition": "Individual components are assessed in isolation, so a path that connects an untrusted input to a high-impact operation through an agent and its tools is not identified.", "expected_outcome": "Paths from untrusted input to consequential operations are identified and recorded, and the paths that carry the greatest impact are prioritized for control.", "assessment_evidence": [ "Integration and tool graph", "Identity and permission records for tool execution", "Data flow records", "Recorded attack path analysis" ], "implementation_considerations": "The value of the analysis depends on accurate effective-permission data. A path is only as constrained as the identity its final tool call runs as.", "primary_mapping": [ { "csf_identifier": "ID.RA-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "mapping_rationale": "The impact and likelihood of threats traversing an identified path are recorded." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-03", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Internal and external threats to the organization are identified and recorded", "mapping_rationale": "The threats that could traverse the path are identified." }, { "csf_identifier": "ID.RA-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "mapping_rationale": "Path analysis informs inherent risk and response prioritization." } ] }, { "id": "PNX-LLM-RA-04", "category": "Risk Assessment", "title": "Agent Capability Risk", "security_objective": "Assess the risk represented by an agent's effective execution capability rather than by its stated purpose.", "description": "An agent's risk is a function of what it can do, not what it is intended to do. Capability risk assessment records the tools an agent can invoke, the identity those invocations use, and the operations reachable through them.", "risk_condition": "An agent is assessed by its described role, while the tools and identities available to it permit operations well beyond that role.", "expected_outcome": "Agent risk is assessed against effective capability, and capability that exceeds the intended function is reduced or justified.", "assessment_evidence": [ "Agent tool inventory", "Effective execution identity records", "Reachable operation records", "Recorded capability risk determination" ], "implementation_considerations": "Capability is often broader than intended because a tool inherits the permissions of the service identity behind it. Assess the service identity behind the tool as well as the tool description.", "primary_mapping": [ { "csf_identifier": "ID.RA-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "mapping_rationale": "Agent capability is combined with impact and likelihood into a risk determination." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege bounds the operations an agent can perform." }, { "csf_identifier": "ID.RA-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "mapping_rationale": "The impact of an over-capable agent is recorded." } ] }, { "id": "PNX-LLM-RA-05", "category": "Risk Assessment", "title": "AI Supply Chain Risk", "security_objective": "Assess the security risk contributed by model providers, model artifacts, agent frameworks, MCP servers, and other AI system suppliers.", "description": "AI supply chain risk covers the providers and components an AI system depends on to function: model providers, model artifacts, SDKs, agent frameworks, MCP servers, and model gateways. Assessment considers the security ownership of each and the consequences of a compromise or a change.", "risk_condition": "AI system suppliers and components are adopted without assessment, so a compromised model artifact, framework, or connected server is not recognized as a security dependency.", "expected_outcome": "AI system suppliers and components are assessed before adoption and monitored over the relationship, with critical dependencies identified.", "assessment_evidence": [ "Supplier and component inventory", "Provenance and integrity records", "Supplier assessment records", "Change and version records" ], "implementation_considerations": "AI supply chain risk overlaps general software supply chain risk but adds model artifacts and connected servers that execute or influence application behavior. Keep the assessment specific to those components.", "primary_mapping": [ { "csf_identifier": "GV.SC-07", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship", "mapping_rationale": "Supplier and component risk is understood, assessed, and monitored over the relationship." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-09", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "mapping_rationale": "Component authenticity and integrity are assessed before use." }, { "csf_identifier": "GV.SC-04", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "Suppliers are known and prioritized by criticality", "mapping_rationale": "AI suppliers are identified and prioritized by criticality." } ] }, { "id": "PNX-LLM-PR-01", "category": "Prompt Security", "title": "Direct Prompt Injection", "security_objective": "Preserve the application's control instructions when a user submits input intended to override them.", "description": "Direct prompt injection is input submitted by a user of the application that attempts to override the application's instructions or policy. The relevant boundary is between application-controlled context and user-controlled input. An LLM does not enforce an instruction hierarchy on its own, so the application cannot assume that its instructions take precedence over user text.", "risk_condition": "User input alters the application's intended behavior, causing it to disregard its instructions, disclose restricted context, or take actions outside its intended scope.", "expected_outcome": "The application's control instructions are preserved under adversarial user input, and deviations are detected.", "assessment_evidence": [ "Prompt construction and context handling design", "Adversarial prompt test results", "Runtime prompt security events", "Instruction and policy separation records" ], "implementation_considerations": "Pattern filtering removes a subset of known phrasings and does not establish the boundary. Treat filtering as one supporting control alongside context isolation, output handling, and constrained execution.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The integrity of the in-use instruction and context data is protected against manipulation." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-01", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "mapping_rationale": "Injection susceptibility is identified and recorded through testing." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Runtime monitoring detects prompt manipulation attempts." } ] }, { "id": "PNX-LLM-PR-02", "category": "Prompt Security", "title": "Indirect Prompt Injection", "security_objective": "Preserve the application's control instructions when instructions are embedded in content the model reads, such as retrieved documents, web pages, or tool outputs.", "description": "Indirect prompt injection places adversarial instructions in content that the model consumes rather than in direct user input. Sources include retrieved documents, web content, files, and tool outputs. Because the application places this content into the model's context, retrieved content becomes an input trust boundary.", "risk_condition": "Content read by the model carries instructions that alter application behavior, and the application treats retrieved or tool-provided content as trusted context.", "expected_outcome": "Content consumed by the model is treated as untrusted input, and its influence on application behavior is bounded and observable.", "assessment_evidence": [ "Retrieval and content ingestion design", "Content provenance records", "Adversarial content test results", "Runtime prompt security events" ], "implementation_considerations": "The exposure grows with the number of content sources an application reads and with the actions available once content is in context. Assess ingestion, retrieval, and the actions reachable afterward together.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The integrity of in-use context is protected when untrusted content enters it." } ], "supporting_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The integrity of stored source content is protected." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Runtime monitoring detects manipulation introduced through content." } ] }, { "id": "PNX-LLM-PR-03", "category": "Prompt Security", "title": "System Prompt Exposure", "security_objective": "Protect the confidentiality of application-controlled instructions and the security-relevant behavior they encode.", "description": "System prompt exposure occurs through explicit extraction, partial disclosure, behavioral inference, error paths, logging, debugging interfaces, downstream tool context, and multi-turn leakage. Preventing literal disclosure of the system prompt and protecting the security-relevant application behavior it encodes are related but not identical objectives.", "risk_condition": "The system prompt is disclosed in full or in part, or its security-relevant contents are inferred, exposing embedded rules, references, or credentials.", "expected_outcome": "Application-controlled instructions are protected from disclosure, and security decisions do not depend on the secrecy of the prompt alone.", "assessment_evidence": [ "Prompt handling and logging design", "Error and debug path review", "Extraction and inference test results", "Downstream context propagation records" ], "implementation_considerations": "A system prompt that carries a secret or a credential remains a risk even when literal extraction is prevented. Move security-relevant enforcement out of the prompt where the design allows.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The confidentiality of in-use application context is protected." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-01", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "mapping_rationale": "Disclosure and inference paths are identified through testing." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Runtime monitoring detects extraction attempts." } ] }, { "id": "PNX-LLM-PR-04", "category": "Prompt Security", "title": "Prompt Control Bypass", "security_objective": "Maintain the application's safety and policy controls against inputs designed to circumvent them.", "description": "Prompt control bypass is the circumvention of an application's safety, policy, or guardrail controls through crafted input. The concern is whether the controls hold under adversarial conditions, independent of the specific phrasing used to test them.", "risk_condition": "Application controls that restrict behavior are circumvented through crafted input, so the application performs actions or produces output that the controls were intended to prevent.", "expected_outcome": "Safety and policy controls resist circumvention under adversarial input, and bypass conditions are identified and corrected.", "assessment_evidence": [ "Guardrail and policy configuration", "Bypass test results", "Runtime policy enforcement events", "Control improvement records" ], "implementation_considerations": "A control that depends only on input pattern matching is bypassable by construction. Evaluate controls against a range of phrasings and encodings and treat single-pattern controls as incomplete.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The integrity of the in-use control context is protected against circumvention." } ], "supporting_mapping": [ { "csf_identifier": "PR.PS-06", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle", "mapping_rationale": "Application controls are built and maintained through secure development practices." }, { "csf_identifier": "ID.IM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Improvement", "csf_category_code": "ID.IM", "csf_subcategory": "Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties", "mapping_rationale": "Bypass findings from testing drive control improvement." } ] }, { "id": "PNX-LLM-PR-05", "category": "Prompt Security", "title": "Cross-Context Prompt Manipulation", "security_objective": "Prevent input in one user, session, or tenant context from influencing another.", "description": "Cross-context prompt manipulation covers cases where context, memory, or retrieved content from one user, session, or tenant influences another. It applies to shared memory stores, cached context, and multi-tenant retrieval where separation is assumed but not enforced.", "risk_condition": "Context or content from one user, session, or tenant reaches another, so the application acts on data outside the current requester's boundary.", "expected_outcome": "Context is isolated across users, sessions, and tenants, and cross-context influence is prevented and detectable.", "assessment_evidence": [ "Context and memory isolation design", "Multi-tenant separation records", "Cross-context test results", "Runtime context access events" ], "implementation_considerations": "Shared memory and caching introduce cross-context paths that are invisible in a single-session test. Assess separation with concurrent, multi-identity scenarios.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The confidentiality and integrity of in-use context are preserved across boundaries." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Separation of duties and least privilege enforce tenant and session boundaries." