{
 "profile": {
  "uuid": "62a7cc86-57dd-5f9c-b6f4-0c1e952912c3",
  "metadata": {
   "title": "CoSAI AI SRF — Finance Vertical Profile (Proposed Extension)",
   "last-modified": "2026-07-28T22:58:14+00:00",
   "version": "0.1.0",
   "oscal-version": "1.2.2",
   "props": [
    {
     "name": "vertical",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "finance"
    },
    {
     "name": "source",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "https://aisharedresponsibility.com/data/finance-controls.json"
    },
    {
     "name": "control-count",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "40"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "aicm"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "eu_ai_act"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "finos_aigf"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "nist_ai_rmf"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "owasp_llm"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "sr26_2"
    }
   ],
   "links": [
    {
     "href": "https://aisharedresponsibility.com/finance/",
     "rel": "canonical"
    },
    {
     "href": "https://aisharedresponsibility.com/finance/controls/",
     "rel": "reference",
     "text": "Finance controls page"
    },
    {
     "href": "#97cd3d25-cf40-53a0-9616-8ce8875cdc2f",
     "rel": "reference",
     "text": "CSA AI Controls Matrix"
    },
    {
     "href": "#51bbabe9-02b8-5813-994d-891f4c95ef21",
     "rel": "reference",
     "text": "EU Artificial Intelligence Act (Regulation (EU) 2024/1689)"
    },
    {
     "href": "#42d3a8ce-e217-5de0-a841-81b227deb27b",
     "rel": "reference",
     "text": "FINOS AI Governance Framework"
    },
    {
     "href": "#c00b1cec-7990-5779-b1cf-10a2e792f026",
     "rel": "reference",
     "text": "NIST AI Risk Management Framework"
    },
    {
     "href": "#c403b49d-9023-519a-a9f4-fefbab79a3ce",
     "rel": "reference",
     "text": "OWASP Top 10 for Large Language Model Applications"
    },
    {
     "href": "#3f564f95-c419-5856-82e2-62e4a8215e87",
     "rel": "reference",
     "text": "SR 26-2 — Revised Guidance on Model Risk Management"
    }
   ],
   "remarks": "SR 26-2 (Federal Reserve / OCC / FDIC, April 2026) puts generative and agentic AI explicitly out of scope while directing institutions to apply existing MRM principles by materiality. This schema operationalizes those principles for AI systems across all five SRF layers. Industry vertical schemas are independently proposed extensions and are not part of the official CoSAI release. Mapping IDs marked TBD are unverified and are carried verbatim as props, never as links; do not substitute invented IDs. Generated from data/*-controls.json."
  },
  "imports": [
   {
    "href": "https://aisharedresponsibility.com/export/srf-oscal-verticals-catalog.json",
    "include-controls": [
     {
      "with-ids": [
       "fin-srf-l1-dev-001",
       "fin-srf-l1-dev-002",
       "fin-srf-l1-dev-003",
       "fin-srf-l1-dev-004",
       "fin-srf-l1-val-001",
       "fin-srf-l1-mon-001",
       "fin-srf-l1-mon-002",
       "fin-srf-l1-mon-003",
       "fin-srf-l1-ech-001",
       "fin-srf-l2-dev-001",
       "fin-srf-l2-dev-002",
       "fin-srf-l2-dev-003",
       "fin-srf-l2-val-001",
       "fin-srf-l2-mon-001",
       "fin-srf-l2-mon-002",
       "fin-srf-l2-mon-003",
       "fin-srf-l2-ech-001",
       "fin-srf-l3-dev-001",
       "fin-srf-l3-dev-002",
       "fin-srf-l3-dev-003",
       "fin-srf-l3-val-001",
       "fin-srf-l3-mon-001",
       "fin-srf-l3-mon-002",
       "fin-srf-l3-mon-003",
       "fin-srf-l3-ech-001",
       "fin-srf-l4-dev-001",
       "fin-srf-l4-dev-002",
       "fin-srf-l4-dev-003",
       "fin-srf-l4-val-001",
       "fin-srf-l4-mon-001",
       "fin-srf-l4-mon-002",
       "fin-srf-l4-mon-003",
       "fin-srf-l4-ech-001",
       "fin-srf-l5-dev-001",
       "fin-srf-l5-dev-002",
       "fin-srf-l5-dev-003",
       "fin-srf-l5-val-001",
       "fin-srf-l5-mon-001",
       "fin-srf-l5-mon-002",
       "fin-srf-l5-ech-001"
      ]
     }
    ]
   }
  ],
  "merge": {
   "as-is": true
  },
  "modify": {
   "set-parameters": [
    {
     "param-id": "fin-srf-l1-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l1-dev-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l1-dev-003-p1",
     "values": [
      "tier-defined"
     ]
    },
    {
     "param-id": "fin-srf-l1-dev-004-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l1-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l1-mon-001-p1",
     "values": [
      "tier-defined"
     ]
    },
    {
     "param-id": "fin-srf-l1-mon-002-p1",
     "values": [
      "tier-defined"
     ]
    },
    {
