# Probity Compliance Crosswalk, v1

One signed run, ten lenses. Probity emits **one** Ed25519-signed evidence object per gate run — the
`adversarial-execution-evidence` attestation with its `catch-record-v1` intercept records and its
`sut-provenance`. This document
is the crosswalk from that single evidence object to the controls of the compliance frameworks a
regulated buyer must satisfy.

The thesis is **one object, many lenses**, not ten bespoke integrations. Most frameworks do not require
*different* evidence; they require the **same** underlying evidence — attributable, tamper-evident
behavioral records plus a bill of materials — expressed in their own control language. OSCAL
(NIST's machine-readable control format) is the crosswalk **spine**: NIST 800-53 is OSCAL-native and
the other catalogs express into it, so the one signed evidence set reads out as ten OSCAL-crosswalked
views.

## What Probity emits today (the honesty baseline)

A conforming run emits, **today**, signed and offline-re-verifiable:

- an `adversarial-execution-evidence` attestation (in-toto Statement, DSSE PAEv1, Ed25519) — the
  fused pass/degraded/fail `result` with per-attack `attackResults`, `containmentObserved`, and the
  `networkPosture` binding;
- `catch-record-v1` intercept records — per-record-signed, RFC-6962 batch-rooted, tamper-evident
  evidence of each intercepted adversarial technique (surfaced as `interceptRecords`);
- `sut-provenance` — the integrity-pinned, digest-bound dependency closure (`dep_closure_sha256`);
- a CycloneDX 1.6 ML-BOM (dependency-closure component inventory) and SARIF v2.1.0 findings.

It does **not** emit, today (these are roadmap and MUST NOT be claimed as present in a bundle):

- an **OSCAL** assessment-results document — the crosswalk in this doc is the mapping; the OSCAL
  emitter is roadmap. We emit in-toto/DSSE + SARIF now.
- a per-finding **OWASP / SAFE-MCP / MITRE ATLAS taxonomy tag** inside any signed predicate. The
  behavioral catch-records *map onto* these taxonomies (see below); the tag is a roadmap field. Copy
  may say "maps onto", never "already carries its ID".
- a notified-body **EU AI Act** certificate, or per-framework "framework-shaped" artifacts. One signed
  object crosswalks to the frameworks; framework evidence **packs** are roadmap.
- the execution-grounded **model-weight** half of the ML-BOM (the dependency-closure SBOM is built;
  the model-weight inventory is partial).

The bright line for every consumer of this crosswalk: a verdict's **signature** is what re-verifies
offline; the framework mapping is what this document asserts. Never imply a bundle *contains* an OSCAL
package, a taxonomy tag, or a framework certificate — a visitor who re-verifies a real bundle would
falsify it.

## The crosswalk

`Status` legend: **emitted** = the artifact that satisfies the control is emitted, signed, and
re-verifiable today; **partial** = the satisfying artifact is partially emitted; **pack** = the
control mapping is real but ships as an aligned evidence pack (roadmap); **tag** = the evidence maps
onto the control but the per-finding taxonomy field is roadmap.

| # | Framework | Control(s) | Probity evidence | Status |
|---|-----------|-----------|------------------|--------|
| 1 | SOC 2 + AI overlay | TSC CC7.2, CC6.1, CC6.6 | signed evidence + interceptRecords (CC7.2 monitoring / audit-trail); per-run Firecracker microVM (CC6.1/CC6.6 logical-access + isolation boundary) | emitted |
| 2 | ISO/IEC 27001:2022 | A.8.29 (security testing in dev & acceptance); A.8.8 (technical-vulnerability mgmt) | signed adversarial-execution-evidence + payload-bound catch-record chain = acceptance-time security-testing evidence | emitted |
| 3 | EU AI Act Annex IV | Reg. 2024/1689 Art 11, Annex IV §2(g), Art 12 (logging) | interceptRecords + signed evidence (validation/testing logs, Art 12 event logging); AIBOM (§1 system/software description) | pack |
| 4 | NIST 800-53 Rev 5 | AU-10, AU-3, AU-12, CM-8, SR-4 | Ed25519 signature (AU-10 non-repudiation); catch-records (AU-3 content + AU-12 generation); AIBOM (CM-8); sut-provenance (SR-4) | emitted |
| 5 | NIST AI RMF 1.0 | MEASURE 2.7 (security & resilience evaluated and documented) | signed adversarial-test verdict + tamper-evident catch-records. (Does NOT occupy MANAGE / continuous post-deployment monitoring — the gate is point-in-time.) | emitted |
| 6 | ISO/IEC 42001:2023 | Clause 8 (operational control), Annex A | signed evidence + interceptRecords + AIBOM = the operational-control audit records an AIMS audit consumes | emitted |
| 7 | OWASP GenAI Top 10 (LLM / Agentic / MCP) | LLM06 Excessive Agency; LLM02 Sensitive Information Disclosure; LLM03 Supply Chain | catch-records = execution-grounded behavioral-containment evidence (blocked undeclared egress, file-read EPERM, SSRF attempt, captured credential exfil). NOT LLM01 (no prompt-content inspection). | tag |
| 8 | MITRE ATLAS | AML.T0051 (LLM Prompt Injection), AML.T0054 (Jailbreak) | catch-records map onto the intercepted technique | tag |
| 9 | NIST SSDF SP 800-218 (+ 800-218A GenAI profile) | PW.8 (task PW.8.2 — test executable code for vulnerabilities); PS.3 (PS.3.2 — release provenance) | signed gate verdict = the dynamic test report; sut-provenance = release provenance | emitted |
| 10 | CycloneDX 1.6 ML-BOM (ECMA-424) | AI component inventory | AIBOM with first-class MCP-server / A2A-agent / tool components; sut-provenance dependency closure. Model-weight inventory partial. | partial |

## Status summary

Six mappings are **fully built** — the artifact that satisfies the named control is emitted, signed,
and offline-re-verifiable today with no new emitter: SOC 2, ISO 27001, NIST 800-53, NIST AI RMF,
ISO 42001, NIST SSDF. Four are **architecturally-real mapping, emission/tag-roadmap**: EU AI Act
(aligned pack, not a certificate), CycloneDX ML-BOM (dependency-closure built, model-weight partial),
and OWASP GenAI + MITRE ATLAS (behavioral evidence maps onto the taxonomy; the per-finding tag is
roadmap). Spanning all ten, the OSCAL assessment-results emitter is roadmap.

## Related

- [`adversarial-execution-evidence`](adversarial-execution-evidence.md) — the signed evidence the crosswalk reads from.
- [`catch-record`](catch-record.md) — the forensic-trace evidence.
- [`sut-provenance`](sut-provenance.md) — the dependency-closure provenance.
- [`ml-bom`](ml-bom.md) — the AI bill of materials.
- [`README`](README.md) — the predicate standard index.