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Runtime monitoring detects cross-context access." } ] }, { "id": "PNX-LLM-DS-01", "category": "Data Security", "title": "Sensitive Data in Prompts", "security_objective": "Control the sensitive data that enters prompts and is transmitted to model endpoints and providers.", "description": "Sensitive data reaches prompts through user input, application context, and retrieved content. It may include PII, credentials, API keys, internal documents, source code, customer data, regulated data, and security telemetry. The concern is the confidentiality of that data as it is transmitted to the model and processed by the provider.", "risk_condition": "Sensitive data is placed into prompts and transmitted to a model endpoint or external provider without a control that reflects its classification.", "expected_outcome": "The sensitive data that enters prompts is identified and controlled according to its classification and the destination that processes it.", "assessment_evidence": [ "Prompt data flow records", "Data classification reaching model endpoints", "Provider processing terms", "Redaction and minimization configuration" ], "implementation_considerations": "The applicable controls differ between a self-hosted model and an external provider. Assess the destination and its data handling as part of the control decision.", "primary_mapping": [ { "csf_identifier": "PR.DS-02", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-transit are protected", "mapping_rationale": "The confidentiality of sensitive data in transit to the model is protected." } ], "supporting_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The data is protected while in use during inference." }, { "csf_identifier": "ID.AM-07", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of data and corresponding metadata for designated data types are maintained", "mapping_rationale": "The data types reaching prompts are inventoried." } ] }, { "id": "PNX-LLM-DS-02", "category": "Data Security", "title": "Sensitive Data in Model Responses", "security_objective": "Control the disclosure of sensitive data in model responses returned to users or downstream systems.", "description": "Model responses can contain sensitive data drawn from training, retrieval, tool outputs, or context. The concern is the disclosure of that data to a recipient who is not authorized for it, whether an end user, a downstream system, or a log.", "risk_condition": "A model response returns sensitive data to a recipient that is not authorized for it, or to a downstream system or log that is not controlled for that classification.", "expected_outcome": "Sensitive data in model responses is controlled according to the recipient and the destination.", "assessment_evidence": [ "Response handling design", "Output classification records", "Response monitoring events", "Downstream destination records" ], "implementation_considerations": "Output handling is a separate control from input handling. A response that is safe to return to one recipient may not be safe to write to a shared log or pass to another system.", "primary_mapping": [ { "csf_identifier": "PR.DS-02", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-transit are protected", "mapping_rationale": "The confidentiality of sensitive data returned in responses is protected in transit." } ], "supporting_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "Response data is protected while in use by downstream processing." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Response monitoring detects disclosure of sensitive data." } ] }, { "id": "PNX-LLM-DS-03", "category": "Data Security", "title": "Prompt and Response Retention Exposure", "security_objective": "Control the retention of prompts and responses in application logs, provider logs, and analytics stores.", "description": "Prompts and responses are frequently retained for debugging, analytics, and model improvement. Retention creates data-at-rest that carries the sensitivity of the original content. The concern is the confidentiality and access control of that retained data.", "risk_condition": "Prompts and responses are retained in logs or analytics stores without controls that reflect the sensitivity of their content, or without a defined retention boundary.", "expected_outcome": "Retained prompts and responses are protected and access-controlled according to their classification, with a defined retention boundary.", "assessment_evidence": [ "Prompt and response logging configuration", "Retention configuration", "Access control on log and analytics stores", "Data inventory for retained content" ], "implementation_considerations": "Retained prompt and response data often outlives the application that produced it and is copied into analytics pipelines. Follow the data to every store it reaches.", "primary_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The confidentiality and integrity of retained prompt and response data at rest are protected." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Access to retained content is governed by least privilege." }, { "csf_identifier": "ID.AM-07", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of data and corresponding metadata for designated data types are maintained", "mapping_rationale": "Retained data types are inventoried." } ] }, { "id": "PNX-LLM-DS-04", "category": "Data Security", "title": "External Model Data Transfer", "security_objective": "Control the transfer of organizational data to external model providers and hosted AI services.", "description": "External model data transfer is the flow of prompts, context, and retrieved content to a provider outside the organization. The concern is the confidentiality of that data in transit, the terms under which the provider processes it, and the classification of what is sent.", "risk_condition": "Organizational data is transferred to an external provider without a control that reflects its classification or the provider's processing and retention terms.", "expected_outcome": "Data transferred to external providers is controlled in transit and governed by supplier terms appropriate to its classification.", "assessment_evidence": [ "Outbound data flow records", "Provider agreements and processing terms", "Data classification per provider", "Transport protection configuration" ], "implementation_considerations": "The provider agreement is part of the control. Assess processing, retention, and sub-processor terms alongside the transport protection.", "primary_mapping": [ { "csf_identifier": "PR.DS-02", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-transit are protected", "mapping_rationale": "The confidentiality of data in transit to external providers is protected." } ], "supporting_mapping": [ { "csf_identifier": "GV.SC-05", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties", "mapping_rationale": "Data handling requirements are integrated into provider agreements." }, { "csf_identifier": "GV.SC-07", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship", "mapping_rationale": "Provider data risk is assessed and monitored over the relationship." } ] }, { "id": "PNX-LLM-DS-05", "category": "Data Security", "title": "AI Logging Data Exposure", "security_objective": "Control the sensitive data that AI systems write to logs, traces, and telemetry.", "description": "AI systems generate logs, traces, and telemetry that can contain prompts, responses, tool inputs, credentials, and identifiers. The concern is the exposure of that sensitive data through logging that is broadly readable or retained without control.", "risk_condition": "AI logging and telemetry capture sensitive data that is then readable or retained without controls that reflect its sensitivity.", "expected_outcome": "AI logging captures the records needed for monitoring while sensitive content is controlled at generation and at rest.", "assessment_evidence": [ "Logging and telemetry configuration", "Access control on log stores", "Sensitive field handling in logs", "Retention configuration" ], "implementation_considerations": "Logging that supports detection and logging that leaks sensitive data are in tension. Configure what is captured and who can read it as one decision.", "primary_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The confidentiality of sensitive data at rest in logs is protected." } ], "supporting_mapping": [ { "csf_identifier": "PR.PS-04", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Log records are generated and made available for continuous monitoring", "mapping_rationale": "Log records are generated and made available for monitoring without exposing sensitive content." }, { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Access to logs is governed by least privilege." } ] }, { "id": "PNX-LLM-RAG-01", "category": "RAG Security", "title": "RAG Data Source Inventory", "security_objective": "Maintain an inventory of the data sources indexed into retrieval pipelines and the classification of their content.", "description": "A RAG system answers using content retrieved from indexed sources. A data source inventory records which sources feed the index, who owns them, and the classification of their content, so that retrieval scope and authorization can be assessed against known sources.", "risk_condition": "Sources are indexed into a retrieval pipeline without an inventory, so the content that a model can retrieve and its sensitivity are not fully known.", "expected_outcome": "The data sources feeding retrieval are inventoried, classified, and attributed to owners.", "assessment_evidence": [ "RAG data source inventory", "Content classification records", "Indexing pipeline configuration", "Source ownership records" ], "implementation_considerations": "Indexes accumulate sources over time and across teams. Reconcile the inventory against the indexing pipeline configuration rather than against documentation alone.", "primary_mapping": [ { "csf_identifier": "ID.AM-07", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of data and corresponding metadata for designated data types are maintained", "mapping_rationale": "Indexed data sources and their content types are inventoried." } ], "supporting_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "The retrieval systems themselves are inventoried." }, { "csf_identifier": "ID.AM-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "mapping_rationale": "Sources are prioritized by classification and criticality." } ] }, { "id": "PNX-LLM-RAG-02", "category": "RAG Security", "title": "Retrieval Authorization Exposure", "security_objective": "Enforce that retrieval returns only content the requester is authorized to access.", "description": "Retrieval authorization determines whether a retrieval respects the requester's access rights. When authorization is applied at the application rather than at retrieval, a user can receive content through the model that they could not access directly.", "risk_condition": "Retrieval returns content without applying the requester's access rights, so a user obtains restricted content through generated answers.", "expected_outcome": "Retrieval enforces the requester's authorization, and access decisions are applied at retrieval rather than only at the application boundary.", "assessment_evidence": [ "Retrieval authorization design", "Access control configuration on retrieval", "Tenant and user scoping records", "Authorization test results" ], "implementation_considerations": "Oversharing is often introduced when retrieval runs with a broad service identity. Assess the identity retrieval executes as, not only the application's front-door controls.", "primary_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least-privilege access permissions govern what retrieval returns to a requester." } ], "supporting_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The confidentiality of stored source content is protected." }, { "csf_identifier": "ID.AM-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "mapping_rationale": "Source classification informs authorization decisions." } ] }, { "id": "PNX-LLM-RAG-03", "category": "RAG Security", "title": "RAG Poisoning", "security_objective": "Preserve the integrity of indexed content against malicious or unauthorized modification.", "description": "RAG poisoning is the introduction of malicious or misleading content into a retrieval source or index. It can occur through a compromised source, unauthorized document insertion, or the exploitation of a trusted-source assumption. Poisoned content can carry indirect prompt injection or bias generated answers.", "risk_condition": "Content in a retrieval source or index is modified or inserted by an unauthorized party, and the pipeline treats indexed content as trusted.", "expected_outcome": "The integrity and provenance of indexed content are protected, and unauthorized modification is detectable.", "assessment_evidence": [ "Source provenance records", "Index write access controls", "Content change monitoring", "Re-indexing and validation records" ], "implementation_considerations": "Provenance and change monitoring matter because poisoning frequently exploits a source the pipeline already trusts. Assess integrity at the source and at re-indexing.", "primary_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The integrity of indexed content at rest is protected." } ], "supporting_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Content and index changes are monitored for adverse modification." }, { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "Poisoned content is treated as untrusted when it enters the model context." } ] }, { "id": "PNX-LLM-RAG-04", "category": "RAG Security", "title": "Untrusted Retrieved Content", "security_objective": "Treat retrieved content as untrusted input to the model rather than as trusted context.", "description": "Retrieved content enters the model's context and can carry instructions, misleading data, or references that alter behavior. The trust placed in retrieved content is a security decision. Content that originates outside the organization or from user-writable sources warrants the same scrutiny as direct user input.", "risk_condition": "Retrieved content is placed into the model context as trusted, so instructions or data embedded in it influence application behavior.", "expected_outcome": "Retrieved content is handled as untrusted input, and its influence on behavior and actions is bounded.", "assessment_evidence": [ "Retrieval handling design", "Content provenance and trust records", "Adversarial content test results", "Action constraints after retrieval" ], "implementation_considerations": "The risk is proportional to what the application can do after retrieval. Constrain the actions reachable once retrieved content is in context.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The integrity of the in-use context is protected when untrusted content enters it." } ], "supporting_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The integrity of the underlying stored content is protected." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Runtime monitoring detects manipulation through retrieved content." } ] }, { "id": "PNX-LLM-RAG-05", "category": "RAG Security", "title": "Vector Store Exposure", "security_objective": "Protect the vector store and its metadata from unauthorized access and modification.", "description": "A vector store holds embedded representations of source content along with chunk metadata. Exposure covers unauthorized read access to embeddings and metadata, unauthorized write access that supports poisoning, and network reachability of the store itself.", "risk_condition": "A vector store is reachable or modifiable without an adequate access boundary, exposing embedded content, metadata, or the index to unauthorized parties.", "expected_outcome": "Access to the vector store and its metadata is authenticated, authorized, and bounded to the systems that require it.", "assessment_evidence": [ "Vector store access configuration", "Network reachability records", "Metadata handling records", "Store inventory" ], "implementation_considerations": "Chunk metadata can carry source paths, identifiers, and access hints that are sensitive independent of the embeddings. Assess metadata exposure alongside the embeddings.", "primary_mapping": [ { "csf_identifier": "PR.DS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "mapping_rationale": "The confidentiality and integrity of stored embeddings and metadata are protected." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least-privilege access governs read and write to the store." }, { "csf_identifier": "PR.IR-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Technology Infrastructure Resilience", "csf_category_code": "PR.IR", "csf_subcategory": "Networks and environments are protected from unauthorized logical access and usage", "mapping_rationale": "The network environment hosting the store is protected from unauthorized access." } ] }, { "id": "PNX-LLM-MCP-01", "category": "MCP Security", "title": "MCP Server Inventory", "security_objective": "Maintain an inventory of MCP servers connected to LLM applications and agents, including their origin and the tools they expose.", "description": "An MCP server exposes tools, resources, and prompts to an LLM application or agent. An inventory records which servers are connected, where they originate, and what they expose, so that the capability reaching applications through MCP is known.", "risk_condition": "MCP servers are connected to applications and agents without an inventory, so the tools and resources reachable through MCP are not fully known.", "expected_outcome": "Connected MCP servers are inventoried and attributed to the applications and agents that use them, with their origin recorded.", "assessment_evidence": [ "MCP server inventory", "Server origin records", "Tool and resource definitions", "Application-to-server mapping" ], "implementation_considerations": "MCP servers can be added by developers during integration work and can proxy to further servers. Reconcile the inventory against actual client configuration.", "primary_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "Connected MCP servers are recorded within the system inventory." } ], "supporting_mapping": [ { "csf_identifier": "ID.AM-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of services provided by suppliers are maintained", "mapping_rationale": "External MCP servers are recorded as supplier services." }, { "csf_identifier": "ID.AM-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "mapping_rationale": "Servers are prioritized by the sensitivity of the operations they expose." } ] }, { "id": "PNX-LLM-MCP-02", "category": "MCP Security", "title": "MCP Server Authentication", "security_objective": "Authenticate MCP servers and the connections to them, and manage the credentials involved.", "description": "MCP connections carry tool invocations that can reach organizational systems. Authentication establishes that a connection is to the intended server and that the server is authorized to be used. It covers the credentials the client presents, the credentials the server holds for downstream services, and the transport that carries them.", "risk_condition": "An MCP connection is established without authenticating the server or the client, or downstream credentials held by the server are not managed.", "expected_outcome": "MCP servers and connections are authenticated, and the credentials involved are managed and protected.", "assessment_evidence": [ "MCP authentication configuration", "Credential management records", "Transport configuration", "Downstream credential inventory" ], "implementation_considerations": "The credentials an MCP server holds for downstream services are frequently more sensitive than the client connection. Assess both directions of authentication.", "primary_mapping": [ { "csf_identifier": "PR.AA-03", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Users, services, and hardware are authenticated", "mapping_rationale": "MCP servers and connecting clients are authenticated." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "mapping_rationale": "The credentials used for MCP connections are managed." }, { "csf_identifier": "PR.AA-04", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Identity assertions are protected, conveyed, and verified", "mapping_rationale": "Identity assertions between client and server are protected and verified." } ] }, { "id": "PNX-LLM-MCP-03", "category": "MCP Security", "title": "MCP Tool Permission Exposure", "security_objective": "Limit MCP-connected tools to the permissions and operations required by the approved use case.", "description": "MCP tools may expose file access, command execution, data retrieval, API operations, or administrative functions to an LLM application or agent. Tool availability alone is not sufficient evidence that the resulting execution boundary is appropriate. The effective permission of a tool is determined by the identity it runs as and the operations reachable through its parameters.", "risk_condition": "A connected MCP tool can perform operations outside the intended application scope, or permissions are not reviewed when server capabilities change.", "expected_outcome": "MCP tool capabilities and effective permissions are identified, reviewed, and restricted according to the approved system function.", "assessment_evidence": [ "MCP server configuration", "Tool definitions", "Authentication configuration", "Effective service permissions", "Allowed operations", "External service access", "Change records" ], "implementation_considerations": "Tool permissions should be evaluated as effective permissions, not only as documented tool descriptions. Review the identity used by the MCP server, downstream service permissions, and operations available through parameterized tool calls.", "primary_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege and separation of duties bound the operations reachable through a tool." } ], "supporting_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "Tool definitions and their capabilities are inventoried." }, { "csf_identifier": "PR.PS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Configuration management practices are established and applied", "mapping_rationale": "Tool permission configuration is managed as configuration." } ] }, { "id": "PNX-LLM-MCP-04", "category": "MCP Security", "title": "Untrusted MCP Server Connection", "security_objective": "Establish the trust basis of an MCP server before connecting an application or agent to it.", "description": "Connecting to an MCP server extends application capability to whatever that server exposes and to whatever it can reach downstream. Connecting to a server whose origin, integrity, and behavior are not established places that trust in an unverified party.", "risk_condition": "An application or agent connects to an MCP server whose origin and integrity have not been established, or to a server that can change its exposed capability after connection.", "expected_outcome": "MCP servers are evaluated before connection, and connections are limited to servers with an established trust basis.", "assessment_evidence": [ "Server origin and provenance records", "Integrity verification records", "Connection approval records", "Change monitoring configuration" ], "implementation_considerations": "An MCP server can present benign tool descriptions while its implementation reaches further systems. Establish trust from the server's origin and observed behavior.", "primary_mapping": [ { "csf_identifier": "GV.SC-06", "csf_function": "Govern", "csf_function_code": "GV", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_category_code": "GV.SC", "csf_subcategory": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "mapping_rationale": "Due diligence is performed before entering into a connection with a third-party server." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-09", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "mapping_rationale": "The authenticity and integrity of the server are assessed before use." } ] }, { "id": "PNX-LLM-MCP-05", "category": "MCP Security", "title": "MCP Tool Input Manipulation", "security_objective": "Preserve the integrity of MCP tool invocations against manipulation through model-generated parameters.", "description": "MCP tool calls are constructed from model output. When untrusted input influences that output, the parameters passed to a tool can be manipulated to reach unintended operations. The concern is the integrity of the tool invocation, including the operation selected and the parameters supplied.", "risk_condition": "Model-generated tool parameters are manipulated through untrusted input, causing a tool to perform an unintended operation within its available permissions.", "expected_outcome": "Tool invocations reflect the intended operation, and manipulation of parameters is constrained and detectable.", "assessment_evidence": [ "Tool parameter handling design", "Invocation constraint configuration", "Tool invocation records", "Manipulation test results" ], "implementation_considerations": "A tool with broad parameters is manipulable even when its permissions are correct. Constrain the operations and parameter ranges a tool accepts, and record invocations for review.", "primary_mapping": [ { "csf_identifier": "PR.DS-10", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Data Security", "csf_category_code": "PR.DS", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "mapping_rationale": "The integrity of in-use tool invocation data is protected against manipulation." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege bounds the operations a manipulated call can reach." }, { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Tool invocations are monitored for manipulation." } ] }, { "id": "PNX-LLM-MCP-06", "category": "MCP Security", "title": "MCP Capability Change Detection", "security_objective": "Detect changes to the tools, resources, and permissions an MCP server exposes.", "description": "An MCP server's exposed capability can change after connection through server updates, configuration changes, or dynamic tool registration. Capability change detection establishes that the tools and permissions in use match what was reviewed, and surfaces changes for reassessment.", "risk_condition": "An MCP server changes the tools or permissions it exposes after connection, and the change is not detected or reassessed.", "expected_outcome": "Changes to MCP-exposed capability are detected, recorded, and reassessed against the approved configuration.", "assessment_evidence": [ "Baseline capability records", "Capability change records", "Change monitoring configuration", "Reassessment records" ], "implementation_considerations": "Capability change is a monitoring concern as well as a change-management concern. A server that adds a tool has changed the application's execution surface.", "primary_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "The runtime capability exposed by MCP servers is monitored for change." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-07", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "mapping_rationale": "Capability changes are managed and assessed for risk impact." }, { "csf_identifier": "PR.PS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Configuration management practices are established and applied", "mapping_rationale": "Approved capability is maintained as a configuration baseline." } ] }, { "id": "PNX-LLM-AG-01", "category": "Agent Security", "title": "Agent Tool Inventory", "security_objective": "Maintain an inventory of the tools available to each agent and the operations those tools expose.", "description": "An agent acts by invoking tools. An agent tool inventory records which tools each agent can invoke and the operations reachable through them, so that the agent's capability can be assessed against its intended function.", "risk_condition": "Agents are deployed with tool sets that are not inventoried, so the operations an agent can perform are not fully known.", "expected_outcome": "The tools available to each agent are inventoried and attributed to the operations they expose.", "assessment_evidence": [ "Agent tool inventory", "Tool operation records", "Agent-to-tool mapping", "Tool source records" ], "implementation_considerations": "Tool sets change as agents are extended. Tie the inventory to the agent configuration that is actually deployed rather than to the intended design.", "primary_mapping": [ { "csf_identifier": "ID.AM-02", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "mapping_rationale": "Agent tools are inventoried within the system inventory." } ], "supporting_mapping": [ { "csf_identifier": "ID.AM-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Asset Management", "csf_category_code": "ID.AM", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "mapping_rationale": "Tools are prioritized by the sensitivity of the operations they expose." }, { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Tool availability is assessed against least-privilege boundaries." } ] }, { "id": "PNX-LLM-AG-02", "category": "Agent Security", "title": "Unsafe Tool Execution", "security_objective": "Constrain the operations an agent can execute so that consequential actions occur within an approved boundary.", "description": "Agent tools can perform file operations, command execution, API actions, administrative operations, database actions, messaging actions, cloud operations, and identity operations. Unsafe tool execution is the ability of an agent to perform a consequential operation without a control appropriate to its impact.", "risk_condition": "An agent executes a consequential operation without an approval boundary, a constrained identity, an operation allowlist, or an observable record.", "expected_outcome": "Consequential agent operations occur within a defined boundary, run under a constrained identity, and are observable.", "assessment_evidence": [ "Tool execution constraints", "Execution identity records", "Operation allowlists", "Tool execution records" ], "implementation_considerations": "Human approval is one boundary among several and is not always the right one. Constrained identities, operation allowlists, and observable execution can bound impact where approval is impractical.", "primary_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege and separation of duties bound the operations an agent can execute." } ], "supporting_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Agent execution is monitored for unsafe operations." } ] }, { "id": "PNX-LLM-AG-03", "category": "Agent Security", "title": "Excessive Agent Permissions", "security_objective": "Align an agent's granted permissions with the operations its function requires.", "description": "Excessive agent permissions arise when the identity an agent uses can perform operations beyond the agent's function. The concern is the gap between granted permission and required permission, which determines the impact of a compromise or a manipulation.", "risk_condition": "An agent runs with an identity whose permissions exceed the operations its function requires.", "expected_outcome": "Agent permissions are scoped to the required operations, and excess permission is removed or justified.", "assessment_evidence": [ "Agent execution identity records", "Granted permission records", "Required operation records", "Permission review records" ], "implementation_considerations": "Excess permission usually comes from reusing a broad service identity. Assess the effective permission of the identity behind the agent.", "primary_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege scopes agent permissions to required operations." