AI Agent Security: Framework Crosswalk

C.1  The five surfaces against the threat taxonomies

Note the asymmetry. The agentic list is organized by what the attacker achieves; the technique catalog by how. They are complementary and neither is a control set. If an assessor asks you to “comply with” either, the honest answer is that neither is a compliance instrument.

C.2  The controls against the management frameworks

The NIST profile for generative AI (AI 600-1, July 2024) remains the current companion to the framework. Three agent-specific NIST efforts are in progress and none has published output - in particular, the control overlay for AI agent systems is on the roadmap and does not yet exist. Do not let anyone cite it at you.

C.3  Where FedRAMP fits

FedRAMP is included here because it is frequently mentioned beside NIST and ISO in U.S. federal AI programs, but it is a different kind of instrument. It provides reusable assessment evidence for a specific cloud service offering. It does not replace the agency's authorization decision, define an AI management system or supply an agent-security control catalog.

Practical rule: use the Marketplace to verify the offering, the provider's package to understand inherited controls, and the agency authorization process to evaluate the full AI-agent system and its use.

C.4  Five gaps in the published frameworks

These are not criticisms. They are places where, if you build what this guide describes, you will find nothing to map it to - and knowing that in advance saves an argument in a design review.

1. The AI threat taxonomy has no technique for suppressing telemetry. Its defense-evasion tactic covers evading the model, not evading the observer. Map that behavior to the general adversary framework instead, where disabling cloud logging is long established and both major SIEM vendors ship detections for it against AI platforms.
2. The common event schema has no AI or agent event class. As of August 2026 AI is a profile and a set of objects layered onto existing classes; an agent tool call is modeled as API activity. Workable, but you are normalizing into your own shape either way.
3. The agent control standard is not a control catalog. Published at v0.1 preview in September 2026, it specifies middleware hook points - input, output, tool call, memory, lifecycle - and runtime policy tiers. There are no numbered control families to crosswalk against. Map to the hooks, not to controls that do not exist.
4. No convention correlates across organizations. When your agent delegates to a partner’s, nothing makes the two audit trails cross-referenceable. Inside your estate this is solvable today; across a boundary, record it as accepted risk.
5. The community detection format has no AI log-source taxonomy. Which is why agent detection content does not travel between tools the way endpoint content does.

C.5  What changed recently, and what it breaks

• A new agentic top ten exists (December 2025) with its own identifiers, separate from the long-standing list for language-model applications.
• That language-model list was itself replaced in 2026. Ranks moved substantially and one entry was renamed and rescoped from system-prompt leakage to hidden context exposure. The project’s own per-risk web pages still serve the previous edition - cite the current document, not the site.
• The technique catalog restructured in 2026, separating content version from format version, renaming one tactic, and adding roughly thirty agent and autonomy techniques plus four agent-specific mitigations. It also gained a platform field, so agentic techniques can now be filtered directly. Tooling pinned to the old distribution path silently produces a 2025-era mapping.
• The generative-AI telemetry conventions moved repositories and now cover workflow, planning and memory operations as well as the original agent and tool spans, plus attributes for the tool protocol. Everything remains at development status; nothing is stable.