AI framework mapping
across 5 standards,
scored from your own activity.

The reference vocabulary for AI risk in the United States, and the one most enterprise risk teams have already adopted internally. It organises AI risk into four functions — Govern, Map, Measure, Manage — and asks whether an organisation can show it does each of them, rather than prescribing specific technology.

Govern and Map are evidenced by the registry: Policy Sets with a draft → review → published lifecycle, Controls with segregation of duties, and AI Use Cases and Agents that record intended purpose and risk rating. Measure is evidenced by nightly Ethics & Bias runs (MEASURE 2.1) and Project Moonshot red-team runs (MEASURE 2.7). Manage is the Violations pipeline and Review Queue.

The only certifiable standard in this set. It is a management-system standard in the same family as ISO 27001: it asks you to plan for AI risk, resource the work, operate controls, evaluate performance, and improve — and it expects documented evidence of each, audited by an accredited certification body.

Obiguard produces the operating evidence an ISO/IEC 42001 auditor asks for, but not the certificate. Clause 6 planning maps to Controls and Criteria with risk ratings; Clause 8 operation to Policy Sets enforcing at the gateway; Clause 9 performance evaluation to the Dashboard and Audit Log; Clause 10 improvement to the Review Queue and the resolution trail behind each violation.

Not a compliance standard at all, but the security industry’s shared list of how LLM applications actually get broken — prompt injection, sensitive information disclosure, excessive agency, system prompt leakage, misinformation, unbounded consumption. It is the framework your penetration testers and your customers’ security questionnaires will both reference.

This is the framework that maps most directly onto product mechanics rather than paperwork. Guardrail Criteria address LLM01 prompt injection and LLM02 sensitive information disclosure at the gateway; agent and tool scoping addresses LLM06 excessive agency; and Moonshot jailbreak recipes can be run separately to test whether those defences hold, though those runs are not counted in coverage.

Malaysia’s national framework for securing AI systems, published by NACSA. Where NIST organises by risk function, AISCF organises by lifecycle: Inception, Design & Development, Verification & Validation, Deployment, Operation & Monitoring, Continuous Validation and Re-evaluation, and Retirement. Each phase carries specific security activities — 42 in total — and it is explicitly risk-based, so the depth expected scales with the system’s risk.

Obiguard covers the operational end of the lifecycle in depth and the design end only where the platform holds a record. Operation & Monitoring maps to guardrail enforcement, the Dashboard, and the Audit Log; Verification & Validation and Continuous Validation are only partly covered, because recurring vulnerability scanning and penetration testing are not features yet; Deployment maps to scoped Access Keys and prompt-version approval. Inception and Retirement activities — requirements definition, data disposal, model retirement — are organisational steps Obiguard records rather than performs.

Singapore’s baseline for a trusted generative-AI ecosystem, from IMDA and the AI Verify Foundation — the same foundation behind Project Moonshot. It is deliberately broader than a security standard: nine dimensions spanning accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research, and AI for public good.

Four of the nine dimensions — Testing & Assurance, Content Provenance, Safety & Alignment R&D, and AI for Public Good — are ecosystem-level commitments aimed at model developers, testing bodies, and policymakers, so no deployer platform can evidence them and the headline score is capped at 56% by design. Read the per-dimension detail, not the gauge. Of the five that a deployer can evidence, Security is the strongest: guardrail Criteria screen for GenAI-specific threat vectors, Policy Sets enforce at the gateway, and Access Keys bound exposure. Accountability rests on segregation of duties in Controls and full attribution in the Audit Log.