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "mapping_rationale": "Agent identities and credentials are managed." }, { "csf_identifier": "ID.RA-05", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "mapping_rationale": "The risk of excess permission is assessed." } ] }, { "id": "PNX-LLM-AG-04", "category": "Agent Security", "title": "Unbounded Agent Action", "security_objective": "Bound the volume, scope, and duration of the actions an agent can take without intervention.", "description": "An agent can take repeated or expanding actions in response to input or its own intermediate output. Unbounded action is the absence of limits on how many actions, of what scope, and over what duration an agent can take, which affects both security impact and resource consumption.", "risk_condition": "An agent takes actions without limits on volume, scope, or duration, so a single input can produce a large or expanding set of operations.", "expected_outcome": "Agent actions are bounded in volume, scope, and duration, and boundary conditions are observable.", "assessment_evidence": [ "Action limit configuration", "Scope constraint records", "Agent action records", "Resource consumption records" ], "implementation_considerations": "Bounds serve both security and availability. Assess the limits on action count and scope alongside the resource and cost controls.", "primary_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege bounds the scope of operations an agent can take." } ], "supporting_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Agent action volume and scope are monitored." }, { "csf_identifier": "PR.IR-04", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Technology Infrastructure Resilience", "csf_category_code": "PR.IR", "csf_subcategory": "Adequate resource capacity to ensure availability is maintained", "mapping_rationale": "Resource capacity controls limit consumption from unbounded action." } ] }, { "id": "PNX-LLM-AG-05", "category": "Agent Security", "title": "Agent Identity and Authentication", "security_objective": "Assign and authenticate distinct identities for agents so that their actions are attributable and access-controlled.", "description": "An agent that acts on systems does so under an identity. Agent identity and authentication establish that the agent presents a distinct, managed identity to the systems it reaches, so that its access is controlled and its actions are attributable.", "risk_condition": "An agent acts under a shared, unmanaged, or unauthenticated identity, so its access cannot be controlled and its actions cannot be attributed.", "expected_outcome": "Agents present distinct, managed identities that are authenticated to the systems they reach.", "assessment_evidence": [ "Agent identity records", "Authentication configuration", "Credential management records", "Attribution records" ], "implementation_considerations": "A shared identity across agents removes attribution and makes least privilege impractical. Assign distinct identities where the systems support it.", "primary_mapping": [ { "csf_identifier": "PR.AA-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "mapping_rationale": "Agent identities and credentials are managed." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-03", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Users, services, and hardware are authenticated", "mapping_rationale": "Agents are authenticated to the systems they reach." }, { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Distinct identities enable least-privilege access control." } ] }, { "id": "PNX-LLM-AG-06", "category": "Agent Security", "title": "Cross-System Agent Attack Path", "security_objective": "Identify paths where an agent connects an untrusted input to a consequential operation on a downstream system.", "description": "A cross-system agent attack path connects an entry point, an LLM application, a content source, an agent, its tools, an execution identity, and a downstream system into a reachable route to a consequential operation. The path analysis records how these elements combine and where impact concentrates.", "risk_condition": "An untrusted input reaches a consequential operation on a downstream system through an agent and its tools, and the path is not identified.", "expected_outcome": "Cross-system agent paths are identified and recorded, and paths carrying the greatest impact are prioritized for control.", "assessment_evidence": [ "Agent tool and identity graph", "Downstream system reachability records", "Data flow records", "Recorded path analysis" ], "implementation_considerations": "Two paths illustrate the pattern. An untrusted retrieved document leads to indirect prompt injection, then to agent instruction manipulation, then to an MCP tool invocation under a service identity, then to an internal ticketing or source control operation. A user message leads to a tool call, then to a cloud operation under the agent identity, then to a configuration change. The impact of each path is set by the identity of its final operation.", "primary_mapping": [ { "csf_identifier": "ID.RA-04", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "mapping_rationale": "The impact and likelihood of an agent path reaching a consequential operation are recorded." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Least privilege on the execution identity limits the reachable operation." }, { "csf_identifier": "DE.AE-03", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Information is correlated from multiple sources", "mapping_rationale": "Correlation across sources supports identification of multi-step paths." } ] }, { "id": "PNX-LLM-DE-01", "category": "Monitoring and Detection", "title": "Prompt Attack Monitoring", "security_objective": "Monitor prompt flows for input that attempts to manipulate application behavior.", "description": "Prompt attack monitoring observes the input side of LLM traffic for manipulation attempts, including injection and control-bypass patterns. It provides the runtime signal that a point-in-time test cannot, because prompt content changes continuously in production.", "risk_condition": "Prompt manipulation attempts occur in production without a monitoring signal, so injection and bypass activity is not observed.", "expected_outcome": "Prompt flows are monitored for manipulation, and detected attempts are available for analysis.", "assessment_evidence": [ "Prompt security event records", "Monitoring configuration", "Detection coverage records", "Model endpoint request records" ], "implementation_considerations": "Runtime monitoring does not replace architecture review. It observes what reaches the application; it does not establish whether the application's boundaries are correct.", "primary_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Prompt flows in the runtime environment are monitored for adverse events." } ], "supporting_mapping": [ { "csf_identifier": "DE.AE-02", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "mapping_rationale": "Detected prompt events are analyzed to understand associated activity." }, { "csf_identifier": "DE.CM-01", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Networks and network services are monitored to find potentially adverse events", "mapping_rationale": "Network monitoring supports observation of model traffic." } ] }, { "id": "PNX-LLM-DE-02", "category": "Monitoring and Detection", "title": "Model Response Security Monitoring", "security_objective": "Monitor model responses for sensitive data disclosure and policy-violating output.", "description": "Model response monitoring observes the output side of LLM traffic for sensitive data disclosure and output that violates policy. It complements input monitoring because some concerns are only visible in the response.", "risk_condition": "Sensitive or policy-violating output is returned in production without a monitoring signal, so disclosure through responses is not observed.", "expected_outcome": "Model responses are monitored for disclosure and policy violation, and detected events are available for analysis.", "assessment_evidence": [ "Response security event records", "Monitoring configuration", "Output classification records", "Log records" ], "implementation_considerations": "Response monitoring must be configured to avoid retaining the sensitive content it detects in a broadly readable store. Configure detection and retention together.", "primary_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Model responses in the runtime environment are monitored for adverse events." } ], "supporting_mapping": [ { "csf_identifier": "DE.AE-02", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "mapping_rationale": "Detected response events are analyzed." }, { "csf_identifier": "PR.PS-04", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Log records are generated and made available for continuous monitoring", "mapping_rationale": "Log records support response monitoring without exposing sensitive content." } ] }, { "id": "PNX-LLM-DE-03", "category": "Monitoring and Detection", "title": "AI Configuration Change Monitoring", "security_objective": "Monitor changes to model, gateway, agent, and RAG configuration that affect the security boundary.", "description": "AI configuration change monitoring observes changes to model settings, gateway routing, agent policy, and RAG indexing that alter the security boundary. A configuration change can expand exposure without any change to code.", "risk_condition": "A change to AI configuration expands the security boundary without detection, so the exposure introduced by the change is not observed or reassessed.", "expected_outcome": "Security-relevant AI configuration changes are detected, recorded, and available for reassessment.", "assessment_evidence": [ "Configuration change records", "Baseline configuration records", "Change monitoring configuration", "Reassessment records" ], "implementation_considerations": "Point-in-time testing does not replace change monitoring. A configuration that was assessed as sound can be changed the day after the assessment.", "primary_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "AI configuration changes in the runtime environment are monitored for adverse events." } ], "supporting_mapping": [ { "csf_identifier": "ID.RA-07", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "mapping_rationale": "Configuration changes are managed and assessed for risk impact." }, { "csf_identifier": "PR.PS-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Configuration management practices are established and applied", "mapping_rationale": "Configuration baselines support change detection." } ] }, { "id": "PNX-LLM-DE-04", "category": "Monitoring and Detection", "title": "MCP Capability Change Monitoring", "security_objective": "Monitor connected MCP servers for changes to the tools and permissions they expose.", "description": "MCP capability change monitoring observes connected servers for changes to their exposed tools, resources, and permissions. Because a server can change its capability after connection, this monitoring maintains an accurate view of the execution surface reaching applications through MCP.", "risk_condition": "A connected MCP server changes its exposed capability, and the change is not observed against the approved baseline.", "expected_outcome": "Changes to MCP-exposed capability are monitored and available for reassessment.", "assessment_evidence": [ "Baseline capability records", "Capability change events", "External service monitoring records", "Change monitoring configuration" ], "implementation_considerations": "MCP capability change monitoring overlaps external service monitoring where the server is operated by a third party. Include both the server behavior and the downstream services it reaches.", "primary_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "MCP-exposed capability in the runtime environment is monitored for change." } ], "supporting_mapping": [ { "csf_identifier": "DE.CM-06", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "External service provider activities and services are monitored to find potentially adverse events", "mapping_rationale": "External MCP server activity is monitored." }, { "csf_identifier": "ID.RA-07", "csf_function": "Identify", "csf_function_code": "ID", "csf_category": "Risk Assessment", "csf_category_code": "ID.RA", "csf_subcategory": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "mapping_rationale": "Capability changes are managed and assessed for risk impact." } ] }, { "id": "PNX-LLM-DE-05", "category": "Monitoring and Detection", "title": "Agent Execution Monitoring", "security_objective": "Monitor agent tool execution for actions that fall outside expected operation.", "description": "Agent execution monitoring observes the operations agents perform through their tools, including the operation, the identity, and the outcome. It provides the record needed to detect and investigate agent actions that fall outside expected operation.", "risk_condition": "An agent performs operations that fall outside expected operation without a monitoring signal, so anomalous or unsafe execution is not observed.", "expected_outcome": "Agent tool execution is monitored, and operations outside expected behavior are available for analysis.", "assessment_evidence": [ "Agent action records", "Tool execution records", "Execution identity records", "Monitoring configuration" ], "implementation_considerations": "Execution monitoring depends on the agent and its tools producing attributable records. Assess whether the execution path generates the records the monitoring requires.", "primary_mapping": [ { "csf_identifier": "DE.CM-09", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "mapping_rationale": "Agent execution in the runtime environment is monitored for adverse events." } ], "supporting_mapping": [ { "csf_identifier": "DE.CM-03", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Continuous Monitoring", "csf_category_code": "DE.CM", "csf_subcategory": "Personnel activity and technology usage are monitored to find potentially adverse events", "mapping_rationale": "Technology usage monitoring covers agent activity." }, { "csf_identifier": "DE.AE-02", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "mapping_rationale": "Detected agent events are analyzed." } ] }, { "id": "PNX-LLM-DE-06", "category": "Monitoring and Detection", "title": "AI Security Event Correlation", "security_objective": "Correlate AI security events across prompt, response, tool, configuration, and identity sources.", "description": "AI security events originate from prompts, responses, tool executions, configuration changes, and identity activity. Correlation combines these sources so that a multi-step sequence, such as a poisoned retrieval