{
  "schema_version": "1.0.0",
  "protocol": "SWT3",
  "publisher": "Tenable Nova LLC",
  "license": "Apache-2.0",
  "generated_at": "2026-06-06T00:00:00Z",
  "description": "Universal Control Taxonomy (UCT) Registry. Defines the factor semantics, evaluation rules, and framework cross-references for every SWT3-anchored compliance procedure. Covers NIST 800-53, NIST AI RMF, CMMC, 800-171, FedRAMP, DoD RMF, EU AI Act, ISO 42001, GDPR, Five-Eyes Agentic AI, OWASP Agentic Top 10, SR 11-7, Colorado SB 26-189, Illinois SB 315, GPAI Code of Practice, EO 14110, EO 14028, OSHA 1926, and HIPAA.",
  "citation": "When referencing these procedures in automated tools or derivative works, cite as: UCT Registry v1.0, Tenable Nova LLC (https://swt3.ai/registry/). SWT3 and Universal Control Taxonomy are trademarks of Tenable Nova LLC. Patent pending.",
  "fingerprint_formula": "SHA256('WITNESS:' + tenant_id + ':' + procedure_id + ':' + factor_a + ':' + factor_b + ':' + factor_c + ':' + timestamp_ms)[0:12]",
  "procedures": {
    "AC-1.1": {
      "procedure_id": "AC-1.1",
      "parent_control": "AC-1",
      "title": "Access Control Policy Document",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "AC-1_POLICY_DOCUMENT",
      "factors": {
        "factor_a": {
          "label": "max_policy_age_days",
          "description": "The expected or required value (the standard).",
          "default": 365
        },
        "factor_b": {
          "label": "policy_age_days",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Policy age in days (B) must not exceed max allowed age (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "AC-1",
        "FEDRAMP-MOD": "AC-1",
        "RMF": "AC-1"
      },
      "namespace": "INF"
    },
    "AC-11.1": {
      "procedure_id": "AC-11.1",
      "parent_control": "AC-11",
      "title": "Session Lock - SSH Idle Timeout",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-11_SSH_IDLE_TIMEOUT",
      "factors": {
        "factor_a": {
          "label": "idle_timeout_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "idle_timeout_seconds",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.10",
        "FEDRAMP-HIGH": "AC-11",
        "FEDRAMP-MOD": "AC-11",
        "NIST-800-171": "3.1.10",
        "RMF": "AC-11"
      },
      "namespace": "INF"
    },
    "AC-17.1": {
      "procedure_id": "AC-17.1",
      "parent_control": "AC-17",
      "title": "Remote Access - SSH Protocol Enforcement",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-17_SSH_PROTOCOL",
      "factors": {
        "factor_a": {
          "label": "nla_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "nla_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.12",
        "FEDRAMP-HIGH": "AC-17",
        "FEDRAMP-MOD": "AC-17",
        "NIST-800-171": "3.1.12",
        "RMF": "AC-17"
      },
      "namespace": "INF"
    },
    "AC-2.1": {
      "procedure_id": "AC-2.1",
      "parent_control": "AC-2",
      "title": "Account Management - Empty Password Accounts",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "AC-2_EMPTY_PASSWORDS",
      "factors": {
        "factor_a": {
          "label": "account_management_required",
          "description": "Whether automated account management controls must be active (1 = required).",
          "default": 1
        },
        "factor_b": {
          "label": "account_management_active",
          "description": "Whether account lifecycle controls (creation, modification, disabling, removal) are enforced by the system."
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Verifies that system accounts are managed through automated controls, not manual processes. One of three critical gate controls."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L1-3.1.1",
        "FEDRAMP-HIGH": "AC-2",
        "FEDRAMP-MOD": "AC-2",
        "NIST-800-171": "3.1.1",
        "RMF": "AC-2"
      },
      "namespace": "INF"
    },
    "AC-2.2": {
      "procedure_id": "AC-2.2",
      "parent_control": "AC-2",
      "title": "Account Management - UID 0 Accounts",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-2_UID_ZERO",
      "factors": {
        "factor_a": {
          "label": "max_no_password_accounts",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "no_password_accounts",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L1-3.1.1",
        "FEDRAMP-HIGH": "AC-2",
        "FEDRAMP-MOD": "AC-2",
        "NIST-800-171": "3.1.1",
        "RMF": "AC-2"
      },
      "namespace": "INF"
    },
    "AC-2.3": {
      "procedure_id": "AC-2.3",
      "parent_control": "AC-2",
      "title": "Account Management - Inactive System Accounts",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-2_INACTIVE_ACCOUNTS",
      "factors": {
        "factor_a": {
          "label": "max_interactive_accounts",
          "description": "The expected or required value (the standard).",
          "default": 10
        },
        "factor_b": {
          "label": "interactive_accounts",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.1",
        "FEDRAMP-HIGH": "AC-2",
        "FEDRAMP-MOD": "AC-2",
        "NIST-800-171": "3.1.1",
        "RMF": "AC-2"
      },
      "namespace": "INF"
    },
    "AC-3.1": {
      "procedure_id": "AC-3.1",
      "parent_control": "AC-3",
      "title": "Access Enforcement - World-Writable Files in /etc",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "AC-3_WORLD_WRITABLE",
      "factors": {
        "factor_a": {
          "label": "uac_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "uac_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Access control: denied requests (B) within tolerance (A)"
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L1-3.1.2",
        "FEDRAMP-HIGH": "AC-3",
        "FEDRAMP-MOD": "AC-3",
        "NIST-800-171": "3.1.2",
        "RMF": "AC-3"
      },
      "namespace": "INF"
    },
    "AC-3.2": {
      "procedure_id": "AC-3.2",
      "parent_control": "AC-3",
      "title": "Database Access Enforcement - Postgres Row-Level Security",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-3_PG_RLS",
      "factors": {
        "factor_a": {
          "label": "min_rls_policies",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "rls_policies_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {},
      "namespace": "INF"
    },
    "AC-4.1": {
      "procedure_id": "AC-4.1",
      "parent_control": "AC-4",
      "title": "Information Flow - IP Forward Controlled by Firewall",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-4_IP_FORWARDING",
      "factors": {
        "factor_a": {
          "label": "forward_chain_controlled",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "forward_rules_present",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.3",
        "FEDRAMP-HIGH": "AC-4",
        "FEDRAMP-MOD": "AC-4",
        "NIST-800-171": "3.1.3",
        "RMF": "AC-4"
      },
      "namespace": "INF"
    },
    "AC-5.1": {
      "procedure_id": "AC-5.1",
      "parent_control": "AC-5",
      "title": "Separation of Duties - Root Account Direct Login Disabled",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-5_ROOT_LOCKED",
      "factors": {
        "factor_a": {
          "label": "root_locked_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "root_account_locked",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.4",
        "FEDRAMP-HIGH": "AC-5",
        "FEDRAMP-MOD": "AC-5",
        "NIST-800-171": "3.1.4",
        "RMF": "AC-5"
      },
      "namespace": "INF"
    },
    "AC-6.1": {
      "procedure_id": "AC-6.1",
      "parent_control": "AC-6",
      "title": "Least Privilege - Sudoers Count",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "AC-6_SUDOERS_COUNT",
      "factors": {
        "factor_a": {
          "label": "max_sudoers_entries",
          "description": "The expected or required value (the standard).",
          "default": 15
        },
        "factor_b": {
          "label": "actual_sudoers_entries",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Least privilege: actual access (B) must not exceed authorized limit (A)"
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.5",
        "FEDRAMP-HIGH": "AC-6",
        "FEDRAMP-MOD": "AC-6",
        "NIST-800-171": "3.1.5",
        "RMF": "AC-6"
      },
      "namespace": "INF"
    },
    "AC-6.2": {
      "procedure_id": "AC-6.2",
      "parent_control": "AC-6",
      "title": "Least Privilege - SUID Binaries Count",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-6_SUID_BINARIES",
      "factors": {
        "factor_a": {
          "label": "max_suid_binaries",
          "description": "The expected or required value (the standard).",
          "default": 50
        },
        "factor_b": {
          "label": "suid_binaries_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.5",
        "FEDRAMP-HIGH": "AC-6",
        "FEDRAMP-MOD": "AC-6",
        "NIST-800-171": "3.1.5",
        "RMF": "AC-6"
      },
      "namespace": "INF"
    },
    "AC-6.3": {
      "procedure_id": "AC-6.3",
      "parent_control": "AC-6",
      "title": "Least Privilege - SGID Binaries Count",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-6_SGID_BINARIES",
      "factors": {
        "factor_a": {
          "label": "max_sgid_binaries",
          "description": "The expected or required value (the standard).",
          "default": 35
        },
        "factor_b": {
          "label": "sgid_binaries_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.5",
        "FEDRAMP-HIGH": "AC-6",
        "FEDRAMP-MOD": "AC-6",
        "NIST-800-171": "3.1.5",
        "RMF": "AC-6"
      },
      "namespace": "INF"
    },
    "AC-7.1": {
      "procedure_id": "AC-7.1",
      "parent_control": "AC-7",
      "title": "Unsuccessful Logon Attempts - Account Lockout Configured",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-7_ACCOUNT_LOCKOUT",
      "factors": {
        "factor_a": {
          "label": "min_lockout_observation_minutes",
          "description": "The expected or required value (the standard).",
          "default": 15
        },
        "factor_b": {
          "label": "lockout_observation_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.8",
        "FEDRAMP-HIGH": "AC-7",
        "FEDRAMP-MOD": "AC-7",
        "NIST-800-171": "3.1.8",
        "RMF": "AC-7"
      },
      "namespace": "INF"
    },
    "AC-8.1": {
      "procedure_id": "AC-8.1",
      "parent_control": "AC-8",
      "title": "System Use Notification - Login Banner",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "AC-8_LOGIN_BANNER",
      "factors": {
        "factor_a": {
          "label": "dod_banner_content_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "security_banner_phrases_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AC.L2-3.1.9",
        "FEDRAMP-HIGH": "AC-8",
        "FEDRAMP-MOD": "AC-8",
        "NIST-800-171": "3.1.9",
        "RMF": "AC-8"
      },
      "namespace": "INF"
    },
    "AI-GRD.1": {
      "procedure_id": "AI-GRD.1",
      "parent_control": "AI-GRD",
      "title": "Guardrail Enforcement \u2014 Required Safety Filters Active",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_GUARDRAIL_ENFORCEMENT",
      "factors": {
        "factor_a": {
          "label": "guardrails_required",
          "description": "Minimum number of active safety guardrails required (e.g., content filter, PII redaction, toxicity detector).",
          "default": 0,
          "regulatory_ref": "EU AI Act Art. 9(2)(a); NIST AI RMF MANAGE 4.1"
        },
        "factor_b": {
          "label": "guardrails_active",
          "description": "Number of safety guardrails confirmed active at inference time.",
          "regulatory_ref": "EU AI Act Art. 9(2)(a); NIST AI RMF MANAGE 4.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Verifies that the required safety guardrails were active when the inference executed. A FAIL indicates the model ran without mandatory safety controls."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(2)(a)",
        "FIVE-EYES-AGENTIC": "FE-7",
        "ISO-42001": "A.8.3",
        "NIST-AI-RMF": "GOVERN 1.5",
        "OWASP-AGENTIC": "MCP-03",
        "SG-IMDA-AGENTIC": "MGF-3.1"
      },
      "namespace": "AI"
    },
    "AI-GRD.2": {
      "procedure_id": "AI-GRD.2",
      "parent_control": "AI-GRD",
      "title": "Content Safety Filter \u2014 Output Classification Passed",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CONTENT_SAFETY",
      "factors": {
        "factor_a": {
          "label": "content_safety_required",
          "description": "Whether content safety filtering must pass (1 = required).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 9(4)(b); NIST AI RMF GOVERN 1.5"
        },
        "factor_b": {
          "label": "content_safety_passed",
          "description": "Whether the inference output passed content safety classification (1 = clean, 0 = refusal or content filter triggered).",
          "regulatory_ref": "EU AI Act Art. 9(4)(b); NIST AI RMF GOVERN 1.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the model output did not trigger content safety filters (refusal, toxicity, or policy violation). A FAIL creates an immediate alert for human review."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(3)",
        "FIVE-EYES-AGENTIC": "FE-7",
        "NIST-AI-RMF": "GOVERN 1.5",
        "OWASP-AGENTIC": "MCP-03"
      },
      "namespace": "AI"
    },
    "AI-INF.1": {
      "procedure_id": "AI-INF.1",
      "parent_control": "AI-INF",
      "title": "Inference Provenance \u2014 Prompt/Response Hash Capture",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_INFERENCE_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "provenance_required",
          "description": "Whether prompt/response hash capture is required (1 = yes). Proves the inference occurred and was recorded.",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 12(1); NIST AI RMF MEASURE 2.5"
        },
        "factor_b": {
          "label": "provenance_captured",
          "description": "Whether the prompt and response were hashed and anchored (1 = captured, 0 = missed).",
          "regulatory_ref": "EU AI Act Art. 12(1); NIST AI RMF MEASURE 2.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms that every AI inference was cryptographically fingerprinted at the point of execution. The prompt and response hashes prove the interaction occurred without retaining the raw content."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1706",
        "EU-AI-ACT": "Art.12(1)",
        "FIVE-EYES-AGENTIC": "FE-2,FE-4",
        "NIST-AI-RMF": "MAP 2.3",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-INF.2": {
      "procedure_id": "AI-INF.2",
      "parent_control": "AI-INF",
      "title": "Inference Latency \u2014 Response Time Within Threshold",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_INFERENCE_LATENCY",
      "factors": {
        "factor_a": {
          "label": "latency_threshold_ms",
          "description": "Maximum acceptable inference latency in milliseconds (e.g., 30000 = 30 seconds). Exceeding this threshold indicates model degradation or resource exhaustion.",
          "default": 30000,
          "regulatory_ref": "EU AI Act Art. 15(3); NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "measured_latency_ms",
          "description": "Actual round-trip latency of the inference in milliseconds, measured from request initiation to response completion.",
          "regulatory_ref": "EU AI Act Art. 15(3); NIST AI RMF MEASURE 2.6"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Verifies that the AI model responded within the operational time boundary. Latency spikes may indicate model poisoning, resource contention, or unauthorized model substitution."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(2)",
        "FIVE-EYES-AGENTIC": "FE-2",
        "NIST-AI-RMF": "MEASURE 2.5",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-MDL.1": {
      "procedure_id": "AI-MDL.1",
      "parent_control": "AI-MDL",
      "title": "Model Weight Integrity \u2014 Deployed Hash Matches Approved",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MODEL_INTEGRITY",
      "factors": {
        "factor_a": {
          "label": "model_integrity_required",
          "description": "Whether model identity verification is required (1 = yes). Ensures the deployed model matches the approved version.",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 9(4)(a); NIST AI RMF GOVERN 1.1"
        },
        "factor_b": {
          "label": "model_identity_verified",
          "description": "Whether the model ID returned by the provider matches the requested model (1 = match, 0 = mismatch or unavailable).",
          "regulatory_ref": "EU AI Act Art. 9(4)(a); NIST AI RMF GOVERN 1.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the AI provider served the exact model version that was requested. Detects unauthorized model swaps, shadow deployments, or provider-side version changes."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(4)(a)",
        "FIVE-EYES-AGENTIC": "FE-11",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "MANAGE 1.3",
        "OWASP-AGENTIC": "MCP-04",
        "SR-11-7": "III.B",
        "NIS-2": "Art.21(2)(e)"
      },
      "namespace": "AI"
    },
    "AI-MDL.2": {
      "procedure_id": "AI-MDL.2",
      "parent_control": "AI-MDL",
      "title": "Model Version Tracking \u2014 Version Identifier Recorded",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MODEL_VERSION",
      "factors": {
        "factor_a": {
          "label": "version_tracking_required",
          "description": "Whether the model version identifier must be recorded (1 = yes).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 12(2)(b); NIST AI RMF MANAGE 2.2"
        },
        "factor_b": {
          "label": "version_recorded",
          "description": "Whether the model version or system fingerprint was captured in the witness record (1 = recorded, 0 = missing).",
          "regulatory_ref": "EU AI Act Art. 12(2)(b); NIST AI RMF MANAGE 2.2"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Ensures model version lineage is maintained across all inferences. Required for EU AI Act Article 12 traceability and NIST AI RMF GOVERN function."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(2)(b)",
        "FIVE-EYES-AGENTIC": "FE-4",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "MAP 2.3",
        "NIS-2": "Art.21(2)(e)",
        "CA-SB-942": "Sec.22757.5(c)"
      },
      "namespace": "AI"
    },
    "AT-1.1": {
      "procedure_id": "AT-1.1",
      "parent_control": "AT-1",
      "title": "Security Awareness Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AT.L2-3.2.1",
        "FEDRAMP-HIGH": "AT-1",
        "FEDRAMP-MOD": "AT-1",
        "NIST-800-171": "3.2.1",
        "RMF": "AT-1"
      },
      "namespace": "INF"
    },
    "AT-2.1": {
      "procedure_id": "AT-2.1",
      "parent_control": "AT-2",
      "title": "Security Awareness Training",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AT.L2-3.2.1",
        "FEDRAMP-HIGH": "AT-2",
        "FEDRAMP-MOD": "AT-2",
        "NIST-800-171": "3.2.1",
        "RMF": "AT-2"
      },
      "namespace": "INF"
    },
    "AT-3.1": {
      "procedure_id": "AT-3.1",
      "parent_control": "AT-3",
      "title": "Role-Based Security Training",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AT.L2-3.2.2",
        "FEDRAMP-HIGH": "AT-3",
        "FEDRAMP-MOD": "AT-3",
        "NIST-800-171": "3.2.2",
        "RMF": "AT-3"
      },
      "namespace": "INF"
    },
    "AT-4.1": {
      "procedure_id": "AT-4.1",
      "parent_control": "AT-4",
      "title": "Training Records",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AT.L2-3.2.3",
        "FEDRAMP-HIGH": "AT-4",
        "FEDRAMP-MOD": "AT-4",
        "NIST-800-171": "3.2.3",
        "RMF": "AT-4"
      },
      "namespace": "INF"
    },
    "AU-12.1": {
      "procedure_id": "AU-12.1",
      "parent_control": "AU-12",
      "title": "Audit Generation - Auditd Service Active",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "AU-12_AUDITD_SERVICE",
      "factors": {
        "factor_a": {
          "label": "auditd_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "auditd_active",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Audit generation: system must be generating logs (B >= 1)"
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.1",
        "FEDRAMP-HIGH": "AU-12",
        "FEDRAMP-MOD": "AU-12",
        "NIST-800-171": "3.3.1",
        "RMF": "AU-12"
      },
      "namespace": "INF"
    },
    "AU-2.1": {
      "procedure_id": "AU-2.1",
      "parent_control": "AU-2",
      "title": "Audit Events - Logging Service Active",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "AU-2_LOGGING_SERVICE",
      "factors": {
        "factor_a": {
          "label": "audit_logging_required",
          "description": "Whether system audit logging must be active (1 = required). Maps to NIST AU-2: Audit Events.",
          "default": 1
        },
        "factor_b": {
          "label": "audit_logging_active",
          "description": "Whether the audit subsystem (auditd/journald) is running and configured to capture security-relevant events."
