Probity Compliance Crosswalk, v1
One signed run, ten lenses. Probity emits one Ed25519-signed evidence object per gate run — the
adversarial-execution-evidence attestation with its catch-record-v1 intercept records and its
sut-provenance. This document
is the crosswalk from that single evidence object to the controls of the compliance frameworks a
regulated buyer must satisfy.
The thesis is one object, many lenses, not ten bespoke integrations. Most frameworks do not require different evidence; they require the same underlying evidence — attributable, tamper-evident behavioral records plus a bill of materials — expressed in their own control language. OSCAL (NIST's machine-readable control format) is the crosswalk spine: NIST 800-53 is OSCAL-native and the other catalogs express into it, so the one signed evidence set reads out as ten OSCAL-crosswalked views.
What Probity emits today (the honesty baseline)
A conforming run emits, today, signed and offline-re-verifiable:
- an
adversarial-execution-evidenceattestation (in-toto Statement, DSSE PAEv1, Ed25519) — the fused pass/degraded/failresultwith per-attackattackResults,containmentObserved, and thenetworkPosturebinding; catch-record-v1intercept records — per-record-signed, RFC-6962 batch-rooted, tamper-evident evidence of each intercepted adversarial technique (surfaced asinterceptRecords);sut-provenance— the integrity-pinned, digest-bound dependency closure (dep_closure_sha256);- a CycloneDX 1.6 ML-BOM (dependency-closure component inventory) and SARIF v2.1.0 findings.
It does not emit, today (these are roadmap and MUST NOT be claimed as present in a bundle):
- an OSCAL assessment-results document — the crosswalk in this doc is the mapping; the OSCAL emitter is roadmap. We emit in-toto/DSSE + SARIF now.
- a per-finding OWASP / SAFE-MCP / MITRE ATLAS taxonomy tag inside any signed predicate. The behavioral catch-records map onto these taxonomies (see below); the tag is a roadmap field. Copy may say "maps onto", never "already carries its ID".
- a notified-body EU AI Act certificate, or per-framework "framework-shaped" artifacts. One signed object crosswalks to the frameworks; framework evidence packs are roadmap.
- the execution-grounded model-weight half of the ML-BOM (the dependency-closure SBOM is built; the model-weight inventory is partial).
The bright line for every consumer of this crosswalk: a verdict's signature is what re-verifies offline; the framework mapping is what this document asserts. Never imply a bundle contains an OSCAL package, a taxonomy tag, or a framework certificate — a visitor who re-verifies a real bundle would falsify it.
The crosswalk
Status legend: emitted = the artifact that satisfies the control is emitted, signed, and
re-verifiable today; partial = the satisfying artifact is partially emitted; pack = the
control mapping is real but ships as an aligned evidence pack (roadmap); tag = the evidence maps
onto the control but the per-finding taxonomy field is roadmap.
| # | Framework | Control(s) | Probity evidence | Status |
|---|---|---|---|---|
| 1 | SOC 2 + AI overlay | TSC CC7.2, CC6.1, CC6.6 | signed evidence + interceptRecords (CC7.2 monitoring / audit-trail); per-run Firecracker microVM (CC6.1/CC6.6 logical-access + isolation boundary) | emitted |
| 2 | ISO/IEC 27001:2022 | A.8.29 (security testing in dev & acceptance); A.8.8 (technical-vulnerability mgmt) | signed adversarial-execution-evidence + payload-bound catch-record chain = acceptance-time security-testing evidence | emitted |
| 3 | EU AI Act Annex IV | Reg. 2024/1689 Art 11, Annex IV §2(g), Art 12 (logging) | interceptRecords + signed evidence (validation/testing logs, Art 12 event logging); AIBOM (§1 system/software description) | pack |
| 4 | NIST 800-53 Rev 5 | AU-10, AU-3, AU-12, CM-8, SR-4 | Ed25519 signature (AU-10 non-repudiation); catch-records (AU-3 content + AU-12 generation); AIBOM (CM-8); sut-provenance (SR-4) | emitted |
| 5 | NIST AI RMF 1.0 | MEASURE 2.7 (security & resilience evaluated and documented) | signed adversarial-test verdict + tamper-evident catch-records. (Does NOT occupy MANAGE / continuous post-deployment monitoring — the gate is point-in-time.) | emitted |
| 6 | ISO/IEC 42001:2023 | Clause 8 (operational control), Annex A | signed evidence + interceptRecords + AIBOM = the operational-control audit records an AIMS audit consumes | emitted |
| 7 | OWASP GenAI Top 10 (LLM / Agentic / MCP) | LLM06 Excessive Agency; LLM02 Sensitive Information Disclosure; LLM03 Supply Chain | catch-records = execution-grounded behavioral-containment evidence (blocked undeclared egress, file-read EPERM, SSRF attempt, captured credential exfil). NOT LLM01 (no prompt-content inspection). | tag |
| 8 | MITRE ATLAS | AML.T0051 (LLM Prompt Injection), AML.T0054 (Jailbreak) | catch-records map onto the intercepted technique | tag |
| 9 | NIST SSDF SP 800-218 (+ 800-218A GenAI profile) | PW.8 (task PW.8.2 — test executable code for vulnerabilities); PS.3 (PS.3.2 — release provenance) | signed gate verdict = the dynamic test report; sut-provenance = release provenance | emitted |
| 10 | CycloneDX 1.6 ML-BOM (ECMA-424) | AI component inventory | AIBOM with first-class MCP-server / A2A-agent / tool components; sut-provenance dependency closure. Model-weight inventory partial. | partial |
Status summary
Six mappings are fully built — the artifact that satisfies the named control is emitted, signed, and offline-re-verifiable today with no new emitter: SOC 2, ISO 27001, NIST 800-53, NIST AI RMF, ISO 42001, NIST SSDF. Four are architecturally-real mapping, emission/tag-roadmap: EU AI Act (aligned pack, not a certificate), CycloneDX ML-BOM (dependency-closure built, model-weight partial), and OWASP GenAI + MITRE ATLAS (behavioral evidence maps onto the taxonomy; the per-finding tag is roadmap). Spanning all ten, the OSCAL assessment-results emitter is roadmap.
Related
adversarial-execution-evidence— the signed evidence the crosswalk reads from.catch-record— the forensic-trace evidence.sut-provenance— the dependency-closure provenance.ml-bom— the AI bill of materials.README— the predicate standard index.