followed by a tool invocation, can be understood as a single chain rather than as unrelated events.", "risk_condition": "AI security events are observed in isolation, so a multi-step sequence that crosses prompt, retrieval, tool, and identity sources is not recognized.", "expected_outcome": "AI security events are correlated across sources so that related activity is analyzed together.", "assessment_evidence": [ "Event source inventory", "Correlation configuration", "Correlated event records", "Analysis records" ], "implementation_considerations": "Correlation quality depends on consistent identifiers across sources. Assess whether prompt, tool, and identity events can be joined on a common request or session identifier.", "primary_mapping": [ { "csf_identifier": "DE.AE-03", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Information is correlated from multiple sources", "mapping_rationale": "Information from multiple AI event sources is correlated." } ], "supporting_mapping": [ { "csf_identifier": "DE.AE-02", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "mapping_rationale": "Correlated events are analyzed to understand associated activity." }, { "csf_identifier": "DE.AE-04", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "The estimated impact and scope of adverse events are understood", "mapping_rationale": "The impact and scope of a correlated sequence are understood." } ] }, { "id": "PNX-LLM-RS-01", "category": "Response", "title": "AI Security Event Analysis", "security_objective": "Analyze AI security events to establish what took place and the root cause.", "description": "AI security event analysis establishes what happened during an AI security event and why. It draws on the correlated event record to determine the sequence, the entry point, the systems reached, and the underlying cause.", "risk_condition": "An AI security event is handled without analysis of what took place and why, so the root cause is not established and recurrence is likely.", "expected_outcome": "AI security events are analyzed to establish the sequence of activity and the root cause.", "assessment_evidence": [ "Correlated event records", "Analysis records", "Root cause determination", "Impact records" ], "implementation_considerations": "Analysis depends on the evidence preserved at the time of the event. The quality of the analysis is bounded by the runtime and logging records available.", "primary_mapping": [ { "csf_identifier": "RS.AN-03", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Analysis", "csf_category_code": "RS.AN", "csf_subcategory": "Analysis is performed to establish what has taken place during an incident and the root cause of the incident", "mapping_rationale": "Analysis establishes what took place during the event and the root cause." } ], "supporting_mapping": [ { "csf_identifier": "DE.AE-02", "csf_function": "Detect", "csf_function_code": "DE", "csf_category": "Adverse Event Analysis", "csf_category_code": "DE.AE", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "mapping_rationale": "Prior event analysis feeds the incident analysis." }, { "csf_identifier": "RS.AN-08", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Analysis", "csf_category_code": "RS.AN", "csf_subcategory": "An incident's magnitude is estimated and validated", "mapping_rationale": "The magnitude of the event is estimated and validated." } ] }, { "id": "PNX-LLM-RS-02", "category": "Response", "title": "Model Endpoint Isolation", "security_objective": "Isolate a model endpoint to contain an active AI security event.", "description": "Model endpoint isolation removes or restricts access to an endpoint involved in an active event, containing the activity while analysis and remediation proceed. It is a containment action applied to the model interface.", "risk_condition": "An active event involving a model endpoint continues because there is no ready means to isolate the endpoint.", "expected_outcome": "A model endpoint involved in an event can be isolated to contain the activity.", "assessment_evidence": [ "Endpoint isolation procedure", "Access control records", "Isolation action records", "Containment outcome records" ], "implementation_considerations": "Isolation is more effective when the endpoint's callers and dependencies are known in advance. The asset inventory and data flow records support a targeted isolation.", "primary_mapping": [ { "csf_identifier": "RS.MI-01", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Mitigation", "csf_category_code": "RS.MI", "csf_subcategory": "Incidents are contained", "mapping_rationale": "Isolating the endpoint contains the incident." } ], "supporting_mapping": [ { "csf_identifier": "RS.MA-03", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Management", "csf_category_code": "RS.MA", "csf_subcategory": "Incidents are categorized and prioritized", "mapping_rationale": "Incident categorization and prioritization inform the isolation decision." }, { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Access controls provide the mechanism to restrict the endpoint." } ] }, { "id": "PNX-LLM-RS-03", "category": "Response", "title": "MCP Connection Revocation", "security_objective": "Revoke an MCP connection and the associated credentials to contain an event involving a connected server.", "description": "MCP connection revocation removes a server connection and invalidates the credentials associated with it, containing activity that reaches systems through that server. It addresses both the connection and the downstream credentials the server holds.", "risk_condition": "An event involving a connected MCP server continues because the connection and its credentials cannot be revoked promptly.", "expected_outcome": "An MCP connection and its associated credentials can be revoked to contain an event.", "assessment_evidence": [ "Connection revocation procedure", "Credential inventory", "Revocation action records", "Containment outcome records" ], "implementation_considerations": "Revoking the connection without invalidating the downstream credentials the server holds may leave the reachable operations available. Address both.", "primary_mapping": [ { "csf_identifier": "RS.MI-01", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Mitigation", "csf_category_code": "RS.MI", "csf_subcategory": "Incidents are contained", "mapping_rationale": "Revoking the connection contains the incident." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-01", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "mapping_rationale": "Credential management provides the means to invalidate the associated credentials." }, { "csf_identifier": "RS.MI-02", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Mitigation", "csf_category_code": "RS.MI", "csf_subcategory": "Incidents are eradicated", "mapping_rationale": "Revocation supports eradication of the reachable capability." } ] }, { "id": "PNX-LLM-RS-04", "category": "Response", "title": "Agent Capability Restriction", "security_objective": "Restrict an agent's tools or identity to contain an event involving agent activity.", "description": "Agent capability restriction reduces the tools available to an agent or constrains the identity it uses, containing activity that the agent is performing. It is a containment action applied to the agent's execution capability.", "risk_condition": "An event involving an agent continues because there is no ready means to restrict the tools or identity it uses.", "expected_outcome": "An agent's capability can be restricted to contain an event.", "assessment_evidence": [ "Capability restriction procedure", "Agent identity and tool records", "Restriction action records", "Containment outcome records" ], "implementation_considerations": "The effectiveness of restriction depends on the agent's identity and tools being known and controllable at the time of the event. The agent inventory supports a targeted restriction.", "primary_mapping": [ { "csf_identifier": "RS.MI-01", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Mitigation", "csf_category_code": "RS.MI", "csf_subcategory": "Incidents are contained", "mapping_rationale": "Restricting agent capability contains the incident." } ], "supporting_mapping": [ { "csf_identifier": "PR.AA-05", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Identity Management, Authentication, and Access Control", "csf_category_code": "PR.AA", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "mapping_rationale": "Access controls provide the mechanism to restrict capability." }, { "csf_identifier": "RS.MI-02", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Mitigation", "csf_category_code": "RS.MI", "csf_subcategory": "Incidents are eradicated", "mapping_rationale": "Restriction supports eradication of the misused capability." } ] }, { "id": "PNX-LLM-RS-05", "category": "Response", "title": "Prompt Security Incident Investigation", "security_objective": "Investigate a prompt security incident using preserved prompt, response, and execution records.", "description": "Prompt security incident investigation reconstructs a prompt-related event from the preserved records of prompts, responses, and the actions that followed. It establishes what input was involved, how the application responded, and what operations resulted.", "risk_condition": "A prompt security incident cannot be reconstructed because the prompt, response, and execution records needed for investigation were not preserved.", "expected_outcome": "Prompt security incidents can be investigated from preserved records, and the sequence of activity is established.", "assessment_evidence": [ "Preserved prompt and response records", "Execution records", "Investigation records", "Triage and validation records" ], "implementation_considerations": "Investigation depends on records that may themselves contain sensitive content. Preserve the records under access control appropriate to their sensitivity.", "primary_mapping": [ { "csf_identifier": "RS.AN-03", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Analysis", "csf_category_code": "RS.AN", "csf_subcategory": "Analysis is performed to establish what has taken place during an incident and the root cause of the incident", "mapping_rationale": "Investigation establishes what took place and the root cause." } ], "supporting_mapping": [ { "csf_identifier": "RS.AN-06", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Analysis", "csf_category_code": "RS.AN", "csf_subcategory": "Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved", "mapping_rationale": "Investigation actions are recorded with integrity and provenance preserved." }, { "csf_identifier": "RS.MA-02", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Management", "csf_category_code": "RS.MA", "csf_subcategory": "Incident reports are triaged and validated", "mapping_rationale": "Incident reports are triaged and validated before investigation." } ] }, { "id": "PNX-LLM-RS-06", "category": "Response", "title": "AI Security Evidence Preservation", "security_objective": "Preserve AI security event data and metadata with integrity and provenance for analysis and investigation.", "description": "AI security evidence preservation retains the prompt, response, tool execution, configuration, and identity records associated with an event, along with their metadata, so that analysis and investigation can rely on them. Preservation addresses both the completeness and the integrity of the records.", "risk_condition": "The records needed to analyze and investigate an AI security event are not preserved, or their integrity and provenance are not maintained.", "expected_outcome": "AI security event data and metadata are collected and preserved with integrity and provenance.", "assessment_evidence": [ "Evidence collection procedure", "Record integrity controls", "Provenance records", "Retention configuration" ], "implementation_considerations": "Evidence quality matters when the mapping is used for control review as well as for incident response. Records that lack integrity or provenance limit both analysis and assurance.", "primary_mapping": [ { "csf_identifier": "RS.AN-07", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Analysis", "csf_category_code": "RS.AN", "csf_subcategory": "Incident data and metadata are collected, and their integrity and provenance are preserved", "mapping_rationale": "Incident data and metadata are collected with integrity and provenance preserved." } ], "supporting_mapping": [ { "csf_identifier": "RS.AN-06", "csf_function": "Respond", "csf_function_code": "RS", "csf_category": "Incident Analysis", "csf_category_code": "RS.AN", "csf_subcategory": "Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved", "mapping_rationale": "Investigation actions are recorded with integrity preserved." }, { "csf_identifier": "PR.PS-04", "csf_function": "Protect", "csf_function_code": "PR", "csf_category": "Platform Security", "csf_category_code": "PR.PS", "csf_subcategory": "Log records are generated and made available for continuous monitoring", "mapping_rationale": "Log generation supplies the records preserved as evidence." } ] } ], "mapping": [ { "taxonomy_id": "PNX-LLM-AM-01", "security_concern": "AI Asset Inventory", "taxonomy_category": "Asset Management", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "The inventory records the LLM software, services, and systems the organization operates." }, { "taxonomy_id": "PNX-LLM-AM-01", "security_concern": "AI Asset Inventory", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "csf_identifier": "ID.AM-05", "mapping_rationale": "Inventoried AI systems are prioritized by classification and criticality." }, { "taxonomy_id": "PNX-LLM-AM-01", "security_concern": "AI Asset Inventory", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Systems, hardware, software, services, and data are managed throughout their life cycles", "csf_identifier": "ID.AM-08", "mapping_rationale": "AI systems are tracked through addition, change, and retirement." }, { "taxonomy_id": "PNX-LLM-AM-02", "security_concern": "Model Endpoint Discovery", "taxonomy_category": "Asset Management", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "Enumerated model endpoints are recorded as part of the system inventory." }, { "taxonomy_id": "PNX-LLM-AM-02", "security_concern": "Model Endpoint Discovery", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Representations of the organization's authorized network communication and internal and external network data flows are maintained", "csf_identifier": "ID.AM-03", "mapping_rationale": "Endpoint discovery documents the data flows between applications and models." }, { "taxonomy_id": "PNX-LLM-AM-02", "security_concern": "Model Endpoint Discovery", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "csf_identifier": "ID.RA-01", "mapping_rationale": "Unmanaged or stale endpoints are recorded as exposure to be assessed." }, { "taxonomy_id": "PNX-LLM-AM-03", "security_concern": "External Model Service Identification", "taxonomy_category": "Asset Management", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of