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the system records security-relevant audit events. Without this control, no other compliance claim can be independently verified."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.1",
        "FEDRAMP-HIGH": "AU-2",
        "FEDRAMP-MOD": "AU-2",
        "NIST-800-171": "3.3.1",
        "RMF": "AU-2"
      },
      "namespace": "INF"
    },
    "AU-2.2": {
      "procedure_id": "AU-2.2",
      "parent_control": "AU-2",
      "title": "Database Audit Logging - Postgres Log Connections",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-2_PG_LOG_CONNECTIONS",
      "factors": {
        "factor_a": {
          "label": "log_connections_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "log_connections_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {},
      "namespace": "INF"
    },
    "AU-3.1": {
      "procedure_id": "AU-3.1",
      "parent_control": "AU-3",
      "title": "Content of Audit Records - Auditd Rules Configured",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-3_AUDIT_RULES",
      "factors": {
        "factor_a": {
          "label": "min_logon_audit_policies",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "logon_audit_policies_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.1",
        "FEDRAMP-HIGH": "AU-3",
        "FEDRAMP-MOD": "AU-3",
        "NIST-800-171": "3.3.1",
        "RMF": "AU-3"
      },
      "namespace": "INF"
    },
    "AU-4.1": {
      "procedure_id": "AU-4.1",
      "parent_control": "AU-4",
      "title": "Audit Storage Capacity - Log Partition Free Percent",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-4_LOG_STORAGE",
      "factors": {
        "factor_a": {
          "label": "min_free_percent",
          "description": "The expected or required value (the standard).",
          "default": 20
        },
        "factor_b": {
          "label": "actual_free_percent",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.4",
        "FEDRAMP-HIGH": "AU-4",
        "FEDRAMP-MOD": "AU-4",
        "NIST-800-171": "3.3.4",
        "RMF": "AU-4"
      },
      "namespace": "INF"
    },
    "AU-5.1": {
      "procedure_id": "AU-5.1",
      "parent_control": "AU-5",
      "title": "Response to Audit Failures - Disk Full Action Configured",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-5_DISK_FULL_ACTION",
      "factors": {
        "factor_a": {
          "label": "disk_full_action_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "disk_full_action_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.4",
        "FEDRAMP-HIGH": "AU-5",
        "FEDRAMP-MOD": "AU-5",
        "NIST-800-171": "3.3.4",
        "RMF": "AU-5"
      },
      "namespace": "INF"
    },
    "AU-6.1": {
      "procedure_id": "AU-6.1",
      "parent_control": "AU-6",
      "title": "Audit Review - Log Rotation Configured",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-6_LOG_ROTATION",
      "factors": {
        "factor_a": {
          "label": "min_logrotate_configs",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "logrotate_configs_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.5",
        "FEDRAMP-HIGH": "AU-6",
        "FEDRAMP-MOD": "AU-6",
        "NIST-800-171": "3.3.5",
        "RMF": "AU-6"
      },
      "namespace": "INF"
    },
    "AU-8.1": {
      "procedure_id": "AU-8.1",
      "parent_control": "AU-8",
      "title": "Time Stamps - NTP Synchronization Active",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-8_NTP_SYNC",
      "factors": {
        "factor_a": {
          "label": "ntp_sync_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "ntp_synchronized",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.7",
        "FEDRAMP-HIGH": "AU-8",
        "FEDRAMP-MOD": "AU-8",
        "NIST-800-171": "3.3.7",
        "RMF": "AU-8"
      },
      "namespace": "INF"
    },
    "AU-9.1": {
      "procedure_id": "AU-9.1",
      "parent_control": "AU-9",
      "title": "Protection of Audit Information - Log File Permissions",
      "category": "AUDIT",
      "scope": "linux_infra",
      "check_type": "AU-9_LOG_PERMISSIONS",
      "factors": {
        "factor_a": {
          "label": "min_security_log_kb",
          "description": "The expected or required value (the standard).",
          "default": 1024
        },
        "factor_b": {
          "label": "security_log_size_kb",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "AU.L2-3.3.8",
        "FEDRAMP-HIGH": "AU-9",
        "FEDRAMP-MOD": "AU-9",
        "NIST-800-171": "3.3.8",
        "RMF": "AU-9"
      },
      "namespace": "INF"
    },
    "CM-2.1": {
      "procedure_id": "CM-2.1",
      "parent_control": "CM-2",
      "title": "Baseline Configuration - Installed Packages Count",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "CM-2_INSTALLED_PACKAGES",
      "factors": {
        "factor_a": {
          "label": "max_installed_features",
          "description": "The expected or required value (the standard).",
          "default": 50
        },
        "factor_b": {
          "label": "installed_features",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Configuration: drift count (B) must not exceed tolerance (A)"
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.1",
        "FEDRAMP-HIGH": "CM-2",
        "FEDRAMP-MOD": "CM-2",
        "NIST-800-171": "3.4.1",
        "RMF": "CM-2"
      },
      "namespace": "INF"
    },
    "CM-3.1": {
      "procedure_id": "CM-3.1",
      "parent_control": "CM-3",
      "title": "Configuration Change Control - Cron Jobs Count",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-3_CRON_JOBS",
      "factors": {
        "factor_a": {
          "label": "max_scheduled_tasks",
          "description": "The expected or required value (the standard).",
          "default": 80
        },
        "factor_b": {
          "label": "active_scheduled_tasks",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.3",
        "FEDRAMP-HIGH": "CM-3",
        "FEDRAMP-MOD": "CM-3",
        "NIST-800-171": "3.4.3",
        "RMF": "CM-3"
      },
      "namespace": "INF"
    },
    "CM-5.1": {
      "procedure_id": "CM-5.1",
      "parent_control": "CM-5",
      "title": "Access Restrictions for Change - /etc Owned by Root",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-5_ETC_OWNERSHIP",
      "factors": {
        "factor_a": {
          "label": "max_non_root_etc_files",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "non_root_etc_files",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.5",
        "FEDRAMP-HIGH": "CM-5",
        "FEDRAMP-MOD": "CM-5",
        "NIST-800-171": "3.4.5",
        "RMF": "CM-5"
      },
      "namespace": "INF"
    },
    "CM-6.1": {
      "procedure_id": "CM-6.1",
      "parent_control": "CM-6",
      "title": "Configuration Settings - SSH Root Login Disabled",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-6_SSH_ROOT_LOGIN",
      "factors": {
        "factor_a": {
          "label": "smbv1_disabled_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "smbv1_disabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.2",
        "FEDRAMP-HIGH": "CM-6",
        "FEDRAMP-MOD": "CM-6",
        "NIST-800-171": "3.4.2",
        "RMF": "CM-6"
      },
      "namespace": "INF"
    },
    "CM-6.2": {
      "procedure_id": "CM-6.2",
      "parent_control": "CM-6",
      "title": "Configuration Settings - SSH Password Auth Disabled",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-6_SSH_PASSWORD_AUTH",
      "factors": {
        "factor_a": {
          "label": "script_block_logging_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "script_block_logging_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.2",
        "FEDRAMP-HIGH": "CM-6",
        "FEDRAMP-MOD": "CM-6",
        "NIST-800-171": "3.4.2",
        "RMF": "CM-6"
      },
      "namespace": "INF"
    },
    "CM-6.3": {
      "procedure_id": "CM-6.3",
      "parent_control": "CM-6",
      "title": "Configuration Settings - Core Dumps Disabled",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-6_CORE_DUMPS",
      "factors": {
        "factor_a": {
          "label": "unencrypted_traffic_max",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "unencrypted_traffic_allowed",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.2",
        "FEDRAMP-HIGH": "CM-6",
        "FEDRAMP-MOD": "CM-6",
        "NIST-800-171": "3.4.2",
        "RMF": "CM-6"
      },
      "namespace": "INF"
    },
    "CM-6.4": {
      "procedure_id": "CM-6.4",
      "parent_control": "CM-6",
      "title": "Configuration Settings - SSH MaxAuthTries",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-6_SSH_MAXAUTHTRIES",
      "factors": {
        "factor_a": {
          "label": "wdigest_disabled_required",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "wdigest_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.2",
        "FEDRAMP-HIGH": "CM-6",
        "FEDRAMP-MOD": "CM-6",
        "NIST-800-171": "3.4.2",
        "RMF": "CM-6"
      },
      "namespace": "INF"
    },
    "CM-7.1": {
      "procedure_id": "CM-7.1",
      "parent_control": "CM-7",
      "title": "Least Functionality - Running Services Count",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-7_RUNNING_SERVICES",
      "factors": {
        "factor_a": {
          "label": "spooler_stopped_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "spooler_stopped",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.6",
        "FEDRAMP-HIGH": "CM-7",
        "FEDRAMP-MOD": "CM-7",
        "NIST-800-171": "3.4.6",
        "RMF": "CM-7"
      },
      "namespace": "INF"
    },
    "CM-7.2": {
      "procedure_id": "CM-7.2",
      "parent_control": "CM-7",
      "title": "Least Functionality - Unnecessary Network Protocols",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-7_UNNECESSARY_PROTOCOLS",
      "factors": {
        "factor_a": {
          "label": "ftp_service_max",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "ftp_service_present",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.7",
        "FEDRAMP-HIGH": "CM-7",
        "FEDRAMP-MOD": "CM-7",
        "NIST-800-171": "3.4.7",
        "RMF": "CM-7"
      },
      "namespace": "INF"
    },
    "CM-7.3": {
      "procedure_id": "CM-7.3",
      "parent_control": "CM-7",
      "title": "Least Functionality - Open Listening Ports",
      "category": "CONFIGURATION",
      "scope": "linux_infra",
      "check_type": "CM-7_LISTENING_PORTS",
      "factors": {
        "factor_a": {
          "label": "max_privileged_containers",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "privileged_containers_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CM.L2-3.4.8",
        "FEDRAMP-HIGH": "CM-7",
        "FEDRAMP-MOD": "CM-7",
        "NIST-800-171": "3.4.8",
        "RMF": "CM-7"
      },
      "namespace": "INF"
    },
    "CP-1.1": {
      "procedure_id": "CP-1.1",
      "parent_control": "CP-1",
      "title": "Contingency Planning Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RE.L2-3.8.9",
        "FEDRAMP-HIGH": "CP-1",
        "FEDRAMP-MOD": "CP-1",
        "NIST-800-171": "3.8.9",
        "RMF": "CP-1"
      },
      "namespace": "INF"
    },
    "CP-2.1": {
      "procedure_id": "CP-2.1",
      "parent_control": "CP-2",
      "title": "Contingency Plan",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RE.L2-3.8.9",
        "FEDRAMP-HIGH": "CP-2",
        "FEDRAMP-MOD": "CP-2",
        "NIST-800-171": "3.8.9",
        "RMF": "CP-2"
      },
      "namespace": "INF"
    },
    "CP-3.1": {
      "procedure_id": "CP-3.1",
      "parent_control": "CP-3",
      "title": "Contingency Training",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RE.L2-3.8.9",
        "FEDRAMP-HIGH": "CP-3",
        "FEDRAMP-MOD": "CP-3",
        "NIST-800-171": "3.8.9",
        "RMF": "CP-3"
      },
      "namespace": "INF"
    },
    "CP-4.1": {
      "procedure_id": "CP-4.1",
      "parent_control": "CP-4",
      "title": "Contingency Plan Testing",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RE.L2-3.8.9",
        "FEDRAMP-HIGH": "CP-4",
        "FEDRAMP-MOD": "CP-4",
        "NIST-800-171": "3.8.9",
        "RMF": "CP-4"
      },
      "namespace": "INF"
    },
    "CP-9.1": {
      "procedure_id": "CP-9.1",
      "parent_control": "CP-9",
      "title": "Information System Backup",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RE.L2-3.8.9",
        "FEDRAMP-HIGH": "CP-9",
        "FEDRAMP-MOD": "CP-9",
        "NIST-800-171": "3.8.9",
        "RMF": "CP-9"
      },
      "namespace": "INF"
    },
    "IA-2.1": {
      "procedure_id": "IA-2.1",
      "parent_control": "IA-2",
      "title": "Identification and Authentication - SSH Key Auth Enabled",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "IA-2_SSH_KEY_AUTH",
      "factors": {
        "factor_a": {
          "label": "mfa_enforcement_required",
          "description": "Whether multi-factor authentication must be enforced for privileged access (1 = required).",
          "default": 1
        },
        "factor_b": {
          "label": "mfa_enforcement_active",
          "description": "Whether MFA is configured and enforced on the authentication system (1 = active, 0 = disabled or not configured)."
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms multi-factor authentication is enforced for all privileged access. One of three critical gate controls (with SC-7.7 and AC-2.1)."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L1-3.5.1",
        "FEDRAMP-HIGH": "IA-2",
        "FEDRAMP-MOD": "IA-2",
        "NIST-800-171": "3.5.1",
        "RMF": "IA-2"
      },
      "namespace": "INF"
    },
    "IA-2.2": {
      "procedure_id": "IA-2.2",
      "parent_control": "IA-2",
      "title": "Multi-Factor Authentication - PAM MFA Module",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-2_MFA_MODULE",
      "factors": {
        "factor_a": {
          "label": "mfa_module_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "mfa_modules_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.3",
        "FEDRAMP-HIGH": "IA-2",
        "FEDRAMP-MOD": "IA-2",
        "NIST-800-171": "3.5.3",
        "RMF": "IA-2"
      },
      "namespace": "INF"
    },
    "IA-2.3": {
      "procedure_id": "IA-2.3",
      "parent_control": "IA-2",
      "title": "Administrative Account Inventory - Sudo/Root Group Members",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-2_ADMIN_INVENTORY",
      "factors": {
        "factor_a": {
          "label": "max_admin_users",
          "description": "The expected or required value (the standard).",
          "default": 5
        },
        "factor_b": {
          "label": "admin_users_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "FEDRAMP-HIGH": "IA-2",
        "FEDRAMP-MOD": "IA-2",
        "RMF": "IA-2"
      },
      "namespace": "INF"
    },
    "IA-4.1": {
      "procedure_id": "IA-4.1",
      "parent_control": "IA-4",
      "title": "Identifier Management - No Duplicate UIDs",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-4_DUPLICATE_UIDS",
      "factors": {
        "factor_a": {
          "label": "guest_disabled_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "guest_account_disabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L1-3.5.2",
        "FEDRAMP-HIGH": "IA-4",
        "FEDRAMP-MOD": "IA-4",
        "NIST-800-171": "3.5.2",
        "RMF": "IA-4"
      },
      "namespace": "INF"
    },
    "IA-4.2": {
      "procedure_id": "IA-4.2",
      "parent_control": "IA-4",
      "title": "Identifier Management - No Duplicate GIDs",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-4_DUPLICATE_GIDS",
      "factors": {
        "factor_a": {
          "label": "admin_renamed_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "admin_renamed",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L1-3.5.2",
        "FEDRAMP-HIGH": "IA-4",
        "FEDRAMP-MOD": "IA-4",
        "NIST-800-171": "3.5.2",
        "RMF": "IA-4"
      },
      "namespace": "INF"
    },
    "IA-5.1": {
      "procedure_id": "IA-5.1",
      "parent_control": "IA-5",
      "title": "Authenticator Management - Password Minimum Length",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-5_PASSWORD_MIN_LENGTH",
      "factors": {
        "factor_a": {
          "label": "min_password_length_required",
          "description": "The expected or required value (the standard).",
          "default": 14
        },
        "factor_b": {
          "label": "min_password_length_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.7",
        "FEDRAMP-HIGH": "IA-5",
        "FEDRAMP-MOD": "IA-5",
        "NIST-800-171": "3.5.7",
        "RMF": "IA-5"
      },
      "namespace": "INF"
    },
    "IA-5.2": {
      "procedure_id": "IA-5.2",
      "parent_control": "IA-5",
      "title": "Authenticator Management - PAM Password Quality Module",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-5_PAM_PASSWORD_QUALITY",
      "factors": {
        "factor_a": {
          "label": "complexity_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "complexity_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.7",
        "FEDRAMP-HIGH": "IA-5",
        "FEDRAMP-MOD": "IA-5",
        "NIST-800-171": "3.5.7",
        "RMF": "IA-5"
      },
      "namespace": "INF"
    },
    "IA-5.3": {
      "procedure_id": "IA-5.3",
      "parent_control": "IA-5",
      "title": "Authenticator Management - Password Maximum Age",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-5_PASSWORD_MAX_AGE",
      "factors": {
        "factor_a": {
          "label": "max_password_age_days",
          "description": "The expected or required value (the standard).",
          "default": 60
        },
        "factor_b": {
          "label": "configured_max_age_days",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.8",
        "FEDRAMP-HIGH": "IA-5",
        "FEDRAMP-MOD": "IA-5",
        "NIST-800-171": "3.5.8",
        "RMF": "IA-5"
      },
      "namespace": "INF"
    },
    "IA-5.4": {
      "procedure_id": "IA-5.4",
      "parent_control": "IA-5",
      "title": "Authenticator Management - Password History Enforced",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-5_PASSWORD_HISTORY",
      "factors": {
        "factor_a": {
          "label": "min_password_history",
          "description": "The expected or required value (the standard).",
          "default": 24
        },
        "factor_b": {
          "label": "password_history_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.8",
        "FEDRAMP-HIGH": "IA-5",
        "FEDRAMP-MOD": "IA-5",
        "NIST-800-171": "3.5.8",
        "RMF": "IA-5"
      },
      "namespace": "INF"
    },
    "IA-5.5": {
      "procedure_id": "IA-5.5",
      "parent_control": "IA-5",
      "title": "Authenticator Management - Password Minimum Age",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-5_PASSWORD_MIN_AGE",
      "factors": {
        "factor_a": {
          "label": "min_password_age_days",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "configured_min_age_days",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.9",
        "FEDRAMP-HIGH": "IA-5",
        "FEDRAMP-MOD": "IA-5",
        "NIST-800-171": "3.5.9",
        "RMF": "IA-5"
      },
      "namespace": "INF"
    },
    "IA-5.6": {
      "procedure_id": "IA-5.6",
      "parent_control": "IA-5",
      "title": "Authenticator Management - Password Warn Age",
      "category": "ACCESS",
      "scope": "linux_infra",
      "check_type": "IA-5_PASSWORD_WARN_AGE",
      "factors": {
        "factor_a": {
          "label": "min_lockout_duration_minutes",
          "description": "The expected or required value (the standard).",
          "default": 15
        },
        "factor_b": {
          "label": "lockout_duration_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "IA.L2-3.5.10",
        "FEDRAMP-HIGH": "IA-5",
        "FEDRAMP-MOD": "IA-5",
        "NIST-800-171": "3.5.10",
        "RMF": "IA-5"
      },
      "namespace": "INF"
    },
    "IR-1.1": {
      "procedure_id": "IR-1.1",
      "parent_control": "IR-1",
      "title": "Incident Response Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Organization maintains incident response policy with annual review"
      },
      "frameworks": {
        "CMMC-v2.0": "IR.L2-3.6.1",
        "FEDRAMP-HIGH": "IR-1",
        "FEDRAMP-MOD": "IR-1",
        "NIST-800-171": "3.6.1",
        "RMF": "IR-1"
      },
      "namespace": "INF"
    },
    "IR-2.1": {
      "procedure_id": "IR-2.1",
