{
 "profile": {
  "uuid": "667b55a5-4e97-5194-9c6f-00978dd53e5a",
  "metadata": {
   "title": "CoSAI AI SRF — Public Sector Vertical Profile (Proposed Extension)",
   "last-modified": "2026-07-28T22:58:14+00:00",
   "version": "0.1.0",
   "oscal-version": "1.2.2",
   "props": [
    {
     "name": "vertical",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "public-sector"
    },
    {
     "name": "source",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "https://aisharedresponsibility.com/data/public-sector-controls.json"
    },
    {
     "name": "control-count",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "40"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "aicm"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "cosais"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "fedramp_20x_ksi"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "m_25_21"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "m_25_22"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "nist_ai_rmf"
    },
    {
     "name": "regulatory-driver",
     "ns": "https://aisharedresponsibility.com/ns/oscal",
     "value": "owasp_llm"
    }
   ],
   "links": [
    {
     "href": "https://aisharedresponsibility.com/public-sector/",
     "rel": "canonical"
    },
    {
     "href": "https://aisharedresponsibility.com/public-sector/controls/",
     "rel": "reference",
     "text": "Public Sector controls page"
    },
    {
     "href": "#97cd3d25-cf40-53a0-9616-8ce8875cdc2f",
     "rel": "reference",
     "text": "CSA AI Controls Matrix"
    },
    {
     "href": "#d5cc8214-e2b4-5f1c-918d-741abe47fc1c",
     "rel": "reference",
     "text": "NIST COSAiS — Control Overlays for Securing AI Systems (NISTIR 8605 series)"
    },
    {
     "href": "#aec75536-9650-52f9-bd36-918743c7b0a5",
     "rel": "reference",
     "text": "FedRAMP 20x Key Security Indicators (Consolidated Rules for 2026)"
    },
    {
     "href": "#84dc5e0b-1ce3-5738-b78c-60e2d87d6b42",
     "rel": "reference",
     "text": "OMB M-25-21 — Accelerating Federal Use of AI"
    },
    {
     "href": "#ae7bd07d-92c3-5ea1-915d-6542ebb67973",
     "rel": "reference",
     "text": "OMB M-25-22 — Driving Efficient Acquisition of AI in Government"
    },
    {
     "href": "#c00b1cec-7990-5779-b1cf-10a2e792f026",
     "rel": "reference",
     "text": "NIST AI Risk Management Framework"
    },
    {
     "href": "#c403b49d-9023-519a-a9f4-fefbab79a3ce",
     "rel": "reference",
     "text": "OWASP Top 10 for Large Language Model Applications"
    }
   ],
   "remarks": "OMB M-25-21 (April 3, 2025) requires federal civilian agencies to apply seven minimum risk management practices to every high-impact AI use case and report compliance to OMB by September 22, 2026. Use cases that cannot meet the minimum practices must be discontinued. FedRAMP 20x is moving AI services into agencies through machine-readable Key Security Indicators rather than point-in-time documents; the first AI 20x Low authorizations landed January 2026, OpenAI holds 20x Moderate, and IBM authorized 11 AI products including watsonx in April 2026. FedRAMP authorizes the CSP side only; this schema fills the agency side of the shared responsibility split for AI-specific obligations. OMB M-25-22 (April 2025) governs AI acquisition, data rights, vendor lock-in avoidance, and transparency requirements. NIST COSAiS overlays are still in draft; mappings to those overlays are marked TBD pending final publication. Industry vertical schemas are independently proposed extensions and are not part of the official CoSAI release. Mapping IDs marked TBD are unverified and are carried verbatim as props, never as links; do not substitute invented IDs. Generated from data/*-controls.json."