services provided by suppliers are maintained", "csf_identifier": "ID.AM-04", "mapping_rationale": "External model providers are recorded as services provided by suppliers." }, { "taxonomy_id": "PNX-LLM-AM-03", "security_concern": "External Model Service Identification", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "Suppliers are known and prioritized by criticality", "csf_identifier": "GV.SC-04", "mapping_rationale": "Model providers are identified as suppliers and prioritized by criticality." }, { "taxonomy_id": "PNX-LLM-AM-03", "security_concern": "External Model Service Identification", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "Provider integrations are reflected in the system inventory." }, { "taxonomy_id": "PNX-LLM-AM-04", "security_concern": "Shadow AI Identification", "taxonomy_category": "Asset Management", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "Identified but unmanaged AI integrations are added to the software and service inventory." }, { "taxonomy_id": "PNX-LLM-AM-04", "security_concern": "Shadow AI Identification", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Runtime and endpoint monitoring surfaces model integrations that discovery missed." }, { "taxonomy_id": "PNX-LLM-AM-04", "security_concern": "Shadow AI Identification", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of services provided by suppliers are maintained", "csf_identifier": "ID.AM-04", "mapping_rationale": "External AI services found through discovery are recorded as supplier services." }, { "taxonomy_id": "PNX-LLM-AM-05", "security_concern": "AI Dependency Inventory", "taxonomy_category": "Asset Management", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "AI system dependencies are recorded within the software inventory." }, { "taxonomy_id": "PNX-LLM-AM-05", "security_concern": "AI Dependency Inventory", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "Suppliers are known and prioritized by criticality", "csf_identifier": "GV.SC-04", "mapping_rationale": "Component suppliers are identified and prioritized by criticality." }, { "taxonomy_id": "PNX-LLM-AM-05", "security_concern": "AI Dependency Inventory", "taxonomy_category": "Asset Management", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "csf_identifier": "ID.RA-09", "mapping_rationale": "Component authenticity and integrity are assessed before use." }, { "taxonomy_id": "PNX-LLM-RA-01", "security_concern": "LLM Application Risk Assessment", "taxonomy_category": "Risk Assessment", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "csf_identifier": "ID.RA-05", "mapping_rationale": "Threats, impacts, and likelihoods are combined into an inherent risk determination for the application." }, { "taxonomy_id": "PNX-LLM-RA-01", "security_concern": "LLM Application Risk Assessment", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Internal and external threats to the organization are identified and recorded", "csf_identifier": "ID.RA-03", "mapping_rationale": "Threats to the application are identified and recorded." }, { "taxonomy_id": "PNX-LLM-RA-01", "security_concern": "LLM Application Risk Assessment", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "csf_identifier": "ID.RA-04", "mapping_rationale": "Impacts and likelihoods of identified threats are recorded." }, { "taxonomy_id": "PNX-LLM-RA-02", "security_concern": "Model Endpoint Exposure", "taxonomy_category": "Risk Assessment", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "csf_identifier": "ID.RA-01", "mapping_rationale": "Endpoint exposure conditions are identified, validated, and recorded as vulnerabilities." }, { "taxonomy_id": "PNX-LLM-RA-02", "security_concern": "Model Endpoint Exposure", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least-privilege access permissions govern which callers may use the endpoint." }, { "taxonomy_id": "PNX-LLM-RA-02", "security_concern": "Model Endpoint Exposure", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Technology Infrastructure Resilience", "csf_subcategory": "Networks and environments are protected from unauthorized logical access and usage", "csf_identifier": "PR.IR-01", "mapping_rationale": "The environment hosting the endpoint is protected from unauthorized logical access." }, { "taxonomy_id": "PNX-LLM-RA-03", "security_concern": "AI Attack Path Analysis", "taxonomy_category": "Risk Assessment", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "csf_identifier": "ID.RA-04", "mapping_rationale": "The impact and likelihood of threats traversing an identified path are recorded." }, { "taxonomy_id": "PNX-LLM-RA-03", "security_concern": "AI Attack Path Analysis", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Internal and external threats to the organization are identified and recorded", "csf_identifier": "ID.RA-03", "mapping_rationale": "The threats that could traverse the path are identified." }, { "taxonomy_id": "PNX-LLM-RA-03", "security_concern": "AI Attack Path Analysis", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "csf_identifier": "ID.RA-05", "mapping_rationale": "Path analysis informs inherent risk and response prioritization." }, { "taxonomy_id": "PNX-LLM-RA-04", "security_concern": "Agent Capability Risk", "taxonomy_category": "Risk Assessment", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "csf_identifier": "ID.RA-05", "mapping_rationale": "Agent capability is combined with impact and likelihood into a risk determination." }, { "taxonomy_id": "PNX-LLM-RA-04", "security_concern": "Agent Capability Risk", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege bounds the operations an agent can perform." }, { "taxonomy_id": "PNX-LLM-RA-04", "security_concern": "Agent Capability Risk", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "csf_identifier": "ID.RA-04", "mapping_rationale": "The impact of an over-capable agent is recorded." }, { "taxonomy_id": "PNX-LLM-RA-05", "security_concern": "AI Supply Chain Risk", "taxonomy_category": "Risk Assessment", "relationship_type": "primary", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship", "csf_identifier": "GV.SC-07", "mapping_rationale": "Supplier and component risk is understood, assessed, and monitored over the relationship." }, { "taxonomy_id": "PNX-LLM-RA-05", "security_concern": "AI Supply Chain Risk", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "csf_identifier": "ID.RA-09", "mapping_rationale": "Component authenticity and integrity are assessed before use." }, { "taxonomy_id": "PNX-LLM-RA-05", "security_concern": "AI Supply Chain Risk", "taxonomy_category": "Risk Assessment", "relationship_type": "supporting", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "Suppliers are known and prioritized by criticality", "csf_identifier": "GV.SC-04", "mapping_rationale": "AI suppliers are identified and prioritized by criticality." }, { "taxonomy_id": "PNX-LLM-PR-01", "security_concern": "Direct Prompt Injection", "taxonomy_category": "Prompt Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The integrity of the in-use instruction and context data is protected against manipulation." }, { "taxonomy_id": "PNX-LLM-PR-01", "security_concern": "Direct Prompt Injection", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "csf_identifier": "ID.RA-01", "mapping_rationale": "Injection susceptibility is identified and recorded through testing." }, { "taxonomy_id": "PNX-LLM-PR-01", "security_concern": "Direct Prompt Injection", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Runtime monitoring detects prompt manipulation attempts." }, { "taxonomy_id": "PNX-LLM-PR-02", "security_concern": "Indirect Prompt Injection", "taxonomy_category": "Prompt Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The integrity of in-use context is protected when untrusted content enters it." }, { "taxonomy_id": "PNX-LLM-PR-02", "security_concern": "Indirect Prompt Injection", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The integrity of stored source content is protected." }, { "taxonomy_id": "PNX-LLM-PR-02", "security_concern": "Indirect Prompt Injection", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Runtime monitoring detects manipulation introduced through content." }, { "taxonomy_id": "PNX-LLM-PR-03", "security_concern": "System Prompt Exposure", "taxonomy_category": "Prompt Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The confidentiality of in-use application context is protected." }, { "taxonomy_id": "PNX-LLM-PR-03", "security_concern": "System Prompt Exposure", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Vulnerabilities in assets are identified, validated, and recorded", "csf_identifier": "ID.RA-01", "mapping_rationale": "Disclosure and inference paths are identified through testing." }, { "taxonomy_id": "PNX-LLM-PR-03", "security_concern": "System Prompt Exposure", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Runtime monitoring detects extraction attempts." }, { "taxonomy_id": "PNX-LLM-PR-04", "security_concern": "Prompt Control Bypass", "taxonomy_category": "Prompt Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The integrity of the in-use control context is protected against circumvention." }, { "taxonomy_id": "PNX-LLM-PR-04", "security_concern": "Prompt Control Bypass", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle", "csf_identifier": "PR.PS-06", "mapping_rationale": "Application controls are built and maintained through secure development practices." }, { "taxonomy_id": "PNX-LLM-PR-04", "security_concern": "Prompt Control Bypass", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Improvement", "csf_subcategory": "Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties", "csf_identifier": "ID.IM-02", "mapping_rationale": "Bypass findings from testing drive control improvement." }, { "taxonomy_id": "PNX-LLM-PR-05", "security_concern": "Cross-Context Prompt Manipulation", "taxonomy_category": "Prompt Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The confidentiality and integrity of in-use context are preserved across boundaries." }, { "taxonomy_id": "PNX-LLM-PR-05", "security_concern": "Cross-Context Prompt Manipulation", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Separation of duties and least privilege enforce tenant and session boundaries." }, { "taxonomy_id": "PNX-LLM-PR-05", "security_concern": "Cross-Context Prompt Manipulation", "taxonomy_category": "Prompt Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Runtime monitoring detects cross-context access." }, { "taxonomy_id": "PNX-LLM-DS-01", "security_concern": "Sensitive Data in Prompts", "taxonomy_category": "Data Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-transit are protected", "csf_identifier": "PR.DS-02", "mapping_rationale": "The confidentiality of sensitive data in transit to the model is protected." }, { "taxonomy_id": "PNX-LLM-DS-01", "security_concern": "Sensitive Data in Prompts", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The data is protected while in use during inference." }, { "taxonomy_id": "PNX-LLM-DS-01", "security_concern": "Sensitive Data in Prompts", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of data and corresponding metadata for designated data types are maintained", "csf_identifier": "ID.AM-07", "mapping_rationale": "The data types reaching prompts are inventoried." }, { "taxonomy_id": "PNX-LLM-DS-02", "security_concern": "Sensitive Data in Model Responses", "taxonomy_category": "Data Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-transit are protected", "csf_identifier": "PR.DS-02", "mapping_rationale": "The confidentiality of sensitive data returned in responses is protected in transit." }, { "taxonomy_id": "PNX-LLM-DS-02", "security_concern": "Sensitive Data in Model Responses", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "Response data is protected while in use by downstream processing." }, { "taxonomy_id": "PNX-LLM-DS-02", "security_concern": "Sensitive Data in Model Responses", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Response monitoring detects disclosure of sensitive data." }, { "taxonomy_id": "PNX-LLM-DS-03", "security_concern": "Prompt and Response Retention Exposure", "taxonomy_category": "Data Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The confidentiality and integrity of retained prompt and response data at rest are protected." }, { "taxonomy_id": "PNX-LLM-DS-03", "security_concern": "Prompt and Response Retention Exposure", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Access to retained content is governed by least privilege." }, { "taxonomy_id": "PNX-LLM-DS-03", "security_concern": "Prompt and Response Retention Exposure", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of data and corresponding metadata for designated data types are maintained", "csf_identifier": "ID.AM-07", "mapping_rationale": "Retained data types are inventoried." }, { "taxonomy_id": "PNX-LLM-DS-04", "security_concern": "External Model Data Transfer", "taxonomy_category": "Data Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-transit are protected", "csf_identifier": "PR.DS-02", "mapping_rationale": "The confidentiality of data in transit to external providers is protected." }, { "taxonomy_id": "PNX-LLM-DS-04", "security_concern": "External Model Data Transfer", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties", "csf_identifier": "GV.SC-05", "mapping_rationale": "Data handling requirements are integrated into provider agreements." }, { "taxonomy_id": "PNX-LLM-DS-04", "security_concern": "External Model Data Transfer", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship", "csf_identifier": "GV.SC-07", "mapping_rationale": "Provider data risk is assessed and monitored over the relationship." }, { "taxonomy_id": "PNX-LLM-DS-05", "security_concern": "AI Logging Data Exposure", "taxonomy_category": "Data Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The confidentiality of sensitive data at rest in logs is protected." }, { "taxonomy_id": "PNX-LLM-DS-05", "security_concern": "AI Logging Data Exposure", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Log records are generated and made available for continuous monitoring", "csf_identifier": "PR.PS-04", "mapping_rationale": "Log records are generated and made available for monitoring without exposing sensitive content." }, { "taxonomy_id": "PNX-LLM-DS-05", "security_concern": "AI Logging Data Exposure", "taxonomy_category": "Data Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Access to logs is governed by least privilege." }, { "taxonomy_id": "PNX-LLM-RAG-01", "security_concern": "RAG Data Source Inventory", "taxonomy_category": "RAG Security", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of data and corresponding metadata for designated data types are maintained", "csf_identifier": "ID.AM-07", "mapping_rationale": "Indexed data sources and their content types are inventoried." }, { "taxonomy_id": "PNX-LLM-RAG-01", "security_concern": "RAG Data Source Inventory", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "The retrieval systems themselves are inventoried." }, { "taxonomy_id": "PNX-LLM-RAG-01", "security_concern": "RAG