The current mapping file template's control table (Control, ID, Description, Tier, Scope) documents what a control requires, but not how someone verifies it's actually implemented. For this new area of agentic controls, where most practitioners are just gaining their first experience this matters.
I had to address this when building the NPW Agentic AI Control Catalogue - 98 controls for AI agents in production, each with a proposed verification method. Openly licensed CC BY-SA 4.0, so can be used and referenced.
Wanted to raise it as a proposal. Would be happy to draft the schema change and pilot on some controls if it makes sense.
The current mapping file template's control table (Control, ID, Description, Tier, Scope) documents what a control requires, but not how someone verifies it's actually implemented. For this new area of agentic controls, where most practitioners are just gaining their first experience this matters.
I had to address this when building the NPW Agentic AI Control Catalogue - 98 controls for AI agents in production, each with a proposed verification method. Openly licensed CC BY-SA 4.0, so can be used and referenced.
Wanted to raise it as a proposal. Would be happy to draft the schema change and pilot on some controls if it makes sense.