      "parent_control": "IR-2",
      "title": "Incident Response Training",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Organization provides incident response training per assigned roles"
      },
      "frameworks": {
        "CMMC-v2.0": "IR.L2-3.6.2",
        "FEDRAMP-HIGH": "IR-2",
        "FEDRAMP-MOD": "IR-2",
        "NIST-800-171": "3.6.2",
        "RMF": "IR-2"
      },
      "namespace": "INF"
    },
    "IR-4.1": {
      "procedure_id": "IR-4.1",
      "parent_control": "IR-4",
      "title": "Incident Handling",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Organization implements incident handling capability (prepare/detect/analyze/contain/eradicate/recover)"
      },
      "frameworks": {
        "CMMC-v2.0": "IR.L2-3.6.1",
        "FEDRAMP-HIGH": "IR-4",
        "FEDRAMP-MOD": "IR-4",
        "NIST-800-171": "3.6.1",
        "RMF": "IR-4"
      },
      "namespace": "INF"
    },
    "IR-5.1": {
      "procedure_id": "IR-5.1",
      "parent_control": "IR-5",
      "title": "Incident Monitoring",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Organization tracks and documents security incidents on an ongoing basis"
      },
      "frameworks": {
        "CMMC-v2.0": "IR.L2-3.6.1",
        "FEDRAMP-HIGH": "IR-5",
        "FEDRAMP-MOD": "IR-5",
        "NIST-800-171": "3.6.1",
        "RMF": "IR-5"
      },
      "namespace": "INF"
    },
    "IR-6.1": {
      "procedure_id": "IR-6.1",
      "parent_control": "IR-6",
      "title": "Incident Reporting",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Organization requires timely incident reporting to response team and external authorities"
      },
      "frameworks": {
        "CMMC-v2.0": "IR.L2-3.6.2",
        "FEDRAMP-HIGH": "IR-6",
        "FEDRAMP-MOD": "IR-6",
        "NIST-800-171": "3.6.2",
        "RMF": "IR-6"
      },
      "namespace": "INF"
    },
    "IR-8.1": {
      "procedure_id": "IR-8.1",
      "parent_control": "IR-8",
      "title": "Incident Response Plan",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Organization develops and maintains an incident response plan reviewed by the AO"
      },
      "frameworks": {
        "CMMC-v2.0": "IR.L2-3.6.3",
        "FEDRAMP-HIGH": "IR-8",
        "FEDRAMP-MOD": "IR-8",
        "NIST-800-171": "3.6.3",
        "RMF": "IR-8"
      },
      "namespace": "INF"
    },
    "MA-1.1": {
      "procedure_id": "MA-1.1",
      "parent_control": "MA-1",
      "title": "Maintenance Policy Document",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MA-1_POLICY_DOCUMENT",
      "factors": {
        "factor_a": {
          "label": "max_policy_age_days",
          "description": "The expected or required value (the standard).",
          "default": 365
        },
        "factor_b": {
          "label": "policy_age_days",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Policy age (B) must not exceed max (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MA-1",
        "FEDRAMP-MOD": "MA-1",
        "RMF": "MA-1"
      },
      "namespace": "INF"
    },
    "MA-2.1": {
      "procedure_id": "MA-2.1",
      "parent_control": "MA-2",
      "title": "Controlled Maintenance",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: maintenance is scheduled and documented"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MA-2",
        "FEDRAMP-MOD": "MA-2",
        "NIST-800-171": "3.7.1",
        "RMF": "MA-2"
      },
      "namespace": "INF"
    },
    "MA-3.1": {
      "procedure_id": "MA-3.1",
      "parent_control": "MA-3",
      "title": "Maintenance Tools - Integrity Tools Installed",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MA-3_INTEGRITY_TOOLS",
      "factors": {
        "factor_a": {
          "label": "min_integrity_tools",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "integrity_tools_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Integrity tools found (B) must meet minimum (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MA-3",
        "FEDRAMP-MOD": "MA-3",
        "NIST-800-171": "3.7.2",
        "RMF": "MA-3"
      },
      "namespace": "INF"
    },
    "MA-3.2": {
      "procedure_id": "MA-3.2",
      "parent_control": "MA-3",
      "title": "Maintenance Tool Inspection",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: tools inspected before use"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MA-3",
        "FEDRAMP-MOD": "MA-3",
        "RMF": "MA-3"
      },
      "namespace": "INF"
    },
    "MA-5.1": {
      "procedure_id": "MA-5.1",
      "parent_control": "MA-5",
      "title": "Maintenance Personnel Authorization",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: personnel authorized and supervised"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MA-5",
        "FEDRAMP-MOD": "MA-5",
        "NIST-800-171": "3.7.3",
        "RMF": "MA-5"
      },
      "namespace": "INF"
    },
    "MA-6.1": {
      "procedure_id": "MA-6.1",
      "parent_control": "MA-6",
      "title": "Timely Maintenance - Recent Maintenance Activity",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MA-6_TIMELY_MAINTENANCE",
      "factors": {
        "factor_a": {
          "label": "min_maintenance_events",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "maintenance_events_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Maintenance events (B) must meet minimum (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MA-6",
        "FEDRAMP-MOD": "MA-6",
        "NIST-800-171": "3.7.6",
        "RMF": "MA-6"
      },
      "namespace": "INF"
    },
    "MP-1.1": {
      "procedure_id": "MP-1.1",
      "parent_control": "MP-1",
      "title": "Media Protection Policy Document",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MP-1_POLICY_DOCUMENT",
      "factors": {
        "factor_a": {
          "label": "max_policy_age_days",
          "description": "The expected or required value (the standard).",
          "default": 365
        },
        "factor_b": {
          "label": "policy_age_days",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Policy age (B) must not exceed max (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-1",
        "FEDRAMP-MOD": "MP-1",
        "NIST-800-171": "3.8.1",
        "RMF": "MP-1"
      },
      "namespace": "INF"
    },
    "MP-2.1": {
      "procedure_id": "MP-2.1",
      "parent_control": "MP-2",
      "title": "Media Access Control - USB Block Devices",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MP-2_USB_DEVICES",
      "factors": {
        "factor_a": {
          "label": "max_usb_block_devices",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "usb_block_devices",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "USB devices (B) must not exceed max (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-2",
        "FEDRAMP-MOD": "MP-2",
        "NIST-800-171": "3.8.2",
        "RMF": "MP-2"
      },
      "namespace": "INF"
    },
    "MP-3.1": {
      "procedure_id": "MP-3.1",
      "parent_control": "MP-3",
      "title": "Media Marking",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: CUI media properly marked"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-3",
        "FEDRAMP-MOD": "MP-3",
        "NIST-800-171": "3.8.3",
        "RMF": "MP-3"
      },
      "namespace": "INF"
    },
    "MP-4.1": {
      "procedure_id": "MP-4.1",
      "parent_control": "MP-4",
      "title": "Media Storage",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: CUI media in controlled areas"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-4",
        "FEDRAMP-MOD": "MP-4",
        "NIST-800-171": "3.8.4",
        "RMF": "MP-4"
      },
      "namespace": "INF"
    },
    "MP-5.1": {
      "procedure_id": "MP-5.1",
      "parent_control": "MP-5",
      "title": "Media Transport Encryption",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: CUI encrypted during transport"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-5",
        "FEDRAMP-MOD": "MP-5",
        "NIST-800-171": "3.8.5",
        "RMF": "MP-5"
      },
      "namespace": "INF"
    },
    "MP-6.1": {
      "procedure_id": "MP-6.1",
      "parent_control": "MP-6",
      "title": "Media Sanitization - Sanitization Tools Available",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MP-6_SANITIZATION_TOOLS",
      "factors": {
        "factor_a": {
          "label": "min_sanitization_tools",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "sanitization_tools_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Sanitization tools (B) must meet minimum (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-6",
        "FEDRAMP-MOD": "MP-6",
        "NIST-800-171": "3.8.6",
        "RMF": "MP-6"
      },
      "namespace": "INF"
    },
    "MP-7.1": {
      "procedure_id": "MP-7.1",
      "parent_control": "MP-7",
      "title": "Removable Media Usage - USB Storage Module Blocked",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "MP-7_USB_STORAGE_BLOCKED",
      "factors": {
        "factor_a": {
          "label": "max_usb_storage_modules",
          "description": "The expected or required value (the standard).",
          "default": 0
        },
        "factor_b": {
          "label": "usb_storage_modules_loaded",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "USB storage modules (B) must not exceed max (A)"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-7",
        "FEDRAMP-MOD": "MP-7",
        "NIST-800-171": "3.8.7",
        "RMF": "MP-7"
      },
      "namespace": "INF"
    },
    "MP-8.1": {
      "procedure_id": "MP-8.1",
      "parent_control": "MP-8",
      "title": "Media Disposal",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Attestation: media disposal procedures followed"
      },
      "frameworks": {
        "FEDRAMP-HIGH": "MP-8",
        "FEDRAMP-MOD": "MP-8",
        "RMF": "MP-8"
      },
      "namespace": "INF"
    },
    "PE-1.1": {
      "procedure_id": "PE-1.1",
      "parent_control": "PE-1",
      "title": "Physical Access Control",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PE.L1-3.10.1",
        "FEDRAMP-HIGH": "PE-1",
        "FEDRAMP-MOD": "PE-1",
        "NIST-800-171": "3.10.1",
        "RMF": "PE-1"
      },
      "namespace": "INF"
    },
    "PE-10.1": {
      "procedure_id": "PE-10.1",
      "parent_control": "PE-10",
      "title": "Emergency Power",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PE.L2-3.10.3",
        "FEDRAMP-HIGH": "PE-10",
        "FEDRAMP-MOD": "PE-10",
        "NIST-800-171": "3.10.3",
        "RMF": "PE-10"
      },
      "namespace": "INF"
    },
    "PE-13.1": {
      "procedure_id": "PE-13.1",
      "parent_control": "PE-13",
      "title": "Fire Protection",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PE.L2-3.10.6",
        "FEDRAMP-HIGH": "PE-13",
        "FEDRAMP-MOD": "PE-13",
        "NIST-800-171": "3.10.6",
        "RMF": "PE-13"
      },
      "namespace": "INF"
    },
    "PE-6.1": {
      "procedure_id": "PE-6.1",
      "parent_control": "PE-6",
      "title": "Physical Monitoring",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PE.L1-3.10.2",
        "FEDRAMP-HIGH": "PE-6",
        "FEDRAMP-MOD": "PE-6",
        "NIST-800-171": "3.10.2",
        "RMF": "PE-6"
      },
      "namespace": "INF"
    },
    "PL-1.1": {
      "procedure_id": "PL-1.1",
      "parent_control": "PL-1",
      "title": "Security Planning Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CA.L2-3.12.1",
        "FEDRAMP-HIGH": "PL-1",
        "FEDRAMP-MOD": "PL-1",
        "NIST-800-171": "3.12.1",
        "RMF": "PL-1"
      },
      "namespace": "INF"
    },
    "PL-2.1": {
      "procedure_id": "PL-2.1",
      "parent_control": "PL-2",
      "title": "System Security Plan",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CA.L2-3.12.4",
        "FEDRAMP-HIGH": "PL-2",
        "FEDRAMP-MOD": "PL-2",
        "NIST-800-171": "3.12.4",
        "RMF": "PL-2"
      },
      "namespace": "INF"
    },
    "PL-4.1": {
      "procedure_id": "PL-4.1",
      "parent_control": "PL-4",
      "title": "Rules of Behavior",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CA.L2-3.12.4",
        "FEDRAMP-HIGH": "PL-4",
        "FEDRAMP-MOD": "PL-4",
        "NIST-800-171": "3.12.4",
        "RMF": "PL-4"
      },
      "namespace": "INF"
    },
    "PS-1.1": {
      "procedure_id": "PS-1.1",
      "parent_control": "PS-1",
      "title": "Personnel Security Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "max_policy_age_days",
          "description": "The expected or required value (the standard).",
          "default": 365
        },
        "factor_b": {
          "label": "policy_age_days",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PS.L2-3.9.1",
        "FEDRAMP-HIGH": "PS-1",
        "FEDRAMP-MOD": "PS-1",
        "NIST-800-171": "3.9.1",
        "RMF": "PS-1"
      },
      "namespace": "INF"
    },
    "PS-3.1": {
      "procedure_id": "PS-3.1",
      "parent_control": "PS-3",
      "title": "Personnel Screening",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PS.L2-3.9.1",
        "FEDRAMP-HIGH": "PS-3",
        "FEDRAMP-MOD": "PS-3",
        "NIST-800-171": "3.9.1",
        "RMF": "PS-3"
      },
      "namespace": "INF"
    },
    "PS-4.1": {
      "procedure_id": "PS-4.1",
      "parent_control": "PS-4",
      "title": "Personnel Termination",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PS.L2-3.9.2",
        "FEDRAMP-HIGH": "PS-4",
        "FEDRAMP-MOD": "PS-4",
        "NIST-800-171": "3.9.2",
        "RMF": "PS-4"
      },
      "namespace": "INF"
    },
    "PS-5.1": {
      "procedure_id": "PS-5.1",
      "parent_control": "PS-5",
      "title": "Personnel Transfer",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "PS.L2-3.9.2",
        "FEDRAMP-HIGH": "PS-5",
        "FEDRAMP-MOD": "PS-5",
        "NIST-800-171": "3.9.2",
        "RMF": "PS-5"
      },
      "namespace": "INF"
    },
    "RA-1.1": {
      "procedure_id": "RA-1.1",
      "parent_control": "RA-1",
      "title": "Risk Assessment Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RA.L2-3.11.1",
        "FEDRAMP-HIGH": "RA-1",
        "FEDRAMP-MOD": "RA-1",
        "NIST-800-171": "3.11.1",
        "RMF": "RA-1"
      },
      "namespace": "INF"
    },
    "RA-3.1": {
      "procedure_id": "RA-3.1",
      "parent_control": "RA-3",
      "title": "Risk Assessment",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RA.L2-3.11.1",
        "FEDRAMP-HIGH": "RA-3",
        "FEDRAMP-MOD": "RA-3",
        "NIST-800-171": "3.11.1",
        "RMF": "RA-3"
      },
      "namespace": "INF"
    },
    "RA-5.1": {
      "procedure_id": "RA-5.1",
      "parent_control": "RA-5",
      "title": "Vulnerability Scanning",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "RA.L2-3.11.2",
        "FEDRAMP-HIGH": "RA-5",
        "FEDRAMP-MOD": "RA-5",
        "NIST-800-171": "3.11.2",
        "RMF": "RA-5"
      },
      "namespace": "INF"
    },
    "SA-1.1": {
      "procedure_id": "SA-1.1",
      "parent_control": "SA-1",
      "title": "System Acquisition Policy",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CA.L2-3.12.1",
        "FEDRAMP-HIGH": "SA-1",
        "FEDRAMP-MOD": "SA-1",
        "NIST-800-171": "3.12.1",
        "RMF": "SA-1"
      },
      "namespace": "INF"
    },
    "SA-4.1": {
      "procedure_id": "SA-4.1",
      "parent_control": "SA-4",
      "title": "Acquisition Process",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CA.L2-3.12.2",
        "FEDRAMP-HIGH": "SA-4",
        "FEDRAMP-MOD": "SA-4",
        "NIST-800-171": "3.12.2",
        "RMF": "SA-4"
      },
      "namespace": "INF"
    },
    "SA-9.1": {
      "procedure_id": "SA-9.1",
      "parent_control": "SA-9",
      "title": "External System Services",
      "category": "attestation_policy",
      "scope": "attestation_policy",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "",
          "description": "The expected or required value (the standard).",
          "default": ""
        },
        "factor_b": {
          "label": "",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "CA.L2-3.12.3",
        "FEDRAMP-HIGH": "SA-9",
        "FEDRAMP-MOD": "SA-9",
        "NIST-800-171": "3.12.3",
        "RMF": "SA-9"
      },
      "namespace": "INF"
    },
    "SC-10.1": {
      "procedure_id": "SC-10.1",
      "parent_control": "SC-10",
      "title": "Network Disconnect - TCP Keepalive Configuration",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-10_TCP_KEEPALIVE",
      "factors": {
        "factor_a": {
          "label": "max_keepalive_seconds",
          "description": "The expected or required value (the standard).",
          "default": 600
        },
        "factor_b": {
          "label": "keepalive_seconds",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L2-3.13.9",
        "FEDRAMP-HIGH": "SC-10",
        "FEDRAMP-MOD": "SC-10",
        "NIST-800-171": "3.13.9",
        "RMF": "SC-10"
      },
      "namespace": "INF"
    },
    "SC-12.1": {
      "procedure_id": "SC-12.1",
      "parent_control": "SC-12",
      "title": "Cryptographic Key Management - SSH Crypto Settings",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-12_SSH_CRYPTO",
      "factors": {
        "factor_a": {
          "label": "min_crypto_settings",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "crypto_settings_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L2-3.13.10",
        "FEDRAMP-HIGH": "SC-12",
        "FEDRAMP-MOD": "SC-12",
        "NIST-800-171": "3.13.10",
        "RMF": "SC-12"
      },
      "namespace": "INF"
    },
    "SC-28.1": {
      "procedure_id": "SC-28.1",
      "parent_control": "SC-28",
      "title": "Protection of Information at Rest - Encrypted Partitions",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-28_ENCRYPTION_AT_REST",
      "factors": {
        "factor_a": {
          "label": "bitlocker_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "bitlocker_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L2-3.13.16",
        "FEDRAMP-HIGH": "SC-28",
        "FEDRAMP-MOD": "SC-28",
        "NIST-800-171": "3.13.16",
        "RMF": "SC-28"
      },
      "namespace": "INF"
    },
    "SC-28.2": {
      "procedure_id": "SC-28.2",
      "parent_control": "SC-28",
      "title": "Database Encryption at Rest - Postgres Data Checksums",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SC-28_PG_DATA_CHECKSUMS",
      "factors": {
        "factor_a": {
          "label": "data_checksums_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "data_checksums_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "FEDRAMP-HIGH": "SC-28",
        "FEDRAMP-MOD": "SC-28",
        "RMF": "SC-28"
      },
      "namespace": "INF"
    },
    "SC-5.1": {
      "procedure_id": "SC-5.1",
      "parent_control": "SC-5",
      "title": "Denial of Service Protection - SYN Cookies Enabled",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-5_SYN_COOKIES",
      "factors": {
        "factor_a": {
          "label": "syn_cookies_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "syn_cookies_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L1-3.13.1",
        "FEDRAMP-HIGH": "SC-5",
        "FEDRAMP-MOD": "SC-5",
        "NIST-800-171": "3.13.1",
        "RMF": "SC-5"
      },
      "namespace": "INF"
    },
    "SC-7.6": {
      "procedure_id": "SC-7.6",
      "parent_control": "SC-7",
      "title": "Boundary Protection - Listening Services",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-7_LISTENING_SERVICES",
      "factors": {
        "factor_a": {
          "label": "default_block_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "default_block_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L1-3.13.1",
        "FEDRAMP-HIGH": "SC-7",
        "FEDRAMP-MOD": "SC-7",
        "NIST-800-171": "3.13.1",
        "RMF": "SC-7"
      },
      "namespace": "INF"
    },
    "SC-7.7": {
      "procedure_id": "SC-7.7",
      "parent_control": "SC-7",
      "title": "Boundary Protection - Firewall Active",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-7_FIREWALL_ACTIVE",
      "factors": {
        "factor_a": {
          "label": "boundary_protection_required",
          "description": "Whether network boundary protection must be active (1 = yes). Maps to NIST SC-7: Boundary Protection.",
          "default": 1
        },
        "factor_b": {
          "label": "boundary_protection_active",
          "description": "Whether the host firewall (iptables/nftables/ufw) has active FORWARD chain rules preventing unauthorized transit traffic."
