aws-samples / aws-samples/sample-aiml-security-assessment

feat: Map security checks to NIST AI RMF and ISO/IEC 42001 compliance frameworks

Open
#35 0 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
HTML
Stars
43
Forks
20
Avg merge
2d 23h
Merged PRs (30d)
4

Description

## Summary

Security practitioners and compliance teams need to map findings to established AI governance frameworks. This issue tracks adding NIST AI Risk Management Framework (AI RMF) and ISO/IEC 42001 control mappings to each security check.

## Proposed Change

- Add `compliance_frameworks` metadata field to each check (e.g., `{"NIST_AI_RMF": ["GOVERN 1.1"], "ISO_42001": ["6.1.2"]}`)
- Update the HTML report to display and filter by framework control
- Add a compliance summary section to the executive dashboard

## Files Likely Touched

- `aiml-security-assessment/functions/security/*/` — add framework field to each check result dict
- HTML report template — add framework filter and compliance tab/section
- `docs/SECURITY_CHECKS.md` — add framework mapping columns
- `docs/AIMLSecurityAssessment-MappingsTable.csv` — extend with framework columns

## Acceptance Criteria

- [ ] Each check result includes `nist_ai_rmf` and `iso_42001` fields (can be empty list if not yet mapped)
- [ ] Report can filter findings by framework control ID
- [ ] `docs/SECURITY_CHECKS.md` table includes framework mapping columns

## Dependencies

Depends on #34 (metadata fields) — the `framework` field from that issue provides the foundation for the filter UI here.

Contributor guide

Open the contributing guide

Research direction

Start with dependency #34, then inspect the check result dictionaries under aiml-security-assessment/functions/security/*/ and locate the HTML report template. Review docs/SECURITY_CHECKS.md and docs/AIMLSecurityAssessment-MappingsTable.csv for the existing check metadata and mapping structure. Done means checks expose the requested framework fields, reports filter and summarize framework controls, and the documentation tables include the new mappings.

Written by the indexing model from the issue text.

Assessment

Tech stack
html
Domain
documentation, frontend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.