Framework crosswalks
In short: These crosswalks show which of the 24 register controls support six frameworks. They are the EU AI Act, NIST AI RMF, ISO/IEC 42001, NIST NCCoE agent identity work, SOC 2 and the OWASP Agentic Top 10. We map only where official text we opened supports it, and each page lists what we left out.
Which frameworks are covered?
| Framework | Mapped controls | Scope |
|---|---|---|
| EU AI Act | 5 | These duties apply to high-risk AI systems as the Act defines them. An agent is not high-risk by default; it depends on its use case. |
| NIST AI RMF | 7 | Voluntary framework. Mappings below are at function level only. |
| ISO/IEC 42001 | 0 | Certifiable management system standard. The full text is not public. |
| NIST NCCoE agent identity | 2 | Project scope as described on nist.gov. No final guidance has been published. |
| SOC 2 | 0 | Attestation framework. Criteria text requires an AICPA account. |
| OWASP Agentic Top 10 | 4 | Risk list, not a control standard. Mappings show which controls reduce which risk. |