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Verifies the system enforces network boundary protection at the host level. Critical control for any enclave processing CUI."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L1-3.13.1",
        "FEDRAMP-HIGH": "SC-7",
        "FEDRAMP-MOD": "SC-7",
        "NIST-800-171": "3.13.1",
        "RMF": "SC-7"
      },
      "namespace": "INF"
    },
    "SC-7.8": {
      "procedure_id": "SC-7.8",
      "parent_control": "SC-7",
      "title": "Boundary Protection - Default Deny INPUT Policy",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-7_DEFAULT_DENY",
      "factors": {
        "factor_a": {
          "label": "firewall_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "private_firewall_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L1-3.13.5",
        "FEDRAMP-HIGH": "SC-7",
        "FEDRAMP-MOD": "SC-7",
        "NIST-800-171": "3.13.5",
        "RMF": "SC-7"
      },
      "namespace": "INF"
    },
    "SC-8.1": {
      "procedure_id": "SC-8.1",
      "parent_control": "SC-8",
      "title": "Transmission Confidentiality - TLS Configuration",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "SC-8_TLS_CONFIGURATION",
      "factors": {
        "factor_a": {
          "label": "ssl3_disabled_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "ssl3_disabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "TLS: encrypted connections (B) must meet required percentage (A)"
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L2-3.13.8",
        "FEDRAMP-HIGH": "SC-8",
        "FEDRAMP-MOD": "SC-8",
        "NIST-800-171": "3.13.8",
        "RMF": "SC-8"
      },
      "namespace": "INF"
    },
    "SC-8.2": {
      "procedure_id": "SC-8.2",
      "parent_control": "SC-8",
      "title": "Transmission Confidentiality - Weak SSL Protocols Disabled",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-8_WEAK_PROTOCOLS",
      "factors": {
        "factor_a": {
          "label": "tls10_disabled_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "tls10_disabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SC.L2-3.13.8",
        "FEDRAMP-HIGH": "SC-8",
        "FEDRAMP-MOD": "SC-8",
        "NIST-800-171": "3.13.8",
        "RMF": "SC-8"
      },
      "namespace": "INF"
    },
    "SC-8.3": {
      "procedure_id": "SC-8.3",
      "parent_control": "SC-8",
      "title": "Database Transport Encryption - Postgres SSL Active",
      "category": "NETWORK",
      "scope": "linux_infra",
      "check_type": "SC-8_PG_SSL",
      "factors": {
        "factor_a": {
          "label": "ssl_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "ssl_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {},
      "namespace": "INF"
    },
    "SI-2.1": {
      "procedure_id": "SI-2.1",
      "parent_control": "SI-2",
      "title": "Flaw Remediation - Pending Security Updates",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "SI-2_SECURITY_UPDATES",
      "factors": {
        "factor_a": {
          "label": "recent_patches_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "recent_patches_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Patching: unpatched systems (B) must not exceed threshold (A)"
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L1-3.14.1",
        "FEDRAMP-HIGH": "SI-2",
        "FEDRAMP-MOD": "SI-2",
        "NIST-800-171": "3.14.1",
        "RMF": "SI-2"
      },
      "namespace": "INF"
    },
    "SI-2.2": {
      "procedure_id": "SI-2.2",
      "parent_control": "SI-2",
      "title": "Flaw Remediation - Automatic Updates Enabled",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-2_AUTO_UPDATES",
      "factors": {
        "factor_a": {
          "label": "wsus_configured_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "wsus_configured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L1-3.14.1",
        "FEDRAMP-HIGH": "SI-2",
        "FEDRAMP-MOD": "SI-2",
        "NIST-800-171": "3.14.1",
        "RMF": "SI-2"
      },
      "namespace": "INF"
    },
    "SI-2.3": {
      "procedure_id": "SI-2.3",
      "parent_control": "SI-2",
      "title": "Flaw Remediation - System Reboot Required",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-2_REBOOT_REQUIRED",
      "factors": {
        "factor_a": {
          "label": "max_stale_images",
          "description": "The expected or required value (the standard).",
          "default": 5
        },
        "factor_b": {
          "label": "stale_images_found",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L1-3.14.1",
        "FEDRAMP-HIGH": "SI-2",
        "FEDRAMP-MOD": "SI-2",
        "NIST-800-171": "3.14.1",
        "RMF": "SI-2"
      },
      "namespace": "INF"
    },
    "SI-3.1": {
      "procedure_id": "SI-3.1",
      "parent_control": "SI-3",
      "title": "Malicious Code Protection - Antimalware Presence",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-3_ANTIMALWARE",
      "factors": {
        "factor_a": {
          "label": "antivirus_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "antivirus_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L1-3.14.2",
        "FEDRAMP-HIGH": "SI-3",
        "FEDRAMP-MOD": "SI-3",
        "NIST-800-171": "3.14.2",
        "RMF": "SI-3"
      },
      "namespace": "INF"
    },
    "SI-4.1": {
      "procedure_id": "SI-4.1",
      "parent_control": "SI-4",
      "title": "System Monitoring - Auditd Active",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "SI-4_AUDITD_ACTIVE",
      "factors": {
        "factor_a": {
          "label": "min_app_log_kb",
          "description": "The expected or required value (the standard).",
          "default": 32768
        },
        "factor_b": {
          "label": "app_log_size_kb",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Monitoring: active sensors (B) must meet required count (A)"
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L2-3.14.6",
        "FEDRAMP-HIGH": "SI-4",
        "FEDRAMP-MOD": "SI-4",
        "NIST-800-171": "3.14.6",
        "RMF": "SI-4"
      },
      "namespace": "INF"
    },
    "SI-4.2": {
      "procedure_id": "SI-4.2",
      "parent_control": "SI-4",
      "title": "System Monitoring - Audit Rules Count",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-4_AUDIT_RULES_COUNT",
      "factors": {
        "factor_a": {
          "label": "min_system_log_kb",
          "description": "The expected or required value (the standard).",
          "default": 32768
        },
        "factor_b": {
          "label": "system_log_size_kb",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L2-3.14.7",
        "FEDRAMP-HIGH": "SI-4",
        "FEDRAMP-MOD": "SI-4",
        "NIST-800-171": "3.14.7",
        "RMF": "SI-4"
      },
      "namespace": "INF"
    },
    "SI-6.1": {
      "procedure_id": "SI-6.1",
      "parent_control": "SI-6",
      "title": "Security Function Verification - AppArmor or SELinux Active",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-6_MAC_ACTIVE",
      "factors": {
        "factor_a": {
          "label": "mac_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "mac_active",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L2-3.14.6",
        "FEDRAMP-HIGH": "SI-6",
        "FEDRAMP-MOD": "SI-6",
        "NIST-800-171": "3.14.6",
        "RMF": "SI-6"
      },
      "namespace": "INF"
    },
    "SI-7.1": {
      "procedure_id": "SI-7.1",
      "parent_control": "SI-7",
      "title": "Software and Information Integrity - File Integrity Tool",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-7_FILE_INTEGRITY",
      "factors": {
        "factor_a": {
          "label": "vbs_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "vbs_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L2-3.14.6",
        "FEDRAMP-HIGH": "SI-7",
        "FEDRAMP-MOD": "SI-7",
        "NIST-800-171": "3.14.6",
        "RMF": "SI-7"
      },
      "namespace": "INF"
    },
    "SI-7.2": {
      "procedure_id": "SI-7.2",
      "parent_control": "SI-7",
      "title": "Software Integrity - Package Verification",
      "category": "INTEGRITY",
      "scope": "linux_infra",
      "check_type": "SI-7_PACKAGE_VERIFICATION",
      "factors": {
        "factor_a": {
          "label": "credential_guard_required",
          "description": "The expected or required value (the standard).",
          "default": 1
        },
        "factor_b": {
          "label": "credential_guard_enabled",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Evaluates whether the measured value meets the required threshold."
      },
      "frameworks": {
        "CMMC-v2.0": "SI.L2-3.14.6",
        "FEDRAMP-HIGH": "SI-7",
        "FEDRAMP-MOD": "SI-7",
        "NIST-800-171": "3.14.6",
        "RMF": "SI-7"
      },
      "namespace": "INF"
    },
    "VARP-BASELINE": {
      "procedure_id": "VARP-BASELINE",
      "parent_control": "SI-2",
      "title": "VARP Baseline \u2014 All remediations completed",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "VARP Baseline Completeness",
      "factors": {
        "factor_a": {
          "label": "threshold",
          "description": "The expected or required value (the standard).",
          "default": null
        },
        "factor_b": {
          "label": "measured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "factor_a = remediations_required, factor_b = remediations_completed, factor_c = drift_count (must be 0). PASS when completed >= required."
      },
      "frameworks": {},
      "namespace": "INF"
    },
    "VARP-FLAGGED-REM": {
      "procedure_id": "VARP-FLAGGED-REM",
      "parent_control": "SI-2",
      "title": "VARP Flagged Items \u2014 All critical findings resolved",
      "category": "linux_infra",
      "scope": "linux_infra",
      "check_type": "VARP Flagged Items Remediation",
      "factors": {
        "factor_a": {
          "label": "threshold",
          "description": "The expected or required value (the standard).",
          "default": null
        },
        "factor_b": {
          "label": "measured",
          "description": "The observed or measured value (the reality)."
        },
        "factor_c": {
          "label": "difference",
          "description": "Additional context or delta value."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "factor_a = findings_flagged, factor_b = findings_resolved, factor_c = findings_outstanding. PASS when resolved >= flagged."
      },
      "frameworks": {},
      "namespace": "INF"
    },
    "AI-HITL.3": {
      "procedure_id": "AI-HITL.3",
      "parent_control": "AI-HITL",
      "title": "Overseer Identity Capture - Reviewer Identified Per Decision",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "identity_capture_required",
          "description": "Whether the identity of the natural person who reviewed or verified the AI output must be recorded (1 = required). EU AI Act Art.12(2)(d) mandate.",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 12(2)(d); NIST AI RMF GOVERN 1.1"
        },
        "factor_b": {
          "label": "identity_captured",
          "description": "Whether the reviewer's identity was captured and linked to the decision record (1 = captured, 0 = anonymous or missing).",
          "regulatory_ref": "EU AI Act Art. 12(2)(d); NIST AI RMF GOVERN 1.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms that every high-risk AI decision has a named human reviewer on record. Required by EU AI Act Article 12(2)(d) for traceability of human oversight."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(2)(d)",
        "FIVE-EYES-AGENTIC": "FE-5",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "GOVERN 4.1"
      },
      "namespace": "AI"
    },
    "AI-LOG.1": {
      "procedure_id": "AI-LOG.1",
      "parent_control": "AI-LOG",
      "title": "Log Retention Compliance - Minimum 180-Day Retention Verified",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI-LOG_RETENTION",
      "factors": {
        "factor_a": {
          "label": "min_retention_days",
          "description": "Minimum required log retention period in days. EU AI Act mandates 180 days (6 months) minimum for deployer-generated logs.",
          "default": 180,
          "regulatory_ref": "EU AI Act Art. 12(3)"
        },
        "factor_b": {
          "label": "actual_retention_days",
          "description": "Age in days of the oldest retained AI inference log. Must equal or exceed the minimum retention period.",
          "regulatory_ref": "EU AI Act Art. 12(3)"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Verifies that AI inference logs are retained for at least 6 months (180 days) as required by EU AI Act Article 12(3). A FAIL indicates logs are being purged too early."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(3)",
        "ISO-42001": "9.2",
        "NIST-800-53": "AU-11",
        "NIST-AI-RMF": "GOVERN 1.4",
        "NIS-2": "Art.21(2)(f)",
        "SG-IMDA-AGENTIC": "MGF-4.2"
      },
      "namespace": "AI"
    },
    "AI-MDL.4": {
      "procedure_id": "AI-MDL.4",
      "parent_control": "AI-MDL",
      "title": "Feedback Loop Control - Training Data Isolation From Biased Outputs",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "feedback_isolation_required",
          "description": "Whether feedback loop controls must be in place to prevent biased AI outputs from contaminating future training data (1 = required).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 15(4); NIST AI RMF MANAGE 2.2"
        },
        "factor_b": {
          "label": "feedback_isolation_active",
          "description": "Whether controls are active that prevent model outputs flagged as biased, inaccurate, or non-compliant from being fed back into training pipelines (1 = active, 0 = no controls).",
          "regulatory_ref": "EU AI Act Art. 15(4); NIST AI RMF MANAGE 2.2"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms that continuously learning AI systems have controls preventing biased outputs from poisoning future training data. Required by EU AI Act Article 15(4) for systems that continue to learn after deployment."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(4)",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "MAP 1.1",
        "SR-11-7": "III.B"
      },
      "namespace": "AI"
    },
    "FIN-GOV.1": {
      "procedure_id": "FIN-GOV.1",
      "parent_control": "FIN-GOV",
      "title": "Model Governance Committee Approval",
      "category": "FIN",
      "scope": "financial_services",
      "check_type": "FIN_GOVERNANCE_APPROVAL",
      "factors": {
        "factor_a": {
          "label": "committee_quorum_required",
          "description": "Minimum number of committee members required for a valid governance vote.",
          "default": 3,
          "regulatory_ref": "SR 11-7 Sec. III"
        },
        "factor_b": {
          "label": "votes_recorded",
          "description": "Number of committee votes actually recorded for this model decision.",
          "regulatory_ref": "SR 11-7 Sec. III"
        },
        "factor_c": {
          "label": "approval_flag",
          "description": "Whether the committee approved (1) or rejected (0) the model for production use.",
          "regulatory_ref": "SR 11-7 Sec. III"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c >= 1",
        "description": "Confirms the governance committee achieved quorum and approved the model. Maps to SR 11-7 Board and Senior Management Oversight."
      },
      "frameworks": {
        "SR-11-7": "SR11-7.III"
      },
      "namespace": "FIN"
    },
    "FIN-MRM.1": {
      "procedure_id": "FIN-MRM.1",
      "parent_control": "FIN-MRM",
      "title": "Model Inventory and Lineage",
      "category": "FIN",
      "scope": "financial_services",
      "check_type": "FIN_MODEL_INVENTORY",
      "factors": {
        "factor_a": {
          "label": "model_registration_required",
          "description": "Set to 1 indicating model must be registered in the inventory.",
          "default": 1,
          "regulatory_ref": "SR 11-7 Sec. V"
        },
        "factor_b": {
          "label": "model_hash_matches",
          "description": "Set to 1 if the deployed model hash matches the approved version in the inventory.",
          "regulatory_ref": "SR 11-7 Sec. V"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Verifies the model is registered in the firm-wide inventory and the deployed version matches the approved hash. Maps to SR 11-7 Model Inventory requirements."
      },
      "frameworks": {
        "SR-11-7": "SR11-7.V"
      },
      "namespace": "FIN"
    },
    "FIN-VAL.1": {
      "procedure_id": "FIN-VAL.1",
      "parent_control": "FIN-VAL",
      "title": "Independent Model Validation",
      "category": "FIN",
      "scope": "financial_services",
      "check_type": "FIN_INDEPENDENT_VALIDATION",
      "factors": {
        "factor_a": {
          "label": "validation_required",
          "description": "Set to 1 indicating independent validation is required.",
          "default": 1,
          "regulatory_ref": "SR 11-7 Sec. VI"
        },
        "factor_b": {
          "label": "validator_signed",
          "description": "Set to 1 if an independent validator has signed off on the model.",
          "regulatory_ref": "SR 11-7 Sec. VI"
        },
        "factor_c": {
          "label": "days_since_validation",
          "description": "Number of days since the last independent validation was completed.",
          "regulatory_ref": "SR 11-7 Sec. VI"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms an independent validator has performed effective challenge on the model. The days_since_validation factor provides staleness tracking. Maps to SR 11-7 Model Validation."
      },
      "frameworks": {
        "SR-11-7": "SR11-7.VI"
      },
      "namespace": "FIN"
    },
    "FIN-MON.1": {
      "procedure_id": "FIN-MON.1",
      "parent_control": "FIN-MON",
      "title": "Ongoing Performance Monitoring",
      "category": "FIN",
      "scope": "financial_services",
      "check_type": "FIN_PERFORMANCE_MONITORING",
      "factors": {
        "factor_a": {
          "label": "performance_threshold",
          "description": "Maximum acceptable value for the monitored metric (PSI, CSI, AUC degradation, etc.).",
          "regulatory_ref": "SR 11-7 Sec. VII"
        },
        "factor_b": {
          "label": "actual_metric",
          "description": "Current value of the monitored performance metric.",
          "regulatory_ref": "SR 11-7 Sec. VII"
        },
        "factor_c": {
          "label": "drift_flag",
          "description": "Set to 1 if the metric has breached the threshold (drift detected). 0 if within bounds.",
          "regulatory_ref": "SR 11-7 Sec. VII"
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a AND factor_c <= 0",
        "description": "Confirms the model performance metric is within the acceptable threshold and no drift has been flagged. Maps to SR 11-7 Ongoing Monitoring."
      },
      "frameworks": {
        "SR-11-7": "SR11-7.VII"
      },
      "namespace": "FIN"
    },
    "FIN-OUT.1": {
      "procedure_id": "FIN-OUT.1",
      "parent_control": "FIN-OUT",
      "title": "Outcomes Analysis (Back-testing)",
      "category": "FIN",
      "scope": "financial_services",
      "check_type": "FIN_OUTCOMES_ANALYSIS",
      "factors": {
        "factor_a": {
          "label": "sample_size_required",
          "description": "Minimum number of observations required for a statistically valid back-test.",
          "regulatory_ref": "SR 11-7 Sec. VIII"
        },
        "factor_b": {
          "label": "actual_sample_size",
          "description": "Number of observations actually used in the back-test.",
          "regulatory_ref": "SR 11-7 Sec. VIII"
        },
        "factor_c": {
          "label": "within_tolerance",
          "description": "Set to 1 if model predictions were within the acceptable tolerance of actual outcomes. 0 if not.",
          "regulatory_ref": "SR 11-7 Sec. VIII"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c >= 1",
        "description": "Confirms back-testing was performed with a sufficient sample size and results fell within tolerance. Maps to SR 11-7 Outcomes Analysis."
      },
      "frameworks": {
        "SR-11-7": "SR11-7.VIII"
      },
      "namespace": "FIN"
    },
    "CON-STR.1": {
      "procedure_id": "CON-STR.1",
      "parent_control": "CON-STR",
      "title": "Structural Verification",
      "category": "CON",
      "scope": "construction",
      "check_type": "CON_STRUCTURAL_VERIFICATION",
      "factors": {
        "factor_a": {
          "label": "code_requirement",
          "description": "The value required by the applicable building code or engineering specification (e.g., rebar spacing in cm, load capacity in kN).",
          "regulatory_ref": "OSHA 29 CFR 1926.700(a)"
        },
        "factor_b": {
          "label": "measured_value",
          "description": "The value measured or observed at the job site, captured by sensor, AI vision, or manual inspection tool.",
          "regulatory_ref": "OSHA 29 CFR 1926.700(a)"
        },
        "factor_c": {
          "label": "inspection_method",
          "description": "Inspection method code: 1 = AI vision, 2 = sensor/IoT, 3 = licensed inspector manual entry.",
          "regulatory_ref": "OSHA 29 CFR 1926.20(b)(2)"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c >= 1",
        "description": "Confirms the measured structural value meets or exceeds the code requirement, and a valid inspection method was used."
      },
      "frameworks": {
        "OSHA-1926": "1926.700"
      },
      "namespace": "CON"
    },
    "CON-FIN.1": {
      "procedure_id": "CON-FIN.1",
      "parent_control": "CON-FIN",
      "title": "Payment Attestation",
      "category": "CON",
      "scope": "construction",
      "check_type": "CON_PAYMENT_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "milestone_completion_pct",
          "description": "Required completion percentage for the milestone to trigger payment release (e.g., 100).",
          "regulatory_ref": "AIA A201-2017"
        },
        "factor_b": {
          "label": "verified_completion_pct",
          "description": "Completion percentage verified by inspector or AI vision at the time of attestation.",
          "regulatory_ref": "AIA A201-2017"
        },
        "factor_c": {
          "label": "lien_waiver_received",
          "description": "Set to 1 if a valid lien waiver has been received for this payment milestone. 0 if not.",
          "regulatory_ref": "UCC Article 3"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c >= 1",
        "description": "Confirms milestone completion is verified and lien waiver is on file before payment release."
      },
      "frameworks": {
        "OSHA-1926": "FINANCIAL"
      },
      "namespace": "CON"
    },
    "CON-ENV.1": {
      "procedure_id": "CON-ENV.1",
      "parent_control": "CON-ENV",
      "title": "Environmental Monitoring",
      "category": "CON",
      "scope": "construction",
      "check_type": "CON_ENVIRONMENTAL_MONITORING",
      "factors": {
        "factor_a": {
          "label": "threshold_value",
          "description": "The environmental threshold defined by spec (e.g., concrete cure PSI at 72h, temperature range, humidity ceiling).",
          "regulatory_ref": "OSHA 29 CFR 1926.700(a); ACI 318-19 Sec. 26.5.3.1"
        },
        "factor_b": {
          "label": "sensor_reading",
          "description": "The value reported by the on-site sensor or monitoring device at the time of capture.",
          "regulatory_ref": "OSHA 29 CFR 1926.700(a)"
        },
        "factor_c": {
          "label": "hours_elapsed",
          "description": "Hours elapsed since the monitored event began (e.g., hours since concrete pour). Used to verify time-dependent thresholds.",
          "regulatory_ref": "ACI 318-19 Sec. 26.5.3.1"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the environmental reading meets or exceeds the required threshold at the specified elapsed time."
      },
      "frameworks": {
        "OSHA-1926": "1926.700"
      },
      "namespace": "CON"
    },
    "CON-SAF.1": {
      "procedure_id": "CON-SAF.1",
      "parent_control": "CON-SAF",
      "title": "Safety Compliance",
      "category": "CON",
      "scope": "construction",
      "check_type": "CON_SAFETY_COMPLIANCE",
      "factors": {
        "factor_a": {
          "label": "required_certifications",
          "description": "Number of valid safety certifications required for the work activity (e.g., fall protection, confined space, crane operation).",
          "regulatory_ref": "OSHA 29 CFR 1926.500-503"
        },
        "factor_b": {
          "label": "verified_certifications",
          "description": "Number of certifications verified as current and valid at time of inspection.",
          "regulatory_ref": "OSHA 29 CFR 1926.500-503"
        },
        "factor_c": {
          "label": "ppe_compliant",
          "description": "Set to 1 if all required PPE was observed/verified at the job site. 0 if any deficiency was noted.",
          "regulatory_ref": "OSHA 29 CFR 1926.95-107"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c >= 1",
        "description": "Confirms all required safety certifications are current and PPE compliance is verified."
