aws-samples / aws-samples/sample-aiml-security-assessment
feat: Map security checks to NIST AI RMF and ISO/IEC 42001 compliance frameworks
- Dominant language
- HTML
- Stars
- 43
- Forks
- 20
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 4
Description
## Summary
Security practitioners and compliance teams need to map findings to established AI governance frameworks. This issue tracks adding NIST AI Risk Management Framework (AI RMF) and ISO/IEC 42001 control mappings to each security check.
## Proposed Change
- Add `compliance_frameworks` metadata field to each check (e.g., `{"NIST_AI_RMF": ["GOVERN 1.1"], "ISO_42001": ["6.1.2"]}`)
- Update the HTML report to display and filter by framework control
- Add a compliance summary section to the executive dashboard
## Files Likely Touched
- `aiml-security-assessment/functions/security/*/` — add framework field to each check result dict
- HTML report template — add framework filter and compliance tab/section
- `docs/SECURITY_CHECKS.md` — add framework mapping columns
- `docs/AIMLSecurityAssessment-MappingsTable.csv` — extend with framework columns
## Acceptance Criteria
- [ ] Each check result includes `nist_ai_rmf` and `iso_42001` fields (can be empty list if not yet mapped)
- [ ] Report can filter findings by framework control ID
- [ ] `docs/SECURITY_CHECKS.md` table includes framework mapping columns
## Dependencies
Depends on #34 (metadata fields) — the `framework` field from that issue provides the foundation for the filter UI here.
Contributor guide
Research direction
Start with dependency #34, then inspect the check result dictionaries under aiml-security-assessment/functions/security/*/ and locate the HTML report template. Review docs/SECURITY_CHECKS.md and docs/AIMLSecurityAssessment-MappingsTable.csv for the existing check metadata and mapping structure. Done means checks expose the requested framework fields, reports filter and summarize framework controls, and the documentation tables include the new mappings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- documentation, frontend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100