{
 "profile": {
  "uuid": "b6823461-e9df-5d32-8fa0-6e90f834eeb2",
  "metadata": {
   "title": "CoSAI AI SRF — Insurance Vertical Profile (Proposed Extension)",
   "last-modified": "2026-07-28T22:58:14+00:00",
   "version": "0.1.0",
   "oscal-version": "1.2.2",
   "props": [
    {
     "name": "vertical",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "insurance"
    },
    {
     "name": "source",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "https://aisharedresponsibility.com/data/insurance-controls.json"
    },
    {
     "name": "control-count",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "40"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "aicm"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "co_reg_10_1_1"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "eu_ai_act"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "naic_eval_tool"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "naic_model_bulletin"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "nist_ai_rmf"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "nydfs_cl7"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "owasp_llm"
    }
   ],
   "links": [
    {
     "href": "https://aisharedresponsibility.com/insurance/",
     "rel": "canonical"
    },
    {
     "href": "https://aisharedresponsibility.com/insurance/controls/",
     "rel": "reference",
     "text": "Insurance controls page"
    },
    {
     "href": "#97cd3d25-cf40-53a0-9616-8ce8875cdc2f",
     "rel": "reference",
     "text": "CSA AI Controls Matrix"
    },
    {
     "href": "#85fdd33e-cac4-547a-9bf2-df01201e297a",
     "rel": "reference",
     "text": "Colorado 3 CCR 702-10, Regulation 10-1-1 (Insurance AI Governance)"
    },
    {
     "href": "#51bbabe9-02b8-5813-994d-891f4c95ef21",
     "rel": "reference",
     "text": "EU Artificial Intelligence Act (Regulation (EU) 2024/1689)"
    },
    {
     "href": "#3ebdb912-a63d-5056-a2c2-35254b8088f9",
     "rel": "reference",
     "text": "NAIC AI Systems Evaluation Tool 4.0 (DRAFT, pilot pre-adoption)"
    },
    {
     "href": "#52431089-8acf-5d26-bf45-b32bd1b97e77",
     "rel": "reference",
     "text": "NAIC Model Bulletin on the Use of AI Systems by Insurers"
    },
    {
     "href": "#c00b1cec-7990-5779-b1cf-10a2e792f026",
     "rel": "reference",
     "text": "NIST AI Risk Management Framework"
    },
    {
     "href": "#c59939b3-2e4d-575b-878c-2a4ff0ee3ea1",
     "rel": "reference",
     "text": "NYDFS Insurance Circular Letter No. 7 (2024)"
    },
    {
     "href": "#c403b49d-9023-519a-a9f4-fefbab79a3ce",
     "rel": "reference",
     "text": "OWASP Top 10 for Large Language Model Applications"
    }
   ],
   "remarks": "The NAIC Model Bulletin on the Use of AI Systems (December 2023) requires a written AIS Program covering governance, risk management, internal controls, and third-party AI oversight but prescribes no control catalog. Colorado Regulation 10-1-1 (amended effective October 15, 2025) extends ECDIS governance to private passenger auto and health benefit insurers, with governance frameworks due on request from July 1, 2026. The NAIC AI Systems Evaluation Tool multistate pilot (January to September 2026, twelve states) gives examiners a standardized review framework for market conduct exams. This schema operationalizes those requirements with named accountable personas, measurable thresholds, and machine-readable evidence. Industry vertical schemas are independently proposed extensions and are not part of the official CoSAI release. Mapping IDs marked TBD are unverified and are carried verbatim as props, never as links; do not substitute invented IDs. Generated from data/*-controls.json."