      },
      "frameworks": {
        "OSHA-1926": "1926.500"
      },
      "namespace": "CON"
    },
    "CON-INS.1": {
      "procedure_id": "CON-INS.1",
      "parent_control": "CON-INS",
      "title": "Inspection Attestation",
      "category": "CON",
      "scope": "construction",
      "check_type": "CON_INSPECTION_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "inspection_items_required",
          "description": "Number of items on the inspection checklist for this milestone.",
          "regulatory_ref": "OSHA 29 CFR 1926.20(b)(2)"
        },
        "factor_b": {
          "label": "inspection_items_passed",
          "description": "Number of checklist items that passed inspection.",
          "regulatory_ref": "OSHA 29 CFR 1926.20(b)(2)"
        },
        "factor_c": {
          "label": "inspector_licensed",
          "description": "Set to 1 if the inspector holds a valid license for this inspection type. 0 if not.",
          "regulatory_ref": "OSHA 29 CFR 1926.20(b)(1)"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c >= 1",
        "description": "Confirms all inspection checklist items passed and the inspector is licensed."
      },
      "frameworks": {
        "OSHA-1926": "1926.20"
      },
      "namespace": "CON"
    },
    "HCF-DX.1": {
      "procedure_id": "HCF-DX.1",
      "parent_control": "HCF-DX",
      "title": "Diagnostic Accountability",
      "category": "HCF",
      "scope": "healthcare",
      "check_type": "HCF_DIAGNOSTIC_ACCOUNTABILITY",
      "factors": {
        "factor_a": {
          "label": "confidence_threshold",
          "description": "Minimum confidence score required by clinical protocol for the AI to render a diagnostic recommendation (e.g., 0.92).",
          "regulatory_ref": "21 CFR Part 11 Sec. 11.10(a); FDA CDS Guidance"
        },
        "factor_b": {
          "label": "model_confidence",
          "description": "The confidence score output by the diagnostic AI for this inference.",
          "regulatory_ref": "21 CFR Part 11 Sec. 11.10(a)"
        },
        "factor_c": {
          "label": "ground_truth_match",
          "description": "Set to 1 if the AI recommendation matched the ground truth or clinician-confirmed diagnosis. 0 if divergent. -1 if ground truth not yet available.",
          "regulatory_ref": "21 CFR Part 11 Sec. 11.10(e); EU AI Act Annex III.1"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the AI diagnostic confidence meets or exceeds the clinical threshold. Ground truth match is recorded for retrospective accuracy auditing."
      },
      "frameworks": {
        "EU-AI-ACT": "Annex III.1(a)",
        "FDA-21CFR11": "11.10(a)",
        "FDA-21CFR820": "820.30(g)",
        "FDA-SaMD": "510(k) Clinical Validation",
        "HIPAA": "164.312(b)"
      },
      "namespace": "HCF"
    },
    "HCF-RX.1": {
      "procedure_id": "HCF-RX.1",
      "parent_control": "HCF-RX",
      "title": "Prescription Safety",
      "category": "HCF",
      "scope": "healthcare",
      "check_type": "HCF_PRESCRIPTION_SAFETY",
      "factors": {
        "factor_a": {
          "label": "interaction_checks_required",
          "description": "Number of drug interaction and allergy checks required by formulary protocol.",
          "regulatory_ref": "45 CFR 164.312(c)(1); JCAHO NPSG.03.05.01"
        },
        "factor_b": {
          "label": "interaction_checks_passed",
          "description": "Number of checks that returned safe/clear results.",
          "regulatory_ref": "45 CFR 164.312(c)(1)"
        },
        "factor_c": {
          "label": "contraindication_flag",
          "description": "Set to 0 if no contraindications were detected. Set to 1 if a contraindication was flagged and overridden by a clinician. Set to 2 if a contraindication blocked the prescription.",
          "regulatory_ref": "45 CFR 164.312(c)(1)"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a AND factor_c <= 1",
        "description": "Confirms all drug interaction checks passed and no unresolved contraindications exist."
      },
      "frameworks": {
        "EU-AI-ACT": "Annex III.1(a)",
        "FDA-21CFR11": "11.10(a)",
        "FDA-21CFR820": "820.30(f)",
        "FDA-SaMD": "CDS Safety Assessment",
        "HIPAA": "164.312(c)(1)"
      },
      "namespace": "HCF"
    },
    "HCF-PRIV.1": {
      "procedure_id": "HCF-PRIV.1",
      "parent_control": "HCF-PRIV",
      "title": "PHI Access Audit",
      "category": "HCF",
      "scope": "healthcare",
      "check_type": "HCF_PHI_ACCESS_AUDIT",
      "factors": {
        "factor_a": {
          "label": "consent_required",
          "description": "Set to 1 if patient consent is required for this data access event. 0 for emergency/break-glass access.",
          "regulatory_ref": "45 CFR 164.508"
        },
        "factor_b": {
          "label": "consent_verified",
          "description": "Set to 1 if valid patient consent was verified at the time of access. 0 if not.",
          "regulatory_ref": "45 CFR 164.508"
        },
        "factor_c": {
          "label": "requestor_authorized",
          "description": "Set to 1 if the requestor holds an authorized role for this data type. 0 if access was unauthorized.",
          "regulatory_ref": "45 CFR 164.312(d)"
        }
      },
      "evaluation": {
        "expression": "(factor_a == 0 OR factor_b >= factor_a) AND factor_c >= 1",
        "description": "Confirms patient consent is on file (or waived for emergency) and the requestor is authorized. Maps to HIPAA Privacy Rule access controls."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.10",
        "FDA-21CFR11": "11.10(e)",
        "FDA-21CFR820": "820.180",
        "HIPAA": "164.508"
      },
      "namespace": "HCF"
    },
    "AI-INF.3": {
      "procedure_id": "AI-INF.3",
      "parent_control": "AI-INF",
      "title": "Inference Volume - Hourly Rate Governance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_INFERENCE_VOLUME",
      "factors": {
        "factor_a": {
          "label": "max_inferences_hour",
          "description": "Maximum allowed inferences per hour as defined by governance policy.",
          "regulatory_ref": "EU AI Act Art. 12(1); NIST AI RMF GOVERN 2.1"
        },
        "factor_b": {
          "label": "actual_inferences",
          "description": "Actual inference count observed in the monitoring window.",
          "regulatory_ref": "EU AI Act Art. 12(1); NIST AI RMF GOVERN 2.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Confirms inference volume is within governance limits."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(1)",
        "ISO-42001": "9.1",
        "NIST-800-53": "AU-5",
        "NIST-AI-RMF": "GOVERN 2.1"
      },
      "namespace": "AI"
    },
    "AI-MDL.3": {
      "procedure_id": "AI-MDL.3",
      "parent_control": "AI-MDL",
      "title": "Model Drift Detection",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MODEL_DRIFT",
      "factors": {
        "factor_a": {
          "label": "drift_threshold",
          "description": "Maximum acceptable drift score before the model is flagged for review.",
          "regulatory_ref": "EU AI Act Art. 72(1); NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "drift_score",
          "description": "Measured drift score comparing current output distribution to baseline.",
          "regulatory_ref": "EU AI Act Art. 72(1); NIST AI RMF MEASURE 2.6"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Confirms model output distribution has not drifted beyond acceptable threshold."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.72(1)",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-RMF": "MEASURE 2.6",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-GRD.3": {
      "procedure_id": "AI-GRD.3",
      "parent_control": "AI-GRD",
      "title": "PII Redaction",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_PII_REDACTION",
      "factors": {
        "factor_a": {
          "label": "redaction_required",
          "description": "Whether PII redaction is required for this inference (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 10(2)(f); NIST AI RMF GOVERN 1.7"
        },
        "factor_b": {
          "label": "redaction_active",
          "description": "Whether the PII redaction engine was active (1 = active, 0 = inactive).",
          "regulatory_ref": "EU AI Act Art. 10(2)(f); NIST AI RMF GOVERN 1.7"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms PII redaction was active when required."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.10(2)(f)",
        "FIVE-EYES-AGENTIC": "FE-7",
        "NIST-800-53": "AC-4",
        "NIST-AI-RMF": "GOVERN 1.7",
        "OWASP-AGENTIC": "MCP-02,MCP-05"
      },
      "namespace": "AI"
    },
    "AI-FAIR.1": {
      "procedure_id": "AI-FAIR.1",
      "parent_control": "AI-FAIR",
      "title": "Bias Disparity Measurement",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_BIAS_DISPARITY",
      "factors": {
        "factor_a": {
          "label": "max_disparity_ratio",
          "description": "Maximum acceptable disparity ratio across protected groups (percentage).",
          "regulatory_ref": "EU AI Act Art. 10(2)(f); NIST AI RMF MEASURE 2.5"
        },
        "factor_b": {
          "label": "observed_disparity",
          "description": "Measured disparity ratio from the fairness evaluation.",
          "regulatory_ref": "EU AI Act Art. 10(2)(f); NIST AI RMF MEASURE 2.5"
        },
        "factor_c": {
          "label": "protected_class_count",
          "description": "Number of protected class categories evaluated.",
          "regulatory_ref": "EU AI Act Art. 10(2)(f); NIST AI RMF MAP 2.1"
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a",
        "description": "Confirms bias disparity is within acceptable threshold across all protected groups."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1705",
        "EU-AI-ACT": "Art.10(2)(f)",
        "FIVE-EYES-AGENTIC": "FE-15",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MEASURE 2.5",
        "SR-11-7": "III.A",
        "KR-AI-BASIC": "Art.25",
        "TX-TRAIGA": "Sec.224.105",
        "NYC-LL144": "Sec.20-871(a)"
      },
      "namespace": "AI"
    },
    "AI-FAIR.2": {
      "procedure_id": "AI-FAIR.2",
      "parent_control": "AI-FAIR",
      "title": "Fairness Calibration",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_FAIRNESS_CALIBRATION",
      "factors": {
        "factor_a": {
          "label": "min_fairness_score",
          "description": "Minimum acceptable fairness calibration score.",
          "regulatory_ref": "EU AI Act Art. 9(4)(a); NIST AI RMF MAP 2.3"
        },
        "factor_b": {
          "label": "actual_fairness_score",
          "description": "Measured fairness calibration score across demographic groups.",
          "regulatory_ref": "EU AI Act Art. 9(4)(a); NIST AI RMF MAP 2.3"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms fairness score meets the minimum calibration threshold."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(4)(a)",
        "FIVE-EYES-AGENTIC": "FE-15",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MAP 2.3",
        "SR-11-7": "III.A",
        "NYC-LL144": "Sec.20-871(a)"
      },
      "namespace": "AI"
    },
    "AI-DATA.1": {
      "procedure_id": "AI-DATA.1",
      "parent_control": "AI-DATA",
      "title": "Training Data Provenance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DATA_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "provenance_required",
          "description": "Whether data provenance documentation is required (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 10(2)(a); NIST AI RMF MAP 3.5"
        },
        "factor_b": {
          "label": "provenance_documented",
          "description": "Whether source, license, and collection method are documented (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 10(2)(a); NIST AI RMF MAP 3.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms training data provenance is documented per data governance requirements."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.10(2)(a)",
        "FIVE-EYES-AGENTIC": "FE-14",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MAP 3.5",
        "OWASP-AGENTIC": "MCP-10",
        "SR-11-7": "III.B",
        "CA-SB-942": "Sec.22757.5(c)",
        "KR-AI-BASIC": "Art.28",
        "TX-TRAIGA": "Sec.224.107",
        "NYC-LL144": "Sec.20-871(d)"
      },
      "namespace": "AI"
    },
    "AI-DATA.2": {
      "procedure_id": "AI-DATA.2",
      "parent_control": "AI-DATA",
      "title": "Training Data License Compliance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DATA_LICENSE",
      "factors": {
        "factor_a": {
          "label": "license_check_required",
          "description": "Whether license compliance verification is required (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 10(2)(a); NIST AI RMF GOVERN 1.7"
        },
        "factor_b": {
          "label": "license_verified",
          "description": "Whether all training data licenses have been verified (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 10(2)(a); NIST AI RMF GOVERN 1.7"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms all training data complies with applicable license terms."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.10(2)(a)",
        "FIVE-EYES-AGENTIC": "FE-14",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "GOVERN 1.7"
      },
      "namespace": "AI"
    },
    "AI-DATA.3": {
      "procedure_id": "AI-DATA.3",
      "parent_control": "AI-DATA",
      "title": "Training Data Statistics",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DATA_STATISTICS",
      "factors": {
        "factor_a": {
          "label": "row_count",
          "description": "Total samples in the training dataset.",
          "regulatory_ref": "EU AI Act Art. 10(3)"
        },
        "factor_b": {
          "label": "feature_count",
          "description": "Number of features or dimensions in the dataset.",
          "regulatory_ref": "EU AI Act Art. 10(3)"
        },
        "factor_c": {
          "label": "class_balance_ratio",
          "description": "Majority/minority class balance ratio (x1000, e.g., 850 = 85%).",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 && factor_b > 0",
        "description": "Confirms training dataset statistics were recorded with non-zero sample and feature counts."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.10(3)",
        "FIVE-EYES-AGENTIC": "FE-14",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MAP 4.1"
      },
      "namespace": "AI"
    },
    "AI-DATA.4": {
      "procedure_id": "AI-DATA.4",
      "parent_control": "AI-DATA",
      "title": "Training Data PII Lifecycle",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DATA_PII_LIFECYCLE",
      "factors": {
        "factor_a": {
          "label": "records_affected",
          "description": "Number of records involved in the PII lifecycle event.",
          "regulatory_ref": "EU AI Act Art. 10(5); GDPR Art. 25"
        },
        "factor_b": {
          "label": "event_completed",
          "description": "Whether the event completed successfully (1 = yes, 0 = partial/failed).",
          "regulatory_ref": "EU AI Act Art. 10(5)"
        },
        "factor_c": {
          "label": "event_type_code",
          "description": "Event type: 0=unspecified, 1=pseudonymization, 2=anonymization, 3=access_restriction, 4=deletion, 5=encryption.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= 1",
        "description": "Confirms the PII lifecycle event completed successfully."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1704",
        "EU-AI-ACT": "Art.10(5)",
        "FIVE-EYES-AGENTIC": "FE-14",
        "GDPR": "Art.25",
        "ISO-42001": "A.8.2",
        "NIST-AI-RMF": "MAP 3.5"
      },
      "namespace": "AI"
    },
    "AI-HITL.1": {
      "procedure_id": "AI-HITL.1",
      "parent_control": "AI-HITL",
      "title": "Human Review Completion",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_HUMAN_REVIEW",
      "factors": {
        "factor_a": {
          "label": "review_required",
          "description": "Whether human review is required for this decision type (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 14(1); NIST AI RMF GOVERN 1.1"
        },
        "factor_b": {
          "label": "review_completed",
          "description": "Whether a qualified human reviewed and approved the decision (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 14(1); NIST AI RMF GOVERN 1.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms human oversight was exercised for high-risk AI decisions."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.14(1)",
        "FIVE-EYES-AGENTIC": "FE-5",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "GOVERN 1.1",
        "SR-11-7": "IV.B",
        "NIS-2": "Art.21(2)(g)",
        "KR-AI-BASIC": "Art.24",
        "SG-IMDA-AGENTIC": "MGF-3.3",
        "TX-TRAIGA": "Sec.224.106"
      },
      "namespace": "AI"
    },
    "AI-HITL.2": {
      "procedure_id": "AI-HITL.2",
      "parent_control": "AI-HITL",
      "title": "Human Override Event Tracking",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_OVERRIDE_TRACKING",
      "factors": {
        "factor_a": {
          "label": "override_logging_required",
          "description": "Whether override event logging is required (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 14(4)(d); NIST AI RMF MANAGE 4.1"
        },
        "factor_b": {
          "label": "override_logged",
          "description": "Whether the override event was captured in the audit trail (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 14(4)(d); NIST AI RMF MANAGE 4.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms human override events are logged for accountability."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.14(4)(d)",
        "FIVE-EYES-AGENTIC": "FE-5",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "MANAGE 4.1"
      },
      "namespace": "AI"
    },
    "AI-EXPL.1": {
      "procedure_id": "AI-EXPL.1",
      "parent_control": "AI-EXPL",
      "title": "Explanation Generation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_EXPLAINABILITY",
      "factors": {
        "factor_a": {
          "label": "explanation_required",
          "description": "Whether an explanation must accompany the AI output (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 13(1); NIST AI RMF MEASURE 2.5"
        },
        "factor_b": {
          "label": "explanation_provided",
          "description": "Whether a reasoning explanation was generated (1 = yes).",
          "regulatory_ref": "EU AI Act Art. 13(1); NIST AI RMF MEASURE 2.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the AI system provided an interpretable explanation with its output."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.13(1)",
        "FIVE-EYES-AGENTIC": "FE-9",
        "ISO-42001": "A.8.3",
        "NIST-AI-RMF": "MEASURE 2.5",
        "SR-11-7": "IV.B",
        "CA-SB-942": "Sec.22757.5(b)",
        "KR-AI-BASIC": "Art.22",
        "TX-TRAIGA": "Sec.224.104",
        "NYC-LL144": "Sec.20-871(b)"
      },
      "namespace": "AI"
    },
    "AI-EXPL.2": {
      "procedure_id": "AI-EXPL.2",
      "parent_control": "AI-EXPL",
      "title": "Confidence Scoring",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CONFIDENCE_SCORE",
      "factors": {
        "factor_a": {
          "label": "min_confidence_threshold",
          "description": "Minimum confidence score required for the output to be actionable.",
          "regulatory_ref": "EU AI Act Art. 13(3)(b)(ii); NIST AI RMF MAP 2.3"
        },
        "factor_b": {
          "label": "model_confidence",
          "description": "The confidence score output by the AI model.",
          "regulatory_ref": "EU AI Act Art. 13(3)(b)(ii); NIST AI RMF MAP 2.3"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms model confidence meets the minimum threshold for actionable output."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.13(3)(b)(ii)",
        "FIVE-EYES-AGENTIC": "FE-9",
        "ISO-42001": "A.8.3",
        "NIST-AI-RMF": "MAP 2.3",
        "SR-11-7": "IV.B"
      },
      "namespace": "AI"
    },
    "AI-GOV.1": {
      "procedure_id": "AI-GOV.1",
      "parent_control": "AI-GOV",
      "title": "AI Acceptable Use Policy",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 9; NIST 800-53 PL-4"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether the organization has attested to having a current AI acceptable use policy (1 = yes, 0 = no).",
          "regulatory_ref": "EU AI Act Art. 9; NIST 800-53 PL-4"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the organization has attested to a current AI acceptable use policy."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-5",
        "ISO-42001": "5.2",
        "NIST-800-53": "PL-4",
        "NIST-AI-RMF": "GOVERN 1.1",
        "NIS-2": "Art.21(2)(a)",
        "TX-TRAIGA": "Sec.224.102"
      },
      "namespace": "AI"
    },
    "AI-GOV.2": {
      "procedure_id": "AI-GOV.2",
      "parent_control": "AI-GOV",
      "title": "Employee AI Training",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 4; NIST 800-53 AT-2"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether all personnel with AI system access have completed accountability training (1 = yes, 0 = no).",
          "regulatory_ref": "EU AI Act Art. 4; NIST 800-53 AT-2"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms all AI system users have completed accountability and safety training."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.4",
        "FIVE-EYES-AGENTIC": "FE-5",
        "ISO-42001": "7.2",
        "NIST-800-53": "AT-2",
        "NIST-AI-RMF": "GOVERN 2.1"
      },
      "namespace": "AI"
    },
    "AI-GOV.3": {
      "procedure_id": "AI-GOV.3",
      "parent_control": "AI-GOV",
      "title": "Approved Model Registry",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 49; NIST 800-53 CM-8"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether the organization maintains a current registry of all AI models with version tracking and risk classification (1 = yes, 0 = no).",
          "regulatory_ref": "EU AI Act Art. 49; NIST 800-53 CM-8"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the organization maintains an approved AI model registry."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.49",
        "FIVE-EYES-AGENTIC": "FE-11",
        "ISO-42001": "A.6.2.4",
        "NIST-800-53": "CM-8",
        "NIST-AI-RMF": "MAP 1.1"
      },