Data Source Inventory", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "csf_identifier": "ID.AM-05", "mapping_rationale": "Sources are prioritized by classification and criticality." }, { "taxonomy_id": "PNX-LLM-RAG-02", "security_concern": "Retrieval Authorization Exposure", "taxonomy_category": "RAG Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least-privilege access permissions govern what retrieval returns to a requester." }, { "taxonomy_id": "PNX-LLM-RAG-02", "security_concern": "Retrieval Authorization Exposure", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The confidentiality of stored source content is protected." }, { "taxonomy_id": "PNX-LLM-RAG-02", "security_concern": "Retrieval Authorization Exposure", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "csf_identifier": "ID.AM-05", "mapping_rationale": "Source classification informs authorization decisions." }, { "taxonomy_id": "PNX-LLM-RAG-03", "security_concern": "RAG Poisoning", "taxonomy_category": "RAG Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The integrity of indexed content at rest is protected." }, { "taxonomy_id": "PNX-LLM-RAG-03", "security_concern": "RAG Poisoning", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Content and index changes are monitored for adverse modification." }, { "taxonomy_id": "PNX-LLM-RAG-03", "security_concern": "RAG Poisoning", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "Poisoned content is treated as untrusted when it enters the model context." }, { "taxonomy_id": "PNX-LLM-RAG-04", "security_concern": "Untrusted Retrieved Content", "taxonomy_category": "RAG Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The integrity of the in-use context is protected when untrusted content enters it." }, { "taxonomy_id": "PNX-LLM-RAG-04", "security_concern": "Untrusted Retrieved Content", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The integrity of the underlying stored content is protected." }, { "taxonomy_id": "PNX-LLM-RAG-04", "security_concern": "Untrusted Retrieved Content", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Runtime monitoring detects manipulation through retrieved content." }, { "taxonomy_id": "PNX-LLM-RAG-05", "security_concern": "Vector Store Exposure", "taxonomy_category": "RAG Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-at-rest are protected", "csf_identifier": "PR.DS-01", "mapping_rationale": "The confidentiality and integrity of stored embeddings and metadata are protected." }, { "taxonomy_id": "PNX-LLM-RAG-05", "security_concern": "Vector Store Exposure", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least-privilege access governs read and write to the store." }, { "taxonomy_id": "PNX-LLM-RAG-05", "security_concern": "Vector Store Exposure", "taxonomy_category": "RAG Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Technology Infrastructure Resilience", "csf_subcategory": "Networks and environments are protected from unauthorized logical access and usage", "csf_identifier": "PR.IR-01", "mapping_rationale": "The network environment hosting the store is protected from unauthorized access." }, { "taxonomy_id": "PNX-LLM-MCP-01", "security_concern": "MCP Server Inventory", "taxonomy_category": "MCP Security", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "Connected MCP servers are recorded within the system inventory." }, { "taxonomy_id": "PNX-LLM-MCP-01", "security_concern": "MCP Server Inventory", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of services provided by suppliers are maintained", "csf_identifier": "ID.AM-04", "mapping_rationale": "External MCP servers are recorded as supplier services." }, { "taxonomy_id": "PNX-LLM-MCP-01", "security_concern": "MCP Server Inventory", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "csf_identifier": "ID.AM-05", "mapping_rationale": "Servers are prioritized by the sensitivity of the operations they expose." }, { "taxonomy_id": "PNX-LLM-MCP-02", "security_concern": "MCP Server Authentication", "taxonomy_category": "MCP Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Users, services, and hardware are authenticated", "csf_identifier": "PR.AA-03", "mapping_rationale": "MCP servers and connecting clients are authenticated." }, { "taxonomy_id": "PNX-LLM-MCP-02", "security_concern": "MCP Server Authentication", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "csf_identifier": "PR.AA-01", "mapping_rationale": "The credentials used for MCP connections are managed." }, { "taxonomy_id": "PNX-LLM-MCP-02", "security_concern": "MCP Server Authentication", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Identity assertions are protected, conveyed, and verified", "csf_identifier": "PR.AA-04", "mapping_rationale": "Identity assertions between client and server are protected and verified." }, { "taxonomy_id": "PNX-LLM-MCP-03", "security_concern": "MCP Tool Permission Exposure", "taxonomy_category": "MCP Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege and separation of duties bound the operations reachable through a tool." }, { "taxonomy_id": "PNX-LLM-MCP-03", "security_concern": "MCP Tool Permission Exposure", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "Tool definitions and their capabilities are inventoried." }, { "taxonomy_id": "PNX-LLM-MCP-03", "security_concern": "MCP Tool Permission Exposure", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Configuration management practices are established and applied", "csf_identifier": "PR.PS-01", "mapping_rationale": "Tool permission configuration is managed as configuration." }, { "taxonomy_id": "PNX-LLM-MCP-04", "security_concern": "Untrusted MCP Server Connection", "taxonomy_category": "MCP Security", "relationship_type": "primary", "csf_function": "Govern", "csf_category": "Cybersecurity Supply Chain Risk Management", "csf_subcategory": "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships", "csf_identifier": "GV.SC-06", "mapping_rationale": "Due diligence is performed before entering into a connection with a third-party server." }, { "taxonomy_id": "PNX-LLM-MCP-04", "security_concern": "Untrusted MCP Server Connection", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", "csf_identifier": "ID.RA-09", "mapping_rationale": "The authenticity and integrity of the server are assessed before use." }, { "taxonomy_id": "PNX-LLM-MCP-05", "security_concern": "MCP Tool Input Manipulation", "taxonomy_category": "MCP Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Data Security", "csf_subcategory": "The confidentiality, integrity, and availability of data-in-use are protected", "csf_identifier": "PR.DS-10", "mapping_rationale": "The integrity of in-use tool invocation data is protected against manipulation." }, { "taxonomy_id": "PNX-LLM-MCP-05", "security_concern": "MCP Tool Input Manipulation", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege bounds the operations a manipulated call can reach." }, { "taxonomy_id": "PNX-LLM-MCP-05", "security_concern": "MCP Tool Input Manipulation", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Tool invocations are monitored for manipulation." }, { "taxonomy_id": "PNX-LLM-MCP-06", "security_concern": "MCP Capability Change Detection", "taxonomy_category": "MCP Security", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "The runtime capability exposed by MCP servers is monitored for change." }, { "taxonomy_id": "PNX-LLM-MCP-06", "security_concern": "MCP Capability Change Detection", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "csf_identifier": "ID.RA-07", "mapping_rationale": "Capability changes are managed and assessed for risk impact." }, { "taxonomy_id": "PNX-LLM-MCP-06", "security_concern": "MCP Capability Change Detection", "taxonomy_category": "MCP Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Configuration management practices are established and applied", "csf_identifier": "PR.PS-01", "mapping_rationale": "Approved capability is maintained as a configuration baseline." }, { "taxonomy_id": "PNX-LLM-AG-01", "security_concern": "Agent Tool Inventory", "taxonomy_category": "Agent Security", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Inventories of software, services, and systems managed by the organization are maintained", "csf_identifier": "ID.AM-02", "mapping_rationale": "Agent tools are inventoried within the system inventory." }, { "taxonomy_id": "PNX-LLM-AG-01", "security_concern": "Agent Tool Inventory", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Asset Management", "csf_subcategory": "Assets are prioritized based on classification, criticality, resources, and impact on the mission", "csf_identifier": "ID.AM-05", "mapping_rationale": "Tools are prioritized by the sensitivity of the operations they expose." }, { "taxonomy_id": "PNX-LLM-AG-01", "security_concern": "Agent Tool Inventory", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Tool availability is assessed against least-privilege boundaries." }, { "taxonomy_id": "PNX-LLM-AG-02", "security_concern": "Unsafe Tool Execution", "taxonomy_category": "Agent Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege and separation of duties bound the operations an agent can execute." }, { "taxonomy_id": "PNX-LLM-AG-02", "security_concern": "Unsafe Tool Execution", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Agent execution is monitored for unsafe operations." }, { "taxonomy_id": "PNX-LLM-AG-03", "security_concern": "Excessive Agent Permissions", "taxonomy_category": "Agent Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege scopes agent permissions to required operations." }, { "taxonomy_id": "PNX-LLM-AG-03", "security_concern": "Excessive Agent Permissions", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "csf_identifier": "PR.AA-01", "mapping_rationale": "Agent identities and credentials are managed." }, { "taxonomy_id": "PNX-LLM-AG-03", "security_concern": "Excessive Agent Permissions", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization", "csf_identifier": "ID.RA-05", "mapping_rationale": "The risk of excess permission is assessed." }, { "taxonomy_id": "PNX-LLM-AG-04", "security_concern": "Unbounded Agent Action", "taxonomy_category": "Agent Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege bounds the scope of operations an agent can take." }, { "taxonomy_id": "PNX-LLM-AG-04", "security_concern": "Unbounded Agent Action", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Agent action volume and scope are monitored." }, { "taxonomy_id": "PNX-LLM-AG-04", "security_concern": "Unbounded Agent Action", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Technology Infrastructure Resilience", "csf_subcategory": "Adequate resource capacity to ensure availability is maintained", "csf_identifier": "PR.IR-04", "mapping_rationale": "Resource capacity controls limit consumption from unbounded action." }, { "taxonomy_id": "PNX-LLM-AG-05", "security_concern": "Agent Identity and Authentication", "taxonomy_category": "Agent Security", "relationship_type": "primary", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "csf_identifier": "PR.AA-01", "mapping_rationale": "Agent identities and credentials are managed." }, { "taxonomy_id": "PNX-LLM-AG-05", "security_concern": "Agent Identity and Authentication", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Users, services, and hardware are authenticated", "csf_identifier": "PR.AA-03", "mapping_rationale": "Agents are authenticated to the systems they reach." }, { "taxonomy_id": "PNX-LLM-AG-05", "security_concern": "Agent Identity and Authentication", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Distinct identities enable least-privilege access control." }, { "taxonomy_id": "PNX-LLM-AG-06", "security_concern": "Cross-System Agent Attack Path", "taxonomy_category": "Agent Security", "relationship_type": "primary", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded", "csf_identifier": "ID.RA-04", "mapping_rationale": "The impact and likelihood of an agent path reaching a consequential operation are recorded." }, { "taxonomy_id": "PNX-LLM-AG-06", "security_concern": "Cross-System Agent Attack Path", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Least privilege on the execution identity limits the reachable operation." }, { "taxonomy_id": "PNX-LLM-AG-06", "security_concern": "Cross-System Agent Attack Path", "taxonomy_category": "Agent Security", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Information is correlated from multiple sources", "csf_identifier": "DE.AE-03", "mapping_rationale": "Correlation across sources supports identification of multi-step paths." }, { "taxonomy_id": "PNX-LLM-DE-01", "security_concern": "Prompt Attack Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Prompt flows in the runtime environment are monitored for adverse events." }, { "taxonomy_id": "PNX-LLM-DE-01", "security_concern": "Prompt Attack Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "csf_identifier": "DE.AE-02", "mapping_rationale": "Detected prompt events are analyzed to understand associated activity." }, { "taxonomy_id": "PNX-LLM-DE-01", "security_concern": "Prompt Attack Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Networks and network services are monitored to find potentially adverse events", "csf_identifier": "DE.CM-01", "mapping_rationale": "Network monitoring supports observation of model traffic." }, { "taxonomy_id": "PNX-LLM-DE-02", "security_concern": "Model Response Security Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Model responses in the runtime environment are monitored for adverse events." }, { "taxonomy_id": "PNX-LLM-DE-02", "security_concern": "Model Response Security Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "csf_identifier": "DE.AE-02", "mapping_rationale": "Detected response events are analyzed." }, { "taxonomy_id": "PNX-LLM-DE-02", "security_concern": "Model Response Security Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Log records are generated and made available for continuous monitoring", "csf_identifier": "PR.PS-04", "mapping_rationale": "Log records support response monitoring without exposing sensitive content." }, { "taxonomy_id": "PNX-LLM-DE-03", "security_concern": "AI Configuration Change Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "AI configuration changes in the runtime environment are monitored for adverse events." }, { "taxonomy_id": "PNX-LLM-DE-03", "security_concern": "AI Configuration Change Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "csf_identifier": "ID.RA-07", "mapping_rationale": "Configuration changes are managed and assessed for risk impact." }, { "taxonomy_id": "PNX-LLM-DE-03", "security_concern": "AI Configuration Change Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Configuration management practices are established and applied", "csf_identifier": "PR.PS-01", "mapping_rationale": "Configuration baselines support change detection." }, { "taxonomy_id": "PNX-LLM-DE-04", "security_concern": "MCP Capability Change Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "MCP-exposed capability in the runtime