  },
  "imports": [
   {
    "href": "https://aisharedresponsibility.com/export/srf-oscal-verticals-catalog.json",
    "include-controls": [
     {
      "with-ids": [
       "ins-srf-l1-dev-001",
       "ins-srf-l1-dev-002",
       "ins-srf-l1-dev-003",
       "ins-srf-l1-dev-004",
       "ins-srf-l1-dev-005",
       "ins-srf-l1-mon-001",
       "ins-srf-l1-mon-002",
       "ins-srf-l1-tpo-001",
       "ins-srf-l1-tpo-002",
       "ins-srf-l2-dev-001",
       "ins-srf-l2-dev-002",
       "ins-srf-l2-dev-003",
       "ins-srf-l2-val-001",
       "ins-srf-l2-mon-001",
       "ins-srf-l2-mon-002",
       "ins-srf-l2-mon-003",
       "ins-srf-l2-tpo-001",
       "ins-srf-l3-dev-001",
       "ins-srf-l3-dev-002",
       "ins-srf-l3-val-001",
       "ins-srf-l3-val-002",
       "ins-srf-l3-val-003",
       "ins-srf-l3-mon-001",
       "ins-srf-l3-mon-002",
       "ins-srf-l3-tpo-001",
       "ins-srf-l4-dev-001",
       "ins-srf-l4-dev-002",
       "ins-srf-l4-dev-003",
       "ins-srf-l4-val-001",
       "ins-srf-l4-mon-001",
       "ins-srf-l4-mon-002",
       "ins-srf-l4-mon-003",
       "ins-srf-l4-tpo-001",
       "ins-srf-l5-dev-001",
       "ins-srf-l5-dev-002",
       "ins-srf-l5-val-001",
       "ins-srf-l5-val-002",
       "ins-srf-l5-mon-001",
       "ins-srf-l5-mon-002",
       "ins-srf-l5-tpo-001"
      ]
     }
    ]
   }
  ],
  "merge": {
   "as-is": true
  },
  "modify": {
   "set-parameters": [
    {
     "param-id": "ins-srf-l1-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-dev-002-p1",
     "values": [
      "TIER_AI_INVENTORY_COVERAGE_PCT"
     ]
    },
    {
     "param-id": "ins-srf-l1-dev-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-dev-004-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-dev-005-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-mon-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-mon-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-tpo-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l1-tpo-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l2-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l2-dev-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l2-dev-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l2-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l2-mon-001-p1",
     "values": [
      "TIER_PSI_DRIFT_THRESHOLD"
     ]
    },
    {
     "param-id": "ins-srf-l2-mon-002-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l2-mon-003-p1",
     "values": [
      "TIER_INPUT_MISSING_RATE_THRESHOLD_PCT"
     ]
    },
    {
     "param-id": "ins-srf-l2-tpo-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l3-dev-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l3-dev-002-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l3-val-001-p1",
     "values": [
      "100"
     ]
    },
    {
     "param-id": "ins-srf-l3-val-002-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l3-val-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l3-mon-001-p1",
     "values": [
      "TIER_ADVERSE_IMPACT_RATIO_MIN"
     ]
    },
    {
     "param-id": "ins-srf-l3-mon-002-p1",
     "values": [
      "TIER_COMPLAINT_RATE_THRESHOLD"
     ]
    },
    {
     "param-id": "ins-srf-l3-tpo-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l4-dev-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l4-dev-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l4-dev-003-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l4-val-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l4-mon-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l4-mon-002-p1",
     "values": [
      "TIER_AUDIT_LOG_COMPLETENESS_PCT"
     ]
    },
    {
     "param-id": "ins-srf-l4-mon-003-p1",
     "values": [
      "TIER_RUNTIME_ANOMALY_DETECT_HOURS"
     ]
    },
    {
     "param-id": "ins-srf-l4-tpo-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l5-dev-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l5-dev-002-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l5-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l5-val-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "ins-srf-l5-mon-001-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l5-mon-002-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "ins-srf-l5-tpo-001-p1",
     "values": [
      "true"
     ]
    }
   ]
  },
  "back-matter": {
   "resources": [
    {
     "uuid": "97cd3d25-cf40-53a0-9616-8ce8875cdc2f",
     "title": "CSA AI Controls Matrix",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "aicm"
      }
     ],
     "rlinks": [
      {
       "href": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix"
      }
     ]
    },
    {
     "uuid": "85fdd33e-cac4-547a-9bf2-df01201e297a",
     "title": "Colorado 3 CCR 702-10, Regulation 10-1-1 (Insurance AI Governance)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "co_reg_10_1_1"
      }
     ],
     "rlinks": [
      {
       "href": "https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework"
      }
     ]
    },
    {
     "uuid": "51bbabe9-02b8-5813-994d-891f4c95ef21",
     "title": "EU Artificial Intelligence Act (Regulation (EU) 2024/1689)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "eu_ai_act"
      }
     ],
     "rlinks": [
      {
       "href": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
      }
     ]
    },
    {
     "uuid": "3ebdb912-a63d-5056-a2c2-35254b8088f9",
     "title": "NAIC AI Systems Evaluation Tool 4.0 (DRAFT, pilot pre-adoption)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "naic_eval_tool"
      }
     ],
     "rlinks": [
      {
       "href": "https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20(Clean).pdf"
      }
     ]
    },
    {
     "uuid": "52431089-8acf-5d26-bf45-b32bd1b97e77",
     "title": "NAIC Model Bulletin on the Use of AI Systems by Insurers",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "naic_model_bulletin"
      }
     ],
     "rlinks": [
      {
       "href": "https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf"
      }
     ]
    },
    {
     "uuid": "c00b1cec-7990-5779-b1cf-10a2e792f026",
     "title": "NIST AI Risk Management Framework",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "nist_ai_rmf"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.nist.gov/itl/ai-risk-management-framework"
      }
     ]
    },
    {
     "uuid": "c59939b3-2e4d-575b-878c-2a4ff0ee3ea1",
     "title": "NYDFS Insurance Circular Letter No. 7 (2024)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "nydfs_cl7"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07"
      }
     ]
    },
    {
     "uuid": "c403b49d-9023-519a-a9f4-fefbab79a3ce",
     "title": "OWASP Top 10 for Large Language Model Applications",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "owasp_llm"
      }
     ],
     "rlinks": [
      {
       "href": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
      }
     ]
    }
   ]
  }
 }
}