      "namespace": "AI"
    },
    "AI-GOV.4": {
      "procedure_id": "AI-GOV.4",
      "parent_control": "AI-GOV",
      "title": "Shadow AI Incident Response",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 26; NIST 800-53 IR-4"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether the organization has a documented procedure for detecting and responding to unauthorized AI usage (1 = yes, 0 = no).",
          "regulatory_ref": "EU AI Act Art. 26; NIST 800-53 IR-4"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms the organization has a shadow AI incident response procedure."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.26",
        "ISO-42001": "A.6.2.5",
        "NIST-800-53": "IR-4",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-GOV.5": {
      "procedure_id": "AI-GOV.5",
      "parent_control": "AI-GOV",
      "title": "Third-Party AI Vendor Assessment",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 25; NIST 800-53 SA-4"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether all third-party AI vendors have undergone an accountability assessment (1 = yes, 0 = no).",
          "regulatory_ref": "EU AI Act Art. 25; NIST 800-53 SA-4"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms all third-party AI vendors have been assessed for accountability compliance."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.25",
        "ISO-42001": "A.6.2.7",
        "NIST-800-53": "SA-4",
        "NIST-AI-RMF": "GOVERN 6.1",
        "SR-11-7": "V.A"
      },
      "namespace": "AI"
    },
    "AI-TOOL.1": {
      "procedure_id": "AI-TOOL.1",
      "parent_control": "AI-TOOL",
      "title": "Tool Call Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TOOL_CALL_WITNESSING",
      "factors": {
        "factor_a": {
          "label": "tool_name_hash",
          "description": "SHA-256 truncated hash of the tool/function name invoked by the agent.",
          "regulatory_ref": "EU AI Act Art. 14(4); NIST AI RMF GOVERN 1.7"
        },
        "factor_b": {
          "label": "args_hash",
          "description": "SHA-256 truncated hash of the serialized tool arguments.",
          "regulatory_ref": "EU AI Act Art. 14(4)"
        },
        "factor_c": {
          "label": "outcome",
          "description": "Tool call outcome: 1 = success, 0 = failure.",
          "regulatory_ref": "EU AI Act Art. 14(4)"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b != ''",
        "description": "Verifies that the tool call was captured with both name and arguments hashed. Verdict is always PASS when the witness fires."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(1)",
        "FIVE-EYES-AGENTIC": "FE-12",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "GOVERN 1.7",
        "OWASP-AGENTIC": "MCP-02,MCP-05",
        "SG-IMDA-AGENTIC": "MGF-3.2"
      },
      "namespace": "AI"
    },
    "AI-ID.1": {
      "procedure_id": "AI-ID.1",
      "parent_control": "AI-ID",
      "title": "Agent Identity Assertion",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_AGENT_IDENTITY",
      "factors": {
        "factor_a": {
          "label": "agent_id_hash",
          "description": "SHA-256 truncated hash of the declared agent identity string.",
          "regulatory_ref": "EU AI Act Art. 50(2); NIST AI RMF MAP 1.1"
        },
        "factor_b": {
          "label": "signature_present",
          "description": "Whether an HMAC-SHA256 signature was included: 1 = signed, 0 = unsigned.",
          "regulatory_ref": "EU AI Act Art. 50(2)"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b == 1",
        "description": "Verifies that a cryptographic agent identity was asserted and a valid signature was present."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(1)",
        "FIVE-EYES-AGENTIC": "FE-3",
        "ISO-42001": "A.6.2.6",
        "NIST-AI-RMF": "MAP 1.1",
        "OWASP-AGENTIC": "MCP-01,MCP-07",
        "NIS-2": "Art.21(2)(i)",
        "CA-SB-942": "Sec.22757.5(d)",
        "SG-IMDA-AGENTIC": "MGF-2.1"
      },
      "namespace": "AI"
    },
    "AI-ACC.1": {
      "procedure_id": "AI-ACC.1",
      "parent_control": "AI-ACC",
      "title": "Agent Access Control Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ACCESS_CONTROL_WITNESSING",
      "factors": {
        "factor_a": {
          "label": "resource_hash",
          "description": "SHA-256 truncated hash of the resource identifier accessed by the agent.",
          "regulatory_ref": "EU AI Act Art. 9(4)(c); NIST AI RMF MANAGE 2.4"
        },
        "factor_b": {
          "label": "scope_hash",
          "description": "SHA-256 truncated hash of the access scope (e.g., read, write, execute).",
          "regulatory_ref": "EU AI Act Art. 9(4)(c)"
        },
        "factor_c": {
          "label": "outcome",
          "description": "Access outcome: 1 = granted, 0 = denied.",
          "regulatory_ref": "EU AI Act Art. 9(4)(c)"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b != ''",
        "description": "Verifies that the resource access was captured with resource identifier and scope. Verdict reflects the access outcome."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(4)(c)",
        "FIVE-EYES-AGENTIC": "FE-1",
        "ISO-42001": "A.6.2.6",
        "NIST-800-53": "AC-4",
        "NIST-AI-RMF": "MANAGE 2.4",
        "OWASP-AGENTIC": "MCP-02,MCP-07",
        "NIS-2": "Art.21(2)(i)",
        "CA-SB-942": "Sec.22757.5(e)",
        "SG-IMDA-AGENTIC": "MGF-2.2"
      },
      "namespace": "AI"
    },
    "AI-REV.1": {
      "procedure_id": "AI-REV.1",
      "parent_control": "AI-REV",
      "title": "Anchor Revocation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ANCHOR_REVOCATION",
      "factors": {
        "factor_a": {
          "label": "revoked_fingerprint_hash",
          "description": "SHA-256 truncated hash of the fingerprint being revoked.",
          "regulatory_ref": "EU AI Act Art. 12(3); GDPR Art. 17"
        },
        "factor_b": {
          "label": "reason_code",
          "description": "Revocation reason: 0=unspecified, 1=model_recall, 2=policy_violation, 3=data_contamination, 4=consent_withdrawal, 5=regulatory_order, 6=error_correction.",
          "regulatory_ref": "EU AI Act Art. 12(3)"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0."
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b >= 0 and factor_b <= 6",
        "description": "Verifies that a valid fingerprint and reason code were provided. Verdict is always PASS when the revocation is recorded."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.14(4)(d)",
        "FIVE-EYES-AGENTIC": "FE-6",
        "GDPR": "Art.17",
        "NIST-800-53": "SI-7",
        "NIST-AI-RMF": "MANAGE 2.4"
      },
      "namespace": "AI"
    },
    "AI-SEC.1": {
      "procedure_id": "AI-SEC.1",
      "parent_control": "AI-SEC",
      "title": "Adversarial Threat Detection",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_THREAT_DETECTION",
      "factors": {
        "factor_a": {
          "label": "threats_checked",
          "description": "Number of adversarial threat categories checked (e.g., prompt injection, data poisoning, model extraction).",
          "regulatory_ref": "EU AI Act Art. 15(4); NIST AI RMF MANAGE 2.3"
        },
        "factor_b": {
          "label": "threats_detected",
          "description": "Number of adversarial threats detected in this inference.",
          "regulatory_ref": "EU AI Act Art. 15(4)"
        },
        "factor_c": {
          "label": "blocked",
          "description": "Whether the inference was blocked due to detected threats: 1 = blocked, 0 = allowed.",
          "regulatory_ref": "EU AI Act Art. 15(4)"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_b == 0",
        "description": "PASS if threat checks ran and no threats detected. FAIL if threats were detected."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(4)",
        "FIVE-EYES-AGENTIC": "FE-10",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.6",
        "NIST-AI-RMF": "MANAGE 2.3",
        "OWASP-AGENTIC": "MCP-03"
      },
      "namespace": "AI"
    },
    "AI-SEC.2": {
      "procedure_id": "AI-SEC.2",
      "parent_control": "AI-SEC",
      "title": "Input Validation and Sanitization",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_INPUT_VALIDATION",
      "factors": {
        "factor_a": {
          "label": "validators_required",
          "description": "Number of input validation steps required (e.g., schema check, length limit, encoding verification).",
          "regulatory_ref": "EU AI Act Art. 15(3); NIST AI RMF MANAGE 2.3"
        },
        "factor_b": {
          "label": "validators_passed",
          "description": "Number of input validation steps that passed.",
          "regulatory_ref": "EU AI Act Art. 15(3)"
        },
        "factor_c": {
          "label": "input_rejected",
          "description": "Whether the input was rejected due to validation failure: 1 = rejected, 0 = accepted.",
          "regulatory_ref": "EU AI Act Art. 15(3)"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "PASS if all required validation steps passed. FAIL if any validation step failed."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(3)",
        "FIVE-EYES-AGENTIC": "FE-10",
        "ISO-42001": "A.6.2.6",
        "NIST-800-53": "SI-10",
        "NIST-AI-RMF": "MANAGE 2.3"
      },
      "namespace": "AI"
    },
    "AI-GOV.6": {
      "procedure_id": "AI-GOV.6",
      "parent_control": "AI-GOV",
      "title": "AI Risk Management Scope Definition",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 17; NIST 800-53 PM-9"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether AI risk management scope has been defined (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.3"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms AI risk management scope is defined and documented."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.17",
        "ISO-42001": "6.1",
        "NIST-800-53": "PM-9",
        "NIST-AI-RMF": "GOVERN 1.3"
      },
      "namespace": "AI"
    },
    "AI-GOV.7": {
      "procedure_id": "AI-GOV.7",
      "parent_control": "AI-GOV",
      "title": "AI Governance Resource Allocation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 PM-3"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether adequate resources are allocated for AI governance (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 2.2"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms resources are allocated for AI governance."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.17",
        "ISO-42001": "7.1",
        "NIST-800-53": "PM-3",
        "NIST-AI-RMF": "GOVERN 2.2"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.1": {
      "procedure_id": "AI-METAGOV.1",
      "parent_control": "AI-METAGOV",
      "title": "Governance Infrastructure Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 CA-2"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether governance infrastructure configuration is cryptographically attested before operational events are processed (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms governance infrastructure configuration is self-attested using the same protocol it enforces."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "NIST-800-53": "CA-2",
        "NIST-AI-RMF": "GOVERN 1.1"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.2": {
      "procedure_id": "AI-METAGOV.2",
      "parent_control": "AI-METAGOV",
      "title": "Governance Layer Registration",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 CA-7"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether all AI governance layers are registered with the cryptographic witness layer (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.3"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms governance layers are registered with the non-AI witness layer to terminate recursion."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "NIST-800-53": "CA-7",
        "NIST-AI-RMF": "GOVERN 1.3"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.3": {
      "procedure_id": "AI-METAGOV.3",
      "parent_control": "AI-METAGOV",
      "title": "Policy Downgrade Detection",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 CM-3"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether policy version monotonicity is enforced and downgrade attempts are detected (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.4"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms monotonic policy version progression is enforced with downgrade detection."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.17",
        "NIST-800-53": "CM-3",
        "NIST-AI-RMF": "GOVERN 1.4"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.4": {
      "procedure_id": "AI-METAGOV.4",
      "parent_control": "AI-METAGOV",
      "title": "Circular Dependency Check",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 CM-4"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether governance rule graphs are validated for circular dependencies at configuration load time (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms governance rule configurations are validated for circular dependencies using topological sort."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "NIST-800-53": "CM-4",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.5": {
      "procedure_id": "AI-METAGOV.5",
      "parent_control": "AI-METAGOV",
      "title": "Governance Authorization",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 AC-6"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether governance changes require signed authorization with scope-appropriate credentials (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 2.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms governance configuration changes require cryptographically signed authorization."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.17",
        "NIST-800-53": "AC-6",
        "NIST-AI-RMF": "GOVERN 2.1"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.6": {
      "procedure_id": "AI-METAGOV.6",
      "parent_control": "AI-METAGOV",
      "title": "Emergency Override Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 AC-6(1)"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether emergency governance overrides are witnessed and subject to mandatory post-hoc review (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms emergency governance changes are automatically witnessed and trigger mandatory review."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "NIST-800-53": "AC-6(1)",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.7": {
      "procedure_id": "AI-METAGOV.7",
      "parent_control": "AI-METAGOV",
      "title": "Governance Sync Verification",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 SA-9"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether governance policy equivalence is verified during federated trust exchanges (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.7"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms governance policy equivalence is verified during federated trust credential exchange."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.25",
        "NIST-800-53": "SA-9",
        "NIST-AI-RMF": "GOVERN 1.7"
      },
      "namespace": "AI"
    },
    "AI-METAGOV.8": {
      "procedure_id": "AI-METAGOV.8",
      "parent_control": "AI-METAGOV",
      "title": "Attestation Purity Verification",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 SA-11"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether attestation engine purity is verified via source hash manifest with no ML components (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms attestation engine contains no ML inference, proving the witness layer is a non-AI recursion terminator."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.17",
        "NIST-800-53": "SA-11",
        "NIST-AI-RMF": "MEASURE 2.5"
      },
      "namespace": "AI"
    },
    "AI-RISK.1": {
      "procedure_id": "AI-RISK.1",
      "parent_control": "AI-RISK",
      "title": "AI Risk Identification and Categorization",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "EU AI Act Art. 9; NIST 800-53 RA-2"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether AI risk register exists with identified risk sources and categories (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF MAP 2.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms AI risk identification and categorization is documented."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "ISO-42001": "6.1",
        "NIST-800-53": "RA-2",
        "NIST-AI-RMF": "MAP 2.1",
        "SR-11-7": "II.A",
        "NIS-2": "Art.21(2)(a)",
        "KR-AI-BASIC": "Art.27",
        "TX-TRAIGA": "Sec.224.103"
      },
      "namespace": "AI"
    },
    "AI-IR.1": {
      "procedure_id": "AI-IR.1",
      "parent_control": "AI-IR",
      "title": "AI Incident Response Capability",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 IR-8"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether AI-specific incident response procedures exist (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF MANAGE 3.1"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms AI incident response capability is documented."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.62",
        "ISO-42001": "A.6.2.5",
        "NIST-800-53": "IR-8",
        "NIST-AI-RMF": "MANAGE 3.1",
        "NIS-2": "Art.21(2)(b)"
      },
      "namespace": "AI"
    },
    "AI-IMPACT.1": {
      "procedure_id": "AI-IMPACT.1",
      "parent_control": "AI-IMPACT",
      "title": "AI Societal Impact Assessment",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "attestation",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "Attestation is required (always 1).",
          "default": 1,
          "regulatory_ref": "NIST 800-53 RA-3"
        },
        "factor_b": {
          "label": "attested",
          "description": "Whether societal impact assessment is documented (1 = yes, 0 = no).",
          "regulatory_ref": "NIST AI RMF MAP 5.2"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "default": 0
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Confirms societal impact assessment is complete."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "ISO-42001": "6.1.2",
        "NIST-800-53": "RA-3",
        "NIST-AI-RMF": "MAP 5.2",
        "KR-AI-BASIC": "Art.27",
        "TX-TRAIGA": "Sec.224.103"
      },
      "namespace": "AI"
    },
    "AI-RAG.1": {
      "procedure_id": "AI-RAG.1",
      "parent_control": "AI-RAG",
      "title": "Context Retrieval Provenance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_RAG_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "chunks_retrieved",
          "description": "Number of context chunks retrieved from the corpus.",
          "regulatory_ref": "EU AI Act Art. 13; NIST AI RMF MAP 2.3"
        },
        "factor_b": {
          "label": "corpus_hash_present",
          "description": "1 if corpus integrity hash was recorded, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 13"
        },
        "factor_c": {
          "label": "avg_similarity",
          "description": "Average similarity score across retrieved chunks (x1000).",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Verifies that retrieval context was captured. Verdict is always PASS when the witness fires."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.13",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MAP 2.3",
        "OWASP-AGENTIC": "MCP-10"
      },
      "namespace": "AI"
    },
    "AI-RAG.2": {
      "procedure_id": "AI-RAG.2",
      "parent_control": "AI-RAG",
      "title": "Context Relevance Scoring",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_RAG_RELEVANCE",
      "factors": {
        "factor_a": {
          "label": "chunks_above_threshold",
          "description": "Number of chunks above the similarity threshold.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        },
        "factor_b": {
          "label": "total_chunks",
          "description": "Total chunks evaluated.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        },
        "factor_c": {
          "label": "threshold_pct",
          "description": "Similarity threshold percentage (e.g. 70 = 0.70).",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Verifies that at least some retrieved context met the relevance threshold."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.13",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MEASURE 2.5",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-MDL.5": {
      "procedure_id": "AI-MDL.5",
      "parent_control": "AI-MDL",
      "title": "Weight File Integrity",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_WEIGHT_FILE_INTEGRITY",
      "factors": {
        "factor_a": {
          "label": "file_size_mb",
          "description": "Model weight file size in megabytes.",
          "regulatory_ref": "EU AI Act Art. 11; NIST AI RMF GOVERN 1.2"
        },
        "factor_b": {
          "label": "hash_match",
          "description": "1 if computed hash matches declared hash, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 11"
        },
        "factor_c": {
          "label": "format_code",
          "description": "Weight format: 0=safetensors, 1=onnx, 2=pytorch, 3=tensorflow, 4=gguf, 5=other.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.2"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Weight file hash must match the declared value."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.11",
        "FIVE-EYES-AGENTIC": "FE-11",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "GOVERN 1.2",
        "OWASP-AGENTIC": "MCP-04",
        "SR-11-7": "III.B"
      },
      "namespace": "AI"
    },
    "AI-MDL.6": {
      "procedure_id": "AI-MDL.6",
      "parent_control": "AI-MDL",
      "title": "Adapter Stack Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ADAPTER_STACK",
      "factors": {
        "factor_a": {
          "label": "adapter_count",
          "description": "Number of adapters (LoRA, QLoRA, etc.) in the stack.",
          "regulatory_ref": "EU AI Act Art. 11"
        },
        "factor_b": {
          "label": "all_verified",
          "description": "1 if all adapter hashes match, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 11"
        },
        "factor_c": {
          "label": "adapter_type_code",