  },
  "imports": [
   {
    "href": "https://aisharedresponsibility.com/export/srf-oscal-verticals-catalog.json",
    "include-controls": [
     {
      "with-ids": [
       "pubsec-srf-l1-acq-001",
       "pubsec-srf-l1-acq-002",
       "pubsec-srf-l1-acq-003",
       "pubsec-srf-l1-acq-004",
       "pubsec-srf-l1-mon-005",
       "pubsec-srf-l1-ovr-006",
       "pubsec-srf-l1-acq-007",
       "pubsec-srf-l1-acq-008",
       "pubsec-srf-l1-mon-009",
       "pubsec-srf-l2-acq-001",
       "pubsec-srf-l2-acq-002",
       "pubsec-srf-l2-acq-003",
       "pubsec-srf-l2-mon-004",
       "pubsec-srf-l2-acq-005",
       "pubsec-srf-l2-mon-006",
       "pubsec-srf-l2-mon-007",
       "pubsec-srf-l2-acq-008",
       "pubsec-srf-l3-val-001",
       "pubsec-srf-l3-val-002",
       "pubsec-srf-l3-val-003",
       "pubsec-srf-l3-ovr-004",
       "pubsec-srf-l3-ovr-005",
       "pubsec-srf-l3-mon-006",
       "pubsec-srf-l3-val-007",
       "pubsec-srf-l3-ovr-008",
       "pubsec-srf-l4-acq-001",
       "pubsec-srf-l4-acq-002",
       "pubsec-srf-l4-acq-003",
       "pubsec-srf-l4-mon-004",
       "pubsec-srf-l4-mon-005",
       "pubsec-srf-l4-mon-006",
       "pubsec-srf-l4-val-007",
       "pubsec-srf-l4-mon-008",
       "pubsec-srf-l5-acq-001",
       "pubsec-srf-l5-mon-002",
       "pubsec-srf-l5-acq-003",
       "pubsec-srf-l5-mon-004",
       "pubsec-srf-l5-acq-005",
       "pubsec-srf-l5-mon-006",
       "pubsec-srf-l5-mon-007"
      ]
     }
    ]
   }
  ],
  "merge": {
   "as-is": true
  },
  "modify": {
   "set-parameters": [
    {
     "param-id": "pubsec-srf-l1-acq-001-p1",
     "values": [
      "TIER_AI_INVENTORY_COVERAGE_PCT"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-acq-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-acq-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-acq-004-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-mon-005-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-ovr-006-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-acq-007-p1",
     "values": [
      "1.0"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-acq-008-p1",
     "values": [
      "TIER_STAFF_TRAINING_COMPLETION_PCT"
     ]
    },
    {
     "param-id": "pubsec-srf-l1-mon-009-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-acq-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-acq-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-acq-003-p1",
     "values": [
      "TIER_DATA_CLASSIFICATION_COVERAGE_PCT"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-mon-004-p1",
     "values": [
      "TIER_INPUT_PSI_THRESHOLD"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-acq-005-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-mon-006-p1",
     "values": [
      "TIER_ACCURACY_DEGRADATION_THRESHOLD_PCT"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-mon-007-p1",
     "values": [
      "TIER_DISPARATE_IMPACT_RATIO_THRESHOLD"
     ]
    },
    {
     "param-id": "pubsec-srf-l2-acq-008-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-val-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-val-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-val-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-ovr-004-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-ovr-005-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-mon-006-p1",
     "values": [
      "0"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-val-007-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l3-ovr-008-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-acq-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-acq-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-acq-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-mon-004-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-mon-005-p1",
     "values": [
      "TIER_AUDIT_LOG_COMPLETENESS_PCT"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-mon-006-p1",
     "values": [
      "TIER_MODEL_AVAILABILITY_PCT"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-val-007-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l4-mon-008-p1",
     "values": [
      "1.0"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-acq-001-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-mon-002-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-acq-003-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-mon-004-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-acq-005-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-mon-006-p1",
     "values": [
      "true"
     ]
    },
    {
     "param-id": "pubsec-srf-l5-mon-007-p1",
     "values": [
      "true"
     ]
    }
   ]
  },
  "back-matter": {
   "resources": [
    {
     "uuid": "97cd3d25-cf40-53a0-9616-8ce8875cdc2f",
     "title": "CSA AI Controls Matrix",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "aicm"
      }
     ],
     "rlinks": [
      {
       "href": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix"
      }
     ]
    },
    {
     "uuid": "aec75536-9650-52f9-bd36-918743c7b0a5",
     "title": "FedRAMP 20x Key Security Indicators (Consolidated Rules for 2026)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "fedramp_20x_ksi"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.fedramp.gov/2026/"
      }
     ]
    },
    {
     "uuid": "c00b1cec-7990-5779-b1cf-10a2e792f026",
     "title": "NIST AI Risk Management Framework",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "nist_ai_rmf"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.nist.gov/itl/ai-risk-management-framework"
      }
     ]
    },
    {
     "uuid": "d5cc8214-e2b4-5f1c-918d-741abe47fc1c",
     "title": "NIST COSAiS — Control Overlays for Securing AI Systems (NISTIR 8605 series)",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "cosais"
      }
     ],
     "rlinks": [
      {
       "href": "https://csrc.nist.gov/projects/cosais"
      }
     ]
    },
    {
     "uuid": "84dc5e0b-1ce3-5738-b78c-60e2d87d6b42",
     "title": "OMB M-25-21 — Accelerating Federal Use of AI",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "m_25_21"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"
      }
     ]
    },
    {
     "uuid": "ae7bd07d-92c3-5ea1-915d-6542ebb67973",
     "title": "OMB M-25-22 — Driving Efficient Acquisition of AI in Government",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "m_25_22"
      }
     ],
     "rlinks": [
      {
       "href": "https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"
      }
     ]
    },
    {
     "uuid": "c403b49d-9023-519a-a9f4-fefbab79a3ce",
     "title": "OWASP Top 10 for Large Language Model Applications",
     "props": [
      {
       "name": "framework-key",
       "ns": "https://aisharedresponsibility.com/ns/oscal",
       "value": "owasp_llm"
      }
     ],
     "rlinks": [
      {
       "href": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
      }
     ]
    }
   ]
  }
 }
}