# Standards and References

- [NIST AI 600-1 Generative AI Profile](https://doi.org/10.6028/NIST.AI.600-1)
- [OWASP Agent Control Standard](https://genai.owasp.org/resource/agent-control-standard-acs/)
- [OWASP Agentic AI Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
- [MITRE ATLAS](https://atlas.mitre.org/)
- [SLSA 1.2 Provenance](https://slsa.dev/spec/v1.2/provenance)
- [in-toto Attestation Framework](https://github.com/in-toto/attestation/tree/main/spec/v1)
- [CycloneDX 1.7 JSON Reference](https://cyclonedx.org/docs/1.7/json/)
- [CycloneDX Authoritative Guide to AI and ML-BOM](https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-AI-ML-BOM-en.pdf)
- [SARIF 2.1.0 OASIS Standard](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html)
- [CWE-798 Use of Hard-coded Credentials](https://cwe.mitre.org/data/definitions/798.html)

References guide rule design; AAISA does not claim certification or complete conformance with every referenced framework.