          "description": "Adapter type: 0=lora, 1=qlora, 2=prefix, 3=prompt, 4=full, 5=other.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.2"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "All adapter hashes must match declared values."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.11",
        "FIVE-EYES-AGENTIC": "FE-11",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "GOVERN 1.2"
      },
      "namespace": "AI"
    },
    "AI-MDL.7": {
      "procedure_id": "AI-MDL.7",
      "parent_control": "AI-MDL",
      "title": "Quantization Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_QUANTIZATION",
      "factors": {
        "factor_a": {
          "label": "original_bits",
          "description": "Original model precision in bits (e.g. 32, 16).",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "quantized_bits",
          "description": "Quantized precision in bits (e.g. 8, 4).",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        },
        "factor_c": {
          "label": "method_code",
          "description": "Quantization method code.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        }
      },
      "evaluation": {
        "expression": "factor_b > 0",
        "description": "Verifies quantization was witnessed with precision recorded."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(3)",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "MEASURE 2.6"
      },
      "namespace": "AI"
    },
    "AI-SKILL.1": {
      "procedure_id": "AI-SKILL.1",
      "parent_control": "AI-SKILL",
      "title": "Skill Manifest Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_SKILL_MANIFEST",
      "factors": {
        "factor_a": {
          "label": "skills_declared",
          "description": "Number of skills in the manifest.",
          "regulatory_ref": "EU AI Act Art. 9; NIST AI RMF GOVERN 1.7"
        },
        "factor_b": {
          "label": "manifest_hash_present",
          "description": "1 if manifest hash was recorded, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "skills_validated",
          "description": "Number of skills that passed validation.",
          "regulatory_ref": "EU AI Act Art. 9"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Verifies that a skill manifest was witnessed."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-13",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "GOVERN 1.7",
        "OWASP-AGENTIC": "MCP-04"
      },
      "namespace": "AI"
    },
    "AI-SKILL.2": {
      "procedure_id": "AI-SKILL.2",
      "parent_control": "AI-SKILL",
      "title": "Memory Context Binding",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MEMORY_CONTEXT",
      "factors": {
        "factor_a": {
          "label": "memory_entries",
          "description": "Number of memory entries in context.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        },
        "factor_b": {
          "label": "context_hash_present",
          "description": "1 if memory context hash was recorded, 0 otherwise.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        },
        "factor_c": {
          "label": "memory_source_code",
          "description": "Memory source: 0=session, 1=persistent, 2=shared, 3=external.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0",
        "description": "Verifies that memory context binding was witnessed."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(2)(a)",
        "FIVE-EYES-AGENTIC": "FE-13",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MEASURE 2.5"
      },
      "namespace": "AI"
    },
    "AI-SKILL.3": {
      "procedure_id": "AI-SKILL.3",
      "parent_control": "AI-SKILL",
      "title": "Reward Model Binding",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_REWARD_MODEL",
      "factors": {
        "factor_a": {
          "label": "reward_score",
          "description": "Reward model output score (x1000).",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "threshold_met",
          "description": "1 if reward score meets threshold, 0 otherwise.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        },
        "factor_c": {
          "label": "reward_model_hash",
          "description": "Truncated hash of reward model identifier.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Reward model score must meet the configured threshold."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(4)(a)",
        "FIVE-EYES-AGENTIC": "FE-13",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MEASURE 2.6"
      },
      "namespace": "AI"
    },
    "AI-HW.1": {
      "procedure_id": "AI-HW.1",
      "parent_control": "AI-HW",
      "title": "Hardware Runtime Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_HARDWARE_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "gpu_count",
          "description": "Number of GPUs or accelerators detected.",
          "regulatory_ref": "EU AI Act Art. 11; NIST AI RMF GOVERN 1.2"
        },
        "factor_b": {
          "label": "memory_gb",
          "description": "Total accelerator memory in GB.",
          "regulatory_ref": "EU AI Act Art. 11"
        },
        "factor_c": {
          "label": "accelerator_type_code",
          "description": "Accelerator type: 0=nvidia, 1=amd, 2=intel, 3=tpu, 4=apple, 5=other.",
          "regulatory_ref": "EU AI Act Art. 11"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Verifies that hardware runtime was attested."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.11",
        "FIVE-EYES-AGENTIC": "FE-8",
        "ISO-42001": "A.6.2.6",
        "NIST-800-53": "SI-7",
        "NIST-AI-RMF": "GOVERN 1.2",
        "NIS-2": "Art.21(2)(d)"
      },
      "namespace": "AI"
    },
    "AI-HW.3": {
      "procedure_id": "AI-HW.3",
      "parent_control": "AI-HW",
      "title": "TPM Platform Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TPM_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "pcr_count",
          "description": "Number of PCR registers measured.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.2"
        },
        "factor_b": {
          "label": "quote_verified",
          "description": "1 if TPM quote signature verified, 0 otherwise.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.2"
        },
        "factor_c": {
          "label": "tpm_version_code",
          "description": "TPM version: 0=2.0, 1=1.2, 2=fTPM, 3=simulated.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.2"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "TPM quote signature must verify."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15",
        "FIVE-EYES-AGENTIC": "FE-8",
        "NIST-800-53": "SI-7",
        "NIST-AI-RMF": "GOVERN 1.2"
      },
      "namespace": "AI"
    },
    "AI-TRUST.1": {
      "procedure_id": "AI-TRUST.1",
      "parent_control": "AI-TRUST",
      "title": "Trust Verification",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TRUST_VERIFY",
      "factors": {
        "factor_a": {
          "label": "trust_level",
          "description": "Evaluated trust level: 0=denied, 1=basic, 2=verified, 3=attested, 4=sovereign.",
          "regulatory_ref": "EU AI Act Art. 9; NIST AI RMF GOVERN 1.5"
        },
        "factor_b": {
          "label": "checks_passed",
          "description": "Number of trust checks that passed.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "checks_total",
          "description": "Total trust checks evaluated.",
          "regulatory_ref": "EU AI Act Art. 9"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Trust level must be at least basic (1)."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-3,FE-10",
        "NIST-800-53": "AC-4",
        "NIST-AI-RMF": "GOVERN 1.5",
        "OWASP-AGENTIC": "MCP-06,MCP-07,MCP-09",
        "NIS-2": "Art.21(2)(d),Art.21(2)(j)",
        "SG-IMDA-AGENTIC": "MGF-5.1"
      },
      "namespace": "AI"
    },
    "AI-TRUST.2": {
      "procedure_id": "AI-TRUST.2",
      "parent_control": "AI-TRUST",
      "title": "Trust Credential Presentation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TRUST_CREDENTIAL",
      "factors": {
        "factor_a": {
          "label": "trust_level",
          "description": "Presented trust level.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_b": {
          "label": "signed",
          "description": "1 if credential is cryptographically signed, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "procedures_witnessed",
          "description": "Number of procedures witnessed by the presenting agent.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.5"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Presented trust level must be at least basic (1)."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-3",
        "ISO-42001": "A.6.2.6",
        "NIST-AI-RMF": "GOVERN 1.5",
        "OWASP-AGENTIC": "MCP-07",
        "NIS-2": "Art.21(2)(j)",
        "SG-IMDA-AGENTIC": "MGF-5.2"
      },
      "namespace": "AI"
    },
    "AI-CHAIN.1": {
      "procedure_id": "AI-CHAIN.1",
      "parent_control": "AI-CHAIN",
      "title": "Multi-Agent Chain Handoff",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CHAIN_HANDOFF",
      "factors": {
        "factor_a": {
          "label": "chain_depth",
          "description": "Position in the agent chain (1 = first handoff).",
          "regulatory_ref": "EU AI Act Art. 9; NIST AI RMF GOVERN 1.3"
        },
        "factor_b": {
          "label": "cycle_bound",
          "description": "1 if bound to a cycle_id, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "accepted",
          "description": "1 if handoff was accepted, 0 if rejected.",
          "regulatory_ref": "EU AI Act Art. 9"
        }
      },
      "evaluation": {
        "expression": "factor_c == 1",
        "description": "Chain handoff must be accepted by the receiving agent."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-6",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "GOVERN 1.3",
        "OWASP-AGENTIC": "MCP-06,MCP-09",
        "NIS-2": "Art.21(2)(d)",
        "SG-IMDA-AGENTIC": "MGF-4.1"
      },
      "namespace": "AI"
    },
    "AI-CHAIN.2": {
      "procedure_id": "AI-CHAIN.2",
      "parent_control": "AI-CHAIN",
      "title": "Chain Trust Degradation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CHAIN_TRUST_DEGRADATION",
      "factors": {
        "factor_a": {
          "label": "previous_trust",
          "description": "Effective trust level before this handoff.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_b": {
          "label": "new_trust",
          "description": "Effective trust level after this handoff.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "degradation_delta",
          "description": "Trust level decrease (previous - new).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.3"
        }
      },
      "evaluation": {
        "expression": "factor_c >= 0",
        "description": "Records trust degradation at chain handoff points. Informational -- always PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-6",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "GOVERN 1.3"
      },
      "namespace": "AI"
    },
    "AI-SAFE.1": {
      "procedure_id": "AI-SAFE.1",
      "parent_control": "AI-SAFE",
      "title": "Safe State Transition",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_SAFE_STATE",
      "factors": {
        "factor_a": {
          "label": "trigger_code",
          "description": "Safe state trigger: 0=manual, 1=threshold, 2=chain_break, 3=policy, 4=external.",
          "regulatory_ref": "EU AI Act Art. 9(4)(b)"
        },
        "factor_b": {
          "label": "actions_suspended",
          "description": "Number of actions suspended.",
          "regulatory_ref": "EU AI Act Art. 9(4)(b)"
        },
        "factor_c": {
          "label": "recovery_available",
          "description": "1 if recovery mechanism exists, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 9(4)(b)"
        }
      },
      "evaluation": {
        "expression": "factor_b >= 0",
        "description": "Records safe state transitions. Informational -- always PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(4)(b)",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-RMF": "MANAGE 2.3",
        "NIS-2": "Art.21(2)(c)",
        "KR-AI-BASIC": "Art.26"
      },
      "namespace": "AI"
    },
    "AI-CHR.1": {
      "procedure_id": "AI-CHR.1",
      "parent_control": "AI-CHR",
      "title": "Agent Charter Registration",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CHARTER_REGISTRATION",
      "factors": {
        "factor_a": {
          "label": "capabilities_declared",
          "description": "Number of capabilities declared in charter.",
          "regulatory_ref": "EU AI Act Art. 13; NIST AI RMF GOVERN 1.7"
        },
        "factor_b": {
          "label": "constraints_declared",
          "description": "Number of constraints declared.",
          "regulatory_ref": "EU AI Act Art. 13"
        },
        "factor_c": {
          "label": "charter_hash_present",
          "description": "1 if charter hash was recorded, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 13"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Agent must declare at least one capability in its charter."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.13",
        "FIVE-EYES-AGENTIC": "FE-5,FE-9",
        "ISO-42001": "A.6.2.2",
        "NIST-AI-RMF": "GOVERN 1.7",
        "CA-SB-942": "Sec.22757.5(b)",
        "KR-AI-BASIC": "Art.23"
      },
      "namespace": "AI"
    },
    "AI-VIO.1": {
      "procedure_id": "AI-VIO.1",
      "parent_control": "AI-VIO",
      "title": "Policy Violation Record",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_VIOLATION_RECORD",
      "factors": {
        "factor_a": {
          "label": "violation_type_code",
          "description": "Violation type: 0=guardrail, 1=access, 2=scope, 3=policy, 4=safety, 5=other.",
          "regulatory_ref": "EU AI Act Art. 9; NIST AI RMF MANAGE 4.1"
        },
        "factor_b": {
          "label": "severity",
          "description": "Violation severity: 1=low, 2=medium, 3=high, 4=critical.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "auto_remediated",
          "description": "1 if violation was auto-remediated, 0 if escalated.",
          "regulatory_ref": "NIST AI RMF MANAGE 4.1"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0",
        "description": "Records policy violations. Informational -- always PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-2",
        "IL-SB-315": "Sec.30",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-RMF": "MANAGE 4.1"
      },
      "namespace": "AI"
    },
    "AI-FAIR.3": {
      "procedure_id": "AI-FAIR.3",
      "parent_control": "AI-FAIR",
      "title": "Bias Audit Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_BIAS_AUDIT",
      "factors": {
        "factor_a": {
          "label": "groups_tested",
          "description": "Number of demographic groups tested.",
          "regulatory_ref": "EU AI Act Art. 10(2)(f); NIST AI RMF MAP 2.3"
        },
        "factor_b": {
          "label": "disparities_found",
          "description": "Number of disparities above threshold.",
          "regulatory_ref": "EU AI Act Art. 10(2)(f)"
        },
        "factor_c": {
          "label": "max_disparity_pct",
          "description": "Maximum disparity percentage (x10, e.g. 125 = 12.5%).",
          "regulatory_ref": "NIST AI RMF MAP 2.3"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Verifies that a bias audit was conducted with at least one group tested."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1705",
        "EU-AI-ACT": "Art.10(2)(f)",
        "FIVE-EYES-AGENTIC": "FE-15",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MAP 2.3",
        "SR-11-7": "III.A"
      },
      "namespace": "AI"
    },
    "AI-ENV.1": {
      "procedure_id": "AI-ENV.1",
      "parent_control": "AI-ENV",
      "title": "Runtime Environment Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_RUNTIME_ENV",
      "factors": {
        "factor_a": {
          "label": "env_hash_present",
          "description": "1 if environment hash was recorded, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 11; NIST AI RMF GOVERN 1.2"
        },
        "factor_b": {
          "label": "container_isolated",
          "description": "1 if running in isolated container, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 11"
        },
        "factor_c": {
          "label": "runtime_type_code",
          "description": "Runtime: 0=bare_metal, 1=vm, 2=container, 3=serverless, 4=edge.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.2"
        }
      },
      "evaluation": {
        "expression": "factor_a == 1",
        "description": "Runtime environment hash must be recorded."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.11",
        "FIVE-EYES-AGENTIC": "FE-8",
        "ISO-42001": "A.6.2.6",
        "NIST-800-53": "CM-6",
        "NIST-AI-RMF": "GOVERN 1.2"
      },
      "namespace": "AI"
    },
    "AI-ENV.2": {
      "procedure_id": "AI-ENV.2",
      "parent_control": "AI-ENV",
      "title": "Dependency Manifest Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DEPENDENCY_MANIFEST",
      "factors": {
        "factor_a": {
          "label": "dependencies_count",
          "description": "Number of dependencies in manifest.",
          "regulatory_ref": "EU AI Act Art. 11; EO 14028"
        },
        "factor_b": {
          "label": "all_pinned",
          "description": "1 if all dependencies are version-pinned, 0 otherwise.",
          "regulatory_ref": "EO 14028"
        },
        "factor_c": {
          "label": "vulnerabilities_known",
          "description": "Number of known vulnerabilities in dependencies.",
          "regulatory_ref": "EU AI Act Art. 11"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "All dependencies must be version-pinned."
      },
      "frameworks": {
        "EO-14028": "Sec.4",
        "EU-AI-ACT": "Art.11",
        "FIVE-EYES-AGENTIC": "FE-8",
        "ISO-42001": "A.6.2.6",
        "NIST-AI-RMF": "GOVERN 1.2"
      },
      "namespace": "AI"
    },
    "AI-MARK.1": {
      "procedure_id": "AI-MARK.1",
      "parent_control": "AI-MARK",
      "title": "Content Provenance Marking",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CONTENT_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "content_count",
          "description": "Number of content items marked.",
          "regulatory_ref": "EU AI Act Art. 50(2); GPAI Code of Practice"
        },
        "factor_b": {
          "label": "metadata_attached",
          "description": "1 if C2PA/watermark metadata was attached, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 50(2)"
        },
        "factor_c": {
          "label": "content_type_code",
          "description": "Content type: 0=text, 1=image, 2=audio, 3=video, 4=multimodal, 5=code, 6=structured_data.",
          "regulatory_ref": "EU AI Act Art. 50(2)"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "Verifies that content provenance marking was applied."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.50(2)",
        "GPAI-CoP": "Transparency",
        "ISO-42001": "A.8.3",
        "NIST-AI-RMF": "GOVERN 1.7"
      },
      "namespace": "AI"
    },
    "AI-BASE.1": {
      "procedure_id": "AI-BASE.1",
      "parent_control": "AI-BASE",
      "title": "Agent Behavioral Baseline",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_BEHAVIORAL_BASELINE",
      "factors": {
        "factor_a": {
          "label": "dimensions_measured",
          "description": "Number of behavioral dimensions measured.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b); NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "within_envelope",
          "description": "1 if behavior is within baseline envelope, 0 if drift detected.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b)"
        },
        "factor_c": {
          "label": "mode_code",
          "description": "Baseline mode: 0=establishing, 1=monitoring, 2=drift_detected, 3=baseline_reset.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1 or factor_c == 0 or factor_c == 3",
        "description": "Behavior must be within envelope, or mode must be establishing/reset."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(2)(b)",
        "ISO-42001": "A.6.2.4",
        "NIST-800-53": "CM-2",
        "NIST-AI-RMF": "MEASURE 2.6"
      },
      "namespace": "AI"
    },
    "AI-LIC.1": {
      "procedure_id": "AI-LIC.1",
      "parent_control": "AI-LIC",
      "title": "License Provenance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_LICENSE_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "components_checked",
          "description": "Number of license components verified.",
          "regulatory_ref": "EU AI Act Art. 53(1)(d); NIST AI RMF GOVERN 1.7"
        },
        "factor_b": {
          "label": "all_compliant",
          "description": "1 if all components are license-compatible, 0 if violation detected.",
          "regulatory_ref": "EU AI Act Art. 53(1)(d)"
        },
        "factor_c": {
          "label": "license_type_code",
          "description": "License type: 0=permissive, 1=copyleft, 2=proprietary, 3=dual, 4=openmdw, 5=unknown.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.7"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "All license components must be compatible."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.53(1)(d)",
        "ISO-42001": "A.6.2.7",
        "NIST-800-53": "SA-4",
        "NIST-AI-RMF": "GOVERN 1.7"
      },
      "namespace": "AI"
    },
    "AI-SBOM.1": {
      "procedure_id": "AI-SBOM.1",
      "parent_control": "AI-SBOM",
      "title": "AI Bill of Materials",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_BILL_OF_MATERIALS",
      "factors": {
        "factor_a": {
          "label": "total_components",
          "description": "Total components inventoried in the BOM.",
          "regulatory_ref": "G7/CISA SBOM-AI; EU AI Act Art. 11"
        },
        "factor_b": {
          "label": "clusters_documented",
          "description": "G7 clusters documented (0-7: Metadata, Models, Datasets, SystemProps, KPIs, Security, Infrastructure).",
          "regulatory_ref": "G7/CISA SBOM-AI"
        },
        "factor_c": {
          "label": "format_code",
          "description": "BOM format: 0=cyclonedx, 1=spdx, 2=custom, 3=unknown.",
          "regulatory_ref": "EU AI Act Art. 11; EO 14028"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_b >= 3",
        "description": "BOM must have at least one component and document at least 3 G7 clusters."