environment is monitored for change." }, { "taxonomy_id": "PNX-LLM-DE-04", "security_concern": "MCP Capability Change Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "External service provider activities and services are monitored to find potentially adverse events", "csf_identifier": "DE.CM-06", "mapping_rationale": "External MCP server activity is monitored." }, { "taxonomy_id": "PNX-LLM-DE-04", "security_concern": "MCP Capability Change Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Identify", "csf_category": "Risk Assessment", "csf_subcategory": "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked", "csf_identifier": "ID.RA-07", "mapping_rationale": "Capability changes are managed and assessed for risk impact." }, { "taxonomy_id": "PNX-LLM-DE-05", "security_concern": "Agent Execution Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events", "csf_identifier": "DE.CM-09", "mapping_rationale": "Agent execution in the runtime environment is monitored for adverse events." }, { "taxonomy_id": "PNX-LLM-DE-05", "security_concern": "Agent Execution Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Continuous Monitoring", "csf_subcategory": "Personnel activity and technology usage are monitored to find potentially adverse events", "csf_identifier": "DE.CM-03", "mapping_rationale": "Technology usage monitoring covers agent activity." }, { "taxonomy_id": "PNX-LLM-DE-05", "security_concern": "Agent Execution Monitoring", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "csf_identifier": "DE.AE-02", "mapping_rationale": "Detected agent events are analyzed." }, { "taxonomy_id": "PNX-LLM-DE-06", "security_concern": "AI Security Event Correlation", "taxonomy_category": "Monitoring and Detection", "relationship_type": "primary", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Information is correlated from multiple sources", "csf_identifier": "DE.AE-03", "mapping_rationale": "Information from multiple AI event sources is correlated." }, { "taxonomy_id": "PNX-LLM-DE-06", "security_concern": "AI Security Event Correlation", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "csf_identifier": "DE.AE-02", "mapping_rationale": "Correlated events are analyzed to understand associated activity." }, { "taxonomy_id": "PNX-LLM-DE-06", "security_concern": "AI Security Event Correlation", "taxonomy_category": "Monitoring and Detection", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "The estimated impact and scope of adverse events are understood", "csf_identifier": "DE.AE-04", "mapping_rationale": "The impact and scope of a correlated sequence are understood." }, { "taxonomy_id": "PNX-LLM-RS-01", "security_concern": "AI Security Event Analysis", "taxonomy_category": "Response", "relationship_type": "primary", "csf_function": "Respond", "csf_category": "Incident Analysis", "csf_subcategory": "Analysis is performed to establish what has taken place during an incident and the root cause of the incident", "csf_identifier": "RS.AN-03", "mapping_rationale": "Analysis establishes what took place during the event and the root cause." }, { "taxonomy_id": "PNX-LLM-RS-01", "security_concern": "AI Security Event Analysis", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Detect", "csf_category": "Adverse Event Analysis", "csf_subcategory": "Potentially adverse events are analyzed to better understand associated activities", "csf_identifier": "DE.AE-02", "mapping_rationale": "Prior event analysis feeds the incident analysis." }, { "taxonomy_id": "PNX-LLM-RS-01", "security_concern": "AI Security Event Analysis", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Analysis", "csf_subcategory": "An incident's magnitude is estimated and validated", "csf_identifier": "RS.AN-08", "mapping_rationale": "The magnitude of the event is estimated and validated." }, { "taxonomy_id": "PNX-LLM-RS-02", "security_concern": "Model Endpoint Isolation", "taxonomy_category": "Response", "relationship_type": "primary", "csf_function": "Respond", "csf_category": "Incident Mitigation", "csf_subcategory": "Incidents are contained", "csf_identifier": "RS.MI-01", "mapping_rationale": "Isolating the endpoint contains the incident." }, { "taxonomy_id": "PNX-LLM-RS-02", "security_concern": "Model Endpoint Isolation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Management", "csf_subcategory": "Incidents are categorized and prioritized", "csf_identifier": "RS.MA-03", "mapping_rationale": "Incident categorization and prioritization inform the isolation decision." }, { "taxonomy_id": "PNX-LLM-RS-02", "security_concern": "Model Endpoint Isolation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Access controls provide the mechanism to restrict the endpoint." }, { "taxonomy_id": "PNX-LLM-RS-03", "security_concern": "MCP Connection Revocation", "taxonomy_category": "Response", "relationship_type": "primary", "csf_function": "Respond", "csf_category": "Incident Mitigation", "csf_subcategory": "Incidents are contained", "csf_identifier": "RS.MI-01", "mapping_rationale": "Revoking the connection contains the incident." }, { "taxonomy_id": "PNX-LLM-RS-03", "security_concern": "MCP Connection Revocation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Identities and credentials for authorized users, services, and hardware are managed by the organization", "csf_identifier": "PR.AA-01", "mapping_rationale": "Credential management provides the means to invalidate the associated credentials." }, { "taxonomy_id": "PNX-LLM-RS-03", "security_concern": "MCP Connection Revocation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Mitigation", "csf_subcategory": "Incidents are eradicated", "csf_identifier": "RS.MI-02", "mapping_rationale": "Revocation supports eradication of the reachable capability." }, { "taxonomy_id": "PNX-LLM-RS-04", "security_concern": "Agent Capability Restriction", "taxonomy_category": "Response", "relationship_type": "primary", "csf_function": "Respond", "csf_category": "Incident Mitigation", "csf_subcategory": "Incidents are contained", "csf_identifier": "RS.MI-01", "mapping_rationale": "Restricting agent capability contains the incident." }, { "taxonomy_id": "PNX-LLM-RS-04", "security_concern": "Agent Capability Restriction", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Identity Management, Authentication, and Access Control", "csf_subcategory": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties", "csf_identifier": "PR.AA-05", "mapping_rationale": "Access controls provide the mechanism to restrict capability." }, { "taxonomy_id": "PNX-LLM-RS-04", "security_concern": "Agent Capability Restriction", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Mitigation", "csf_subcategory": "Incidents are eradicated", "csf_identifier": "RS.MI-02", "mapping_rationale": "Restriction supports eradication of the misused capability." }, { "taxonomy_id": "PNX-LLM-RS-05", "security_concern": "Prompt Security Incident Investigation", "taxonomy_category": "Response", "relationship_type": "primary", "csf_function": "Respond", "csf_category": "Incident Analysis", "csf_subcategory": "Analysis is performed to establish what has taken place during an incident and the root cause of the incident", "csf_identifier": "RS.AN-03", "mapping_rationale": "Investigation establishes what took place and the root cause." }, { "taxonomy_id": "PNX-LLM-RS-05", "security_concern": "Prompt Security Incident Investigation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Analysis", "csf_subcategory": "Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved", "csf_identifier": "RS.AN-06", "mapping_rationale": "Investigation actions are recorded with integrity and provenance preserved." }, { "taxonomy_id": "PNX-LLM-RS-05", "security_concern": "Prompt Security Incident Investigation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Management", "csf_subcategory": "Incident reports are triaged and validated", "csf_identifier": "RS.MA-02", "mapping_rationale": "Incident reports are triaged and validated before investigation." }, { "taxonomy_id": "PNX-LLM-RS-06", "security_concern": "AI Security Evidence Preservation", "taxonomy_category": "Response", "relationship_type": "primary", "csf_function": "Respond", "csf_category": "Incident Analysis", "csf_subcategory": "Incident data and metadata are collected, and their integrity and provenance are preserved", "csf_identifier": "RS.AN-07", "mapping_rationale": "Incident data and metadata are collected with integrity and provenance preserved." }, { "taxonomy_id": "PNX-LLM-RS-06", "security_concern": "AI Security Evidence Preservation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Respond", "csf_category": "Incident Analysis", "csf_subcategory": "Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved", "csf_identifier": "RS.AN-06", "mapping_rationale": "Investigation actions are recorded with integrity preserved." }, { "taxonomy_id": "PNX-LLM-RS-06", "security_concern": "AI Security Evidence Preservation", "taxonomy_category": "Response", "relationship_type": "supporting", "csf_function": "Protect", "csf_category": "Platform Security", "csf_subcategory": "Log records are generated and made available for continuous monitoring", "csf_identifier": "PR.PS-04", "mapping_rationale": "Log generation supplies the records preserved as evidence." } ], "assessment_evidence": [ { "category": "Inventory Evidence", "types": [ "Model endpoint inventory", "AI application inventory", "MCP server inventory", "Agent tool inventory", "External model provider inventory", "RAG data source inventory" ], "description": "Records that establish which AI systems, endpoints, tools, and external services exist and who owns them.", "related": [ "PNX-LLM-AM-01", "PNX-LLM-AM-02", "PNX-LLM-AM-03", "PNX-LLM-AM-05", "PNX-LLM-RAG-01", "PNX-LLM-MCP-01", "PNX-LLM-AG-01" ] }, { "category": "Configuration Evidence", "types": [ "Model gateway configuration", "MCP server configuration", "RAG indexing configuration", "Agent policy configuration", "Prompt gateway configuration" ], "description": "Configuration that determines the security boundary of an AI system, independent of its code.", "related": [ "PNX-LLM-RA-02", "PNX-LLM-MCP-03", "PNX-LLM-MCP-06", "PNX-LLM-DE-03", "PNX-LLM-AG-04" ] }, { "category": "Identity Evidence", "types": [ "Service principals", "API identities", "Cloud roles", "MCP service identities", "Agent execution identities" ], "description": "Records of the identities under which AI systems, tools, and agents act, used to assess effective permission.", "related": [ "PNX-LLM-MCP-02", "PNX-LLM-MCP-03", "PNX-LLM-AG-03", "PNX-LLM-AG-05", "PNX-LLM-RAG-02" ] }, { "category": "Network Evidence", "types": [ "Endpoint reachability records", "Network data flow records", "External destination records", "Transport configuration" ], "description": "Records of where AI endpoints and services are reachable from and where organizational data flows.", "related": [ "PNX-LLM-AM-02", "PNX-LLM-RA-02", "PNX-LLM-DS-04", "PNX-LLM-RAG-05" ] }, { "category": "Data Flow Evidence", "types": [ "Prompt data flow records", "Response data flow records", "Retrieval flow records", "Data classification per destination" ], "description": "Records of the data that enters prompts, returns in responses, and moves through retrieval and external transfer.", "related": [ "PNX-LLM-DS-01", "PNX-LLM-DS-02", "PNX-LLM-DS-04", "PNX-LLM-RAG-02", "PNX-LLM-PR-05" ] }, { "category": "Runtime Evidence", "types": [ "Prompt and response security events", "Tool execution records", "Model endpoint requests", "Agent action history", "MCP tool invocation history" ], "description": "Records generated during operation that support detection, correlation, and investigation.", "related": [ "PNX-LLM-DE-01", "PNX-LLM-DE-02", "PNX-LLM-DE-05", "PNX-LLM-MCP-05", "PNX-LLM-AG-02" ] }, { "category": "Logging Evidence", "types": [ "Application log records", "Model gateway logs", "Agent execution logs", "Audit records" ], "description": "Log records generated and made available for monitoring, configured to support detection without exposing sensitive content.", "related": [ "PNX-LLM-DS-03", "PNX-LLM-DS-05", "PNX-LLM-DE-02", "PNX-LLM-RS-06" ] }, { "category": "Change Evidence", "types": [ "Configuration change records", "Capability change records", "Dependency version changes", "Baseline records" ], "description": "Records of changes to AI configuration, capability, and dependencies used to detect boundary changes and drift.", "related": [ "PNX-LLM-DE-03", "PNX-LLM-DE-04", "PNX-LLM-MCP-06", "PNX-LLM-RAG-03" ] }, { "category": "Dependency Evidence", "types": [ "Dependency manifests", "Model artifact provenance", "SDK and framework versions", "Container image contents", "Supplier assessment records" ], "description": "Records of the components and suppliers that compose AI systems, used to assess supply chain risk and integrity.", "related": [ "PNX-LLM-AM-05", "PNX-LLM-RA-05", "PNX-LLM-MCP-04" ] } ], "version_history": [ { "version": "1.0", "date": "2026-07-13", "change": "Initial publication of the LLM security taxonomy and NIST CSF 2.0 mapping." } ], "references": [ { "title": "The NIST Cybersecurity Framework (CSF) 2.0", "publisher": "National Institute of Standards and Technology", "identifier": "NIST CSWP 29", "url": "https://doi.org/10.6028/NIST.CSWP.29", "note": "Source of truth for the CSF 2.0 Functions, Categories, Subcategories, and outcome wording used in this mapping." }, { "title": "NIST Cybersecurity Framework 2.0 Reference Tool", "publisher": "National Institute of Standards and Technology", "identifier": "", "url": "https://csrc.nist.gov/projects/cybersecurity-framework/filters", "note": "Searchable reference for CSF 2.0 Core identifiers." }, { "title": "Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile)", "publisher": "National Institute of Standards and Technology", "identifier": "NIST IR 8596, Initial Preliminary Draft, December 2025", "url": "https://csrc.nist.gov/pubs/ir/8596/iprd", "note": "NIST's preliminary draft profile that organizes AI cybersecurity risk using NIST CSF 2.0 outcomes. Used as a cross-check reference point for the CSF 2.0 relationships in this resource. As an initial preliminary draft, it is subject to change." }, { "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "publisher": "National Institute of Standards and Technology", "identifier": "NIST AI 600-1", "url": "https://doi.org/10.6028/NIST.AI.600-1", "note": "Referenced for generative AI risk context. Not modified by this resource." }, { "title": "OWASP Top 10 for Large Language Model Applications", "publisher": "OWASP Foundation", "identifier": "", "url": "https://genai.owasp.org/", "note": "Referenced for LLM application risk categories." }, { "title": "MITRE ATLAS", "publisher": "MITRE Corporation", "identifier": "", "url": "https://atlas.mitre.org/", "note": "Referenced for adversarial machine learning tactics and techniques." }, { "title": "Model Context Protocol Specification", "publisher": "Model Context Protocol", "identifier": "", "url": "https://modelcontextprotocol.io/", "note": "Referenced for MCP server, tool, and transport definitions." } ] }