PROVENANCE AND MAPPING
Reference sources
Exact releases and distinct roles of the frameworks. Mapping is a selection, not a substitute for the entire standard.
OWASP Application Security Verification Standard
5.0.0
Selected application security requirements. Do not assign an ASVS level to an entire system based on this subset.
Authoritative source ↗License CC-BY-SA-4.0. AI CORE includes identified methodological adaptations and partial mappings.
OWASP AI Security Verification Standard
1.0
Selected AI and agent requirements. The chosen version is pinned; no claim is made that it is the latest release.
Authoritative source ↗License CC-BY-SA-4.0. AI CORE includes identified methodological adaptations and partial mappings.
NIST AI Risk Management Framework
1.0, NIST AI 100-1, January 2023
Context for risks, assessment scope, independence and remediation; not a certification scheme.
Authoritative source ↗W3C PROV-O
W3C Recommendation 30 April 2013
Conceptual provenance reference. This neither changes AI CORE v2.0 nor automatically makes it a PROV-O ontology.
Authoritative source ↗NIST OSCAL Assessment Results Model
Concept documentation, page updated 2025-03-03, accessed 2026-11-15
Conceptual separation of plans, observations, evidence and findings. AI CORE JSON is not OSCAL. A production OSCAL export is not provided.
Authoritative source ↗Additional professional and technical references
- OWASP Top 10 for Agentic Applications 2026 — supplementary risk taxonomy; not a test plan by itself.
- EU Regulation 2024/1689 (AI Act) — legal framework; specific applicability is assessed separately.
- JSON-LD 1.1 — linked data format.
- JSON Schema 2020-12 — formal record structure.
- W3C Data on the Web Best Practices — stable identifiers, metadata and versions.
No cited organization thereby confirms a system's security, endorses this profile or establishes a partnership with AI CORE.