     "param-id": "fin-srf-l1-mon-003-p1",
     "values": [
      "tier-defined (Tier-1: 30d, Tier-2: 60d)"
     ]
    },
    {
     "param-id": "fin-srf-l1-ech-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l2-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l2-dev-002-p1",
     "values": [
      "tier-defined"
     ]
    },
    {
     "param-id": "fin-srf-l2-dev-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l2-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l2-mon-001-p1",
     "values": [
      "tier-defined"
     ]
    },
    {
     "param-id": "fin-srf-l2-mon-002-p1",
     "values": [
      "tier-defined"
     ]
    },
    {
     "param-id": "fin-srf-l2-mon-003-p1",
     "values": [
      "0 unauthorized-actor writes"
     ]
    },
    {
     "param-id": "fin-srf-l2-ech-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l3-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l3-dev-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l3-dev-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l3-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l3-mon-001-p1",
     "values": [
      "tier-defined (upper and lower control limits set at baseline)"
     ]
    },
    {
     "param-id": "fin-srf-l3-mon-002-p1",
     "values": [
      "tier-defined per filter category"
     ]
    },
    {
     "param-id": "fin-srf-l3-mon-003-p1",
     "values": [
      "0 out-of-allow-list attempts; tier-defined for per-call failures"
     ]
    },
    {
     "param-id": "fin-srf-l3-ech-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l4-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l4-dev-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l4-dev-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l4-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l4-mon-001-p1",
     "values": [
      "tier-defined (0 for Critical; tier-defined for lower severity)"
     ]
    },
    {
     "param-id": "fin-srf-l4-mon-002-p1",
     "values": [
      "tier-defined (Tier-1 authz failures: 0; all others: tier-defined)"
     ]
    },
    {
     "param-id": "fin-srf-l4-mon-003-p1",
     "values": [
      "true per Tier-1 instance"
     ]
    },
    {
     "param-id": "fin-srf-l4-ech-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l5-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l5-dev-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l5-dev-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l5-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "fin-srf-l5-mon-001-p1",
     "values": [
      "1.0 (100% verification success)"
     ]
    },
    {
     "param-id": "fin-srf-l5-mon-002-p1",
     "values": [
      "true per open vulnerability within SLA window"
     ]
    },
    {
     "param-id": "fin-srf-l5-ech-001-p1",
     "values": [
      "true"
     ]
    }
   ]
  },
  "back-matter": {
   "resources": [
    {
     "uuid": "97cd3d25-cf40-53a0-9616-8ce8875cdc2f",
     "title": "CSA AI Controls Matrix",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "aicm"
      }
     ],
     "rlinks": [
      {
       "href": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix"
      }
     ]
    },
    {
     "uuid": "51bbabe9-02b8-5813-994d-891f4c95ef21",
     "title": "EU Artificial Intelligence Act (Regulation (EU) 2024/1689)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "eu_ai_act"
      }
     ],
     "rlinks": [
      {
       "href": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
      }
     ]
    },
    {
     "uuid": "42d3a8ce-e217-5de0-a841-81b227deb27b",
     "title": "FINOS AI Governance Framework",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "finos_aigf"
      }
     ],
     "rlinks": [
      {
       "href": "https://air-governance-framework.finos.org/"
      }
     ]
    },
    {
     "uuid": "c00b1cec-7990-5779-b1cf-10a2e792f026",
     "title": "NIST AI Risk Management Framework",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "nist_ai_rmf"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.nist.gov/itl/ai-risk-management-framework"
      }
     ]
    },
    {
     "uuid": "c403b49d-9023-519a-a9f4-fefbab79a3ce",
     "title": "OWASP Top 10 for Large Language Model Applications",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "owasp_llm"
      }
     ],
     "rlinks": [
      {
       "href": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
      }
     ]
    },
    {
     "uuid": "3f564f95-c419-5856-82e2-62e4a8215e87",
     "title": "SR 26-2 — Revised Guidance on Model Risk Management",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "sr26_2"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm"
      }
     ]
    }
   ]
  }
 }
}