$ show OWASP/AISVS
The OWASP AI Security Verification Standard (AISVS) is a community-driven, open-source framework providing a comprehensive set of verifiable security requirements for AI-enabled systems. Modeled after the OWASP Application Security Verification Standard (ASVS), it defines 12 control families (C01-C12) covering the entire AI lifecycle, from training data integrity and model lifecycle management to adversarial robustness and monitoring/logging. The repository is structured as a living standard with two parallel tracks: a locked, stable release (1.0/) and an active development version (1.01-dev/). Each requirement is backed by an extensive research wiki that details the threat landscape, notable incidents, tooling maturity, verification approaches, and open research questions. This makes the AISVS not just a checklist, but a deeply researched knowledge base for engineers, auditors, and security architects building and evaluating AI systems. It also includes appendices for a glossary, a controls inventory, and AI-assisted secure coding practices. Note: This is a documentation/specification repository, not a software application or data science project. Its quality is measured by the rigor of its research, the clarity of its requirements, and the maintainability of its structure.
The LLM identified 4 files worth highlighting for reuse:
Defines a consistent, reusable template for security requirements (ID, Description, Level, Threat Mitigated, Verification Approach, Gaps/Notes). This pattern can be extracted and applied to author any security or compliance standard, providing a structured, auditable format that bridges high-level controls with practical implementation guidance.
A reusable pattern for documenting the rationale behind security controls. Each requirement is mapped to real-world incidents, academic research, tooling maturity assessments, and open research questions. This transforms a static standard into a living knowledge base that tracks the evolving threat landscape and ecosystem capabilities.
A standalone, self-contained appendix defining 14 control families (AC.1-AC.14) for the secure use of AI coding assistants. It covers tool qualification, prompt management, output validation, CI/CD integration, and incident response. This module is directly reusable by any organization adopting AI-assisted software development.
Implements a robust two-track versioning system for a living document. The 1.0/ directory contains the locked, stable release, while 1.01-dev/ holds the development version. CI workflows (lock-1.0.yml) enforce immutability of the stable release, preventing unauthorized modifications. This pattern is reusable for any project that needs to maintain a stable specification alongside active development.