Framework Crosswalk
Mapped to the frameworks
institutions answer to.
Beneath the Act. Above the Machine. Impossible to Bypass.
Every ICA-governed action is crosswalked against the control frameworks your regulators, auditors, and insurers already use. One activity, mapped to every framework, so the same evidence answers in the language each party speaks.
The mappings
Six frameworks. One posture.
| Framework | Scope | Coverage |
|---|---|---|
| MITRE ATT&CK | Adversary tactics & techniques | Dense |
| NIST CSF 2.0 | Cybersecurity Framework | Dense |
| MITRE D3FEND | Defensive countermeasures | Dense |
| NIST AI RMF | AI risk management | Seeded |
| MITRE F3 | Adversary financial activity | Dense |
| MITRE ATLAS | Adversarial ML (AI-specific) | Seeded |
Coverage is honest. MITRE ATT&CK and NIST CSF are dense. The AI-specific frameworks, MITRE ATLAS and NIST AI RMF, are seeded and growing on regulatory cycles. The full per-framework mapping detail is shared under inquiry, and every mapping is verified before it appears in any issued credential.
The agentic threat surface, mapped
Not a label. A file you can import.
Autonomous agents reach real systems through their tools, and that is where the attacker goes. We publish the MITRE ATT&CK techniques an agent is most likely to reach, mapped to the control that governs the call. Each technique carries the OWASP MCP Top 10 risk it corresponds to and the MITRE D3FEND countermeasure that answers it. This is our control mapping, stated as ours, not a third-party certification.
Decides before the act. Denies, scopes, or requires standing authority for a tool call.
D3FENDCredential Hardening, Platform Hardening, Supply Chain Integrity
ATT&CKT1078, T1552, T1068, T1195, T1036
Stops the crossing act and isolates the agent. STOP, quarantine, kill switch, budget safe-halt.
D3FENDExecution Isolation, Network Isolation, Process Termination
ATT&CKT1059, T1003.006, T1021, T1567, T1496
Writes a signed, append-only record no actor inside the system can rewrite or disable.
D3FENDDetect, Integrity Monitoring, Restore
ATT&CKT1562, T1070, T1027, T1213
Download
ICA Agentic ATT&CK Navigator layer
A working ATT&CK Navigator layer. Load it into the MITRE ATT&CK Navigator through Open Existing Layer to see the full technique set, colored by the ICA control that answers each one. Gold gates, bronze contains, light gold seals.
Coverage, exercised
Governed is the claim. Exercised is the proof.
This board reads live from sealed receipts. A technique turns gold only when at least one signed receipt records ICA acting on it. Every count is a receipt, not an assertion. Techniques with none read governed, not yet exercised, and they say so plainly. The counts move as governed activity moves.
Techniques governed
·
Exercised
·
Sealed receipts
·
Reading sealed receipts…