Tools

Turn the framework into the artifact you keep. Name one accountable party per layer for a specific deployment, flag residual gaps, and export a signed one-page record to PDF.

Identify which regulations apply to your planned AI system. Answer four questions about jurisdiction, risk tier, and deployment context to get a layer-mapped regulatory profile.

Five-layer security controls assessment aligned to the CSA AI Controls Matrix v1.0.3. Covers OWASP LLM Top 10, EU AI Act risk tiers, and generates a gap report with PDF export.

CCI-level security posture assessment across all five CoSAI SRF layers. Focused on defensive controls, threat coverage, and OWASP LLM vulnerability mitigations.

Build your AI governance document hierarchy across the five CoSAI layers: principles, policies, standards, guidelines, and operational baselines. Export as PDF or JSON.

Cross-layer integration and handoff reference. Shows how controls, data flows, and accountability transfer across the L1 through L5 boundaries for a given deployment.

Apply adversarial scenarios to the CoSAI SRF to find gaps, ambiguous boundaries, and accountability edge cases. Useful for pre-deployment review and tabletop exercises.

Seven AI supplier categories mapped to SRF layers. Each category states vendor-versus-customer accountability, attestation baselines, and the evidence to demand. Includes a how-to guide and a downloadable VRA workpaper.

Day-2 response for when a boundary fails. Seven AI incident scenarios mapped to the SRF layer that broke, with who leads per operating model, vendor asks, and evidence to preserve.

Scope an AI red team engagement. Resolves testable, authorization-required, and out-of-scope layers by operating model, pre-assigns finding ownership, and exports a signed scoping record.

Versioned, downloadable system prompts that ground AI assistants in the CoSAI SRF. Variants for executive summary, auditor, developer, and legal/procurement modes.

Prompts that read an image, Mermaid, or SVG of an AI-enabled system and write a threat matrix, a markdown report, JSON, a CSV threat database, and a Mermaid threat-model diagram. Pack v3.0 requires typed traditional analysis, checks AI-to-traditional paths, and pins external source references. Operator fields belong in the first message. Optional SRF and vertical joins run only when those inputs were supplied there.