Risk framework
NIST ↗
Use the AI RMF to organize decisions, responsibilities, and evidence across the lifecycle.
Read the source guide →Knowledge hub / THE SOURCE LIBRARY
THE SOURCE LIBRARY
Know the source. Understand its purpose.
Frameworks, standards, threat knowledge, regulatory guidance, and testing resources have different jobs. Here is how to find the right one.
These resources complement each other.
NIST can organize a risk discussion. MITRE can help describe a threat path. OWASP can inform a technical check. CSA can help frame control responsibilities. None of those relationships removes the need to examine scope, context, and actual evidence.
Threat knowledge
MITRE ATLAS ↗
Use tactics, techniques, and case studies to make AI threat discussions concrete.
Read the source guide →Application security
OWASP ↗
Move from a memorable risk name to the application boundary that needs protection.
Read the source guide →Control framework
Cloud Security Alliance ↗
The AI Controls Matrix helps structure conversations about ownership, implementation, and assurance.
Read the source guide →Management-system standards
ISO / IEC ↗
Understand the role of an AI management system without confusing it with a guarantee about every model output.
Read the source guide →Cybersecurity guidance
ENISA ↗
Connect cybersecurity foundations, AI-specific concerns, and the environment in which a system operates.
Read the source guide →Secure development
NCSC / CISA ↗
Treat design, development, deployment, and ongoing operation as connected security responsibilities.
Read the source guide →Trustworthy AI principles
OECD ↗
Use principles to frame the questions an organization should answer, then turn those questions into practice.
Read the source guide →Research taxonomy
MIT AI Risk Repository ↗
Use a research-backed risk library to challenge blind spots in your own assessment.
Read the source guide →Privacy guidance
UK ICO ↗
Learn how data-protection questions appear throughout an AI workflow.
Read the source guide →Testing and assurance
AI Verify Foundation ↗
Explore tools, testing frameworks, and assurance examples that make claims easier to examine.
Read the source guide →Regulatory education
European Commission ↗
Learn how to investigate applicability without reducing a changing legal framework to a quiz score.
Read the source guide →