      },
      "frameworks": {
        "EO-14028": "Sec.4",
        "EU-AI-ACT": "Art.11",
        "G7-CISA": "SBOM-AI",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.4",
        "NIST-AI-RMF": "MAP 1.1",
        "NIS-2": "Art.21(2)(e)"
      },
      "namespace": "AI"
    },
    "AI-REDTEAM.1": {
      "procedure_id": "AI-REDTEAM.1",
      "parent_control": "AI-REDTEAM",
      "title": "Adversarial Test Campaign",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ADVERSARIAL_TEST",
      "factors": {
        "factor_a": {
          "label": "tests_executed",
          "description": "Number of attack scenarios executed.",
          "regulatory_ref": "EO 14110; EU AI Act Art. 9(7)"
        },
        "factor_b": {
          "label": "tests_passed",
          "description": "Number of attacks successfully mitigated.",
          "regulatory_ref": "EO 14110; EU AI Act Art. 9(7)"
        },
        "factor_c": {
          "label": "coverage_category_code",
          "description": "Coverage category: 0=prompt_injection, 1=jailbreak, 2=data_poisoning, 3=model_extraction, 4=membership_inference, 5=adversarial_examples, 6=supply_chain, 7=denial_of_service, 8=output_manipulation, 9=privilege_escalation, 10=comprehensive.",
          "regulatory_ref": "NIST AI 100-2; OWASP LLM Top 10"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_b / factor_a >= 0.8",
        "description": "At least one test must be executed with at least 80% pass rate."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(7)",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-100-2": "Red Teaming",
        "NIST-AI-RMF": "MEASURE 3.1",
        "NIS-2": "Art.21(2)(f)",
        "CA-SB-942": "Sec.22757.5(f)"
      },
      "namespace": "AI"
    },
    "AI-CONSENT.1": {
      "procedure_id": "AI-CONSENT.1",
      "parent_control": "AI-CONSENT",
      "title": "Data Subject Consent",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DATA_SUBJECT_CONSENT",
      "factors": {
        "factor_a": {
          "label": "subjects_covered",
          "description": "Number of data subjects in scope.",
          "regulatory_ref": "GDPR Art. 6/7; EU AI Act Art. 10"
        },
        "factor_b": {
          "label": "legal_basis_code",
          "description": "GDPR lawful basis: 0=consent, 1=contract, 2=legal_obligation, 3=vital_interest, 4=public_task, 5=legitimate_interest.",
          "regulatory_ref": "GDPR Art. 6(1)"
        },
        "factor_c": {
          "label": "withdrawal_available",
          "description": "1 if withdrawal mechanism exists, 0 otherwise.",
          "regulatory_ref": "GDPR Art. 7(3)"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "At least one data subject must be covered with documented legal basis."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1704",
        "EU-AI-ACT": "Art.10",
        "GDPR": "Art.6/7",
        "ISO-42001": "A.8.2",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-MULTI.1": {
      "procedure_id": "AI-MULTI.1",
      "parent_control": "AI-MULTI",
      "title": "Multi-Agent Delegation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MULTI_AGENT_DELEGATION",
      "factors": {
        "factor_a": {
          "label": "delegation_depth",
          "description": "Hops from original human authorization.",
          "regulatory_ref": "EU AI Act Art. 9; NIST AI RMF GOVERN 1.3"
        },
        "factor_b": {
          "label": "permissions_granted",
          "description": "Count of distinct permissions delegated.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "time_bound_minutes",
          "description": "Minutes until delegation expires (0 = unbounded).",
          "regulatory_ref": "NIST AI RMF GOVERN 1.3"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0",
        "description": "Records inter-agent delegation. Informational -- always PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "FIVE-EYES-AGENTIC": "FE-3",
        "ISO-42001": "A.8.5",
        "NIST-AI-RMF": "GOVERN 1.3",
        "OWASP-AGENTIC": "MCP-06"
      },
      "namespace": "AI"
    },
    "AI-DRIFT.1": {
      "procedure_id": "AI-DRIFT.1",
      "parent_control": "AI-DRIFT",
      "title": "Model Drift Detection",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DRIFT_DETECTION",
      "factors": {
        "factor_a": {
          "label": "metrics_evaluated",
          "description": "Number of drift metrics evaluated.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b); NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "drifted_count",
          "description": "Number of metrics showing drift.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b)"
        },
        "factor_c": {
          "label": "drift_type_code",
          "description": "Drift type: 0=data, 1=concept, 2=prediction, 3=feature, 4=label, 5=prior_probability.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        }
      },
      "evaluation": {
        "expression": "factor_b == 0",
        "description": "No metrics should show drift. Drift detected is informational."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(2)(b)",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-RMF": "MEASURE 2.6",
        "SR-11-7": "IV.A",
        "NIS-2": "Art.21(2)(f)"
      },
      "namespace": "AI"
    },
    "AI-AUDIT.1": {
      "procedure_id": "AI-AUDIT.1",
      "parent_control": "AI-AUDIT",
      "title": "Audit Log Integrity",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_AUDIT_INTEGRITY",
      "factors": {
        "factor_a": {
          "label": "entries_checked",
          "description": "Number of audit log entries verified.",
          "regulatory_ref": "EU AI Act Art. 12; GDPR Art. 30"
        },
        "factor_b": {
          "label": "integrity_verified",
          "description": "1 if log integrity verified, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 12"
        },
        "factor_c": {
          "label": "log_format_code",
          "description": "Log format: 0=jsonl, 1=syslog, 2=otel, 3=custom.",
          "regulatory_ref": "EU AI Act Art. 12"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Audit log integrity must be verified."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1706",
        "EU-AI-ACT": "Art.12",
        "GDPR": "Art.30",
        "IL-SB-315": "Sec.30",
        "ISO-42001": "9.2",
        "NIST-AI-RMF": "GOVERN 1.4",
        "NIS-2": "Art.21(2)(a)",
        "CA-SB-942": "Sec.22757.5(a)",
        "NYC-LL144": "Sec.20-871(c)"
      },
      "namespace": "AI"
    },
    "AI-INCIDENT.1": {
      "procedure_id": "AI-INCIDENT.1",
      "parent_control": "AI-INCIDENT",
      "title": "Incident Reporting",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_INCIDENT_REPORT",
      "factors": {
        "factor_a": {
          "label": "severity_code",
          "description": "Incident severity: 1=low, 2=medium, 3=high, 4=critical.",
          "regulatory_ref": "EU AI Act Art. 62"
        },
        "factor_b": {
          "label": "authority_notified",
          "description": "1 if authority was notified, 0 otherwise.",
          "regulatory_ref": "EU AI Act Art. 62"
        },
        "factor_c": {
          "label": "incident_type_code",
          "description": "Incident type: 0=safety, 1=rights, 2=security, 3=performance, 4=bias, 5=other.",
          "regulatory_ref": "NIST AI RMF MANAGE 3.2"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0",
        "description": "Records incident report. Informational -- always PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.62",
        "IL-SB-315": "Sec.30",
        "ISO-42001": "A.6.2.5",
        "NIST-800-53": "IR-4",
        "NIST-AI-RMF": "MANAGE 3.2",
        "NIS-2": "Art.21(2)(b)"
      },
      "namespace": "AI"
    },
    "AI-PERF.1": {
      "procedure_id": "AI-PERF.1",
      "parent_control": "AI-PERF",
      "title": "Performance Metrics",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_PERFORMANCE_METRICS",
      "factors": {
        "factor_a": {
          "label": "metrics_evaluated",
          "description": "Number of performance metrics evaluated.",
          "regulatory_ref": "EU AI Act Art. 15(1); NIST AI RMF MEASURE 2.5"
        },
        "factor_b": {
          "label": "metrics_passing",
          "description": "Number of metrics meeting threshold.",
          "regulatory_ref": "EU AI Act Art. 15(1)"
        },
        "factor_c": {
          "label": "benchmark_type_code",
          "description": "Benchmark type: 0=accuracy, 1=precision, 2=recall, 3=f1, 4=auc, 5=custom.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        }
      },
      "evaluation": {
        "expression": "factor_b == factor_a",
        "description": "All metrics should pass their thresholds."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(1)",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-RMF": "MEASURE 2.5",
        "SR-11-7": "IV.A",
        "NIS-2": "Art.21(2)(f)"
      },
      "namespace": "AI"
    },
    "AI-ROBUST.1": {
      "procedure_id": "AI-ROBUST.1",
      "parent_control": "AI-ROBUST",
      "title": "Robustness Testing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ROBUSTNESS_TEST",
      "factors": {
        "factor_a": {
          "label": "perturbations_tested",
          "description": "Number of perturbation scenarios tested.",
          "regulatory_ref": "EU AI Act Art. 15(3); NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "perturbations_survived",
          "description": "Number of perturbations the model survived.",
          "regulatory_ref": "EU AI Act Art. 15(3)"
        },
        "factor_c": {
          "label": "perturbation_type_code",
          "description": "Perturbation type: 0=noise, 1=corruption, 2=missing_data, 3=out_of_distribution, 4=edge_case, 5=adversarial_input.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        }
      },
      "evaluation": {
        "expression": "factor_b / factor_a >= 0.9",
        "description": "At least 90% of perturbations should be survived."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(3)",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.6",
        "NIST-AI-RMF": "MEASURE 2.6",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-CYBER.1": {
      "procedure_id": "AI-CYBER.1",
      "parent_control": "AI-CYBER",
      "title": "Cybersecurity Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_CYBERSECURITY",
      "factors": {
        "factor_a": {
          "label": "controls_assessed",
          "description": "Number of cybersecurity controls assessed.",
          "regulatory_ref": "EU AI Act Art. 15(4); NIST CSF"
        },
        "factor_b": {
          "label": "controls_compliant",
          "description": "Number of controls found compliant.",
          "regulatory_ref": "EU AI Act Art. 15(4)"
        },
        "factor_c": {
          "label": "framework_code",
          "description": "Framework: 0=nist_csf, 1=iso27001, 2=owasp, 3=cis, 4=custom.",
          "regulatory_ref": "NIST CSF"
        }
      },
      "evaluation": {
        "expression": "factor_b == factor_a",
        "description": "All assessed controls should be compliant."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15(4)",
        "IL-SB-315": "Sec.25",
        "ISO-42001": "A.6.2.6",
        "NIST-800-53": "CA-2",
        "NIST-AI-RMF": "MANAGE 2.2",
        "NIST-CSF": "Core"
      },
      "namespace": "AI"
    },
    "AI-TRANS.1": {
      "procedure_id": "AI-TRANS.1",
      "parent_control": "AI-TRANS",
      "title": "Transparency Disclosure",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TRANSPARENCY",
      "factors": {
        "factor_a": {
          "label": "disclosures_made",
          "description": "Number of transparency disclosures made.",
          "regulatory_ref": "EU AI Act Art. 13; GDPR Art. 13/14"
        },
        "factor_b": {
          "label": "disclosure_type_code",
          "description": "Disclosure type: 0=ai_usage, 1=data_processing, 2=automated_decision, 3=profiling, 4=capability_limitation.",
          "regulatory_ref": "EU AI Act Art. 13"
        },
        "factor_c": {
          "label": "recipient_type_code",
          "description": "Recipient: 0=deployer, 1=end_user, 2=data_subject, 3=authority.",
          "regulatory_ref": "GDPR Art. 13/14"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "At least one disclosure must be made."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.13",
        "GDPR": "Art.13/14",
        "ISO-42001": "A.8.3",
        "NIST-AI-RMF": "GOVERN 1.7",
        "CA-SB-942": "Sec.22757.5(a)",
        "KR-AI-BASIC": "Art.22",
        "TX-TRAIGA": "Sec.224.104",
        "NYC-LL144": "Sec.20-871(b)"
      },
      "namespace": "AI"
    },
    "AI-WATERMARK.1": {
      "procedure_id": "AI-WATERMARK.1",
      "parent_control": "AI-WATERMARK",
      "title": "Watermark Verification",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_WATERMARK_VERIFY",
      "factors": {
        "factor_a": {
          "label": "items_checked",
          "description": "Number of content items checked for watermarks.",
          "regulatory_ref": "EU AI Act Art. 50(2)"
        },
        "factor_b": {
          "label": "watermarks_detected",
          "description": "Number of watermarks successfully detected.",
          "regulatory_ref": "EU AI Act Art. 50(2)"
        },
        "factor_c": {
          "label": "detection_method_code",
          "description": "Detection method: 0=c2pa_verify, 1=synthid_check, 2=metadata_scan, 3=spectral_analysis, 4=classifier.",
          "regulatory_ref": "GPAI Code of Practice"
        }
      },
      "evaluation": {
        "expression": "factor_b == factor_a",
        "description": "All checked items should have detectable watermarks."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.50(2)",
        "GPAI-CoP": "Transparency",
        "ISO-42001": "A.8.3",
        "NIST-AI-RMF": "GOVERN 1.7"
      },
      "namespace": "AI"
    },
    "AI-DPIA.1": {
      "procedure_id": "AI-DPIA.1",
      "parent_control": "AI-DPIA",
      "title": "Data Protection Impact Assessment",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DPIA",
      "factors": {
        "factor_a": {
          "label": "risks_identified",
          "description": "Number of risks identified in the DPIA.",
          "regulatory_ref": "GDPR Art. 35; EU AI Act Art. 27"
        },
        "factor_b": {
          "label": "risks_mitigated",
          "description": "Number of risks with mitigation measures.",
          "regulatory_ref": "GDPR Art. 35"
        },
        "factor_c": {
          "label": "processing_type_code",
          "description": "Processing type: 0=profiling, 1=automated_decision, 2=large_scale_monitoring, 3=sensitive_data, 4=combined.",
          "regulatory_ref": "GDPR Art. 35"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a * 0.8",
        "description": "At least 80% of identified risks should have mitigation measures."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.27",
        "GDPR": "Art.35",
        "ISO-42001": "6.1.2",
        "NIST-800-53": "RA-3",
        "NIST-AI-RMF": "MAP 5.2",
        "KR-AI-BASIC": "Art.27"
      },
      "namespace": "AI"
    },
    "AI-AUTO.1": {
      "procedure_id": "AI-AUTO.1",
      "parent_control": "AI-AUTO",
      "title": "Automated Decision Notification",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_AUTO_DECISION",
      "factors": {
        "factor_a": {
          "label": "decisions_made",
          "description": "Number of automated decisions made.",
          "regulatory_ref": "GDPR Art. 22; EU AI Act Art. 14"
        },
        "factor_b": {
          "label": "human_reviewed",
          "description": "Number of decisions with human review.",
          "regulatory_ref": "GDPR Art. 22"
        },
        "factor_c": {
          "label": "decision_type_code",
          "description": "Decision type: 0=credit, 1=employment, 2=insurance, 3=benefits, 4=legal, 5=other.",
          "regulatory_ref": "GDPR Art. 22"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0",
        "description": "Records automated decisions. Informational -- always PASS."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.14",
        "GDPR": "Art.22",
        "ISO-42001": "A.8.4",
        "NIST-AI-RMF": "MANAGE 3.2"
      },
      "namespace": "AI"
    },
    "AI-DUALUSE.1": {
      "procedure_id": "AI-DUALUSE.1",
      "parent_control": "AI-DUALUSE",
      "title": "Dual-Use Model Classification",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DUALUSE_CLASS",
      "factors": {
        "factor_a": {
          "label": "classification_code",
          "description": "Classification: 0=standard, 1=dual_use, 2=high_impact.",
          "regulatory_ref": "EO 14110 Sec 4(a)"
        },
        "factor_b": {
          "label": "reporting_status_code",
          "description": "Status: 0=not_required, 1=pending, 2=notified, 3=acknowledged.",
          "regulatory_ref": "EO 14110 Sec 4(a)"
        },
        "factor_c": {
          "label": "days_since_classification",
          "description": "Days since model was classified.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.1"
        }
      },
      "evaluation": {
        "expression": "factor_a == 0 or factor_b >= 2",
        "description": "Standard models pass. Dual-use must be notified or acknowledged."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.6",
        "ISO-42001": "A.6.2.3",
        "NIST-AI-RMF": "GOVERN 1.1"
      },
      "namespace": "AI"
    },
    "AI-SUPPLY.1": {
      "procedure_id": "AI-SUPPLY.1",
      "parent_control": "AI-SUPPLY",
      "title": "Supply Chain Risk",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_SUPPLY_CHAIN",
      "factors": {
        "factor_a": {
          "label": "suppliers_assessed",
          "description": "Number of suppliers assessed.",
          "regulatory_ref": "NIST AI RMF MEASURE 3.1; G7/CISA SBOM-AI"
        },
        "factor_b": {
          "label": "suppliers_compliant",
          "description": "Number of suppliers found compliant.",
          "regulatory_ref": "NIST AI RMF MEASURE 3.1"
        },
        "factor_c": {
          "label": "risk_level_code",
          "description": "Risk level: 0=low, 1=medium, 2=high, 3=critical.",
          "regulatory_ref": "EO 14028"
        }
      },
      "evaluation": {
        "expression": "factor_b == factor_a",
        "description": "All assessed suppliers should be compliant."
      },
      "frameworks": {
        "EO-14028": "Sec.4",
        "EU-AI-ACT": "Art.25",
        "G7-CISA": "SBOM-AI",
        "ISO-42001": "A.6.2.7",
        "NIST-800-53": "SA-4",
        "NIST-AI-RMF": "MEASURE 3.1"
      },
      "namespace": "AI"
    },
    "AI-PMM.1": {
      "procedure_id": "AI-PMM.1",
      "parent_control": "AI-PMM",
      "title": "Post-Market Monitoring",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_POST_MARKET",
      "factors": {
        "factor_a": {
          "label": "monitoring_checks_run",
          "description": "Number of monitoring checks executed.",
          "regulatory_ref": "EU AI Act Art. 72; NIST AI RMF MANAGE 4.1"
        },
        "factor_b": {
          "label": "anomalies_detected",
          "description": "Number of anomalies detected during monitoring.",
          "regulatory_ref": "EU AI Act Art. 72"
        },
        "factor_c": {
          "label": "monitoring_type_code",
          "description": "Type: 0=performance, 1=fairness, 2=safety, 3=security, 4=comprehensive.",
          "regulatory_ref": "NIST AI RMF MANAGE 4.1"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0",
        "description": "At least one monitoring check must be executed."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.72",
        "GPAI-CoP": "Art.55",
        "ISO-42001": "A.6.2.5",
        "NIST-AI-RMF": "MANAGE 4.1"
      },
      "namespace": "AI"
    },
    "AI-AUTO.2": {
      "procedure_id": "AI-AUTO.2",
      "parent_control": "AI-AUTO",
      "title": "Autonomous Generation Depth",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_AUTO_GEN_DEPTH",
      "factors": {
        "factor_a": {
          "label": "max_autonomous_depth",
          "description": "Maximum allowed AI-to-AI generation cycles before human gate required.",
          "regulatory_ref": "EU AI Act Art. 14; EO 14110 Sec. 3",
          "default": 1
        },
        "factor_b": {
          "label": "observed_depth",
          "description": "Actual generation depth at time of witnessing.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.5"
        },
        "factor_c": {
          "label": "human_gate_present",
          "description": "Whether human approval was verified: 1 = present, 0 = autonomous.",
          "regulatory_ref": "EU AI Act Art. 14(4)(d)"
        }
      },
      "evaluation": {
        "expression": "factor_b <= factor_a AND factor_c == 1",
        "description": "PASS if generation depth is within policy AND human gate was present."
      },
      "frameworks": {
        "CO-SB-26-189": "6-1-1703",
        "EU-AI-ACT": "Art.14",
        "FIVE-EYES-AGENTIC": "FE-5",
        "ISO-42001": "A.8.5",
        "NIST-800-53": "CM-3",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-AUDIT.2": {
      "procedure_id": "AI-AUDIT.2",
      "parent_control": "AI-AUDIT",
      "title": "External Timestamp Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_AUDIT_TIMESTAMP",
      "factors": {
        "factor_a": {
          "label": "anchor_count",
          "description": "Number of anchors in the timestamped batch.",
          "regulatory_ref": "NIST 800-53 AU-10"
        },
        "factor_b": {
          "label": "tsa_verified",
          "description": "Whether TSA response was received and validated: 1 = verified, 0 = not.",
          "regulatory_ref": "EU AI Act Art. 12(1)"
        },
        "factor_c": {
          "label": "tsa_provider_code",
          "description": "TSA provider: 0=none, 1=freetsa, 2=digicert, 3=sectigo, 4=custom.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.4"
        }
      },
      "evaluation": {
        "expression": "factor_b >= 1",
        "description": "PASS if TSA response was received and validated."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.12(1)",
        "FIVE-EYES-AGENTIC": "FE-4",
        "ISO-42001": "9.2",
        "NIST-800-53": "AU-10",
        "NIST-AI-RMF": "GOVERN 1.4"
      },
      "namespace": "AI"
    },
    "AI-ENG.1": {
      "procedure_id": "AI-ENG.1",
      "parent_control": "AI-ENG",
      "title": "Design Generation Provenance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DESIGN_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "constraints_applied",
          "description": "Number of design constraints applied to the generation.",
          "regulatory_ref": "DO-178C 5.1; ASME V&V 10 3.1"
        },
        "factor_b": {
          "label": "parameters_generated",
          "description": "Number of design parameters generated by the AI.",
          "regulatory_ref": "ISO 26262-6; FDA 21 CFR 11.10(a)"
        },
        "factor_c": {
          "label": "design_domain_code",
          "description": "Design domain: 0=mechanical, 1=chemical, 2=electrical, 3=structural, 4=thermal, 5=pharmaceutical, 6=semiconductor, 7=custom.",
          "regulatory_ref": "EU AI Act Art. 10(2)"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1",
        "description": "At least one design constraint must be applied."
      },
      "frameworks": {
        "ASME-VV10": "V&V 10 3.1",
        "DO-178C": "5.1",
        "EU-AI-ACT": "Art.10(2)",
        "FDA-21CFR11": "11.10(a)",
        "ISO-26262": "Part 6",
        "NIST-AI-RMF": "MAP 1.1"
      },
      "namespace": "AI"
    },
    "AI-ENG.2": {
      "procedure_id": "AI-ENG.2",
      "parent_control": "AI-ENG",
      "title": "Simulation Validation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_SIMULATION_VALIDATION",
      "factors": {
        "factor_a": {
          "label": "simulations_run",
          "description": "Number of simulations executed against the AI-generated design.",
          "regulatory_ref": "DO-178C 6.3; ASME V&V 10 4.1"
        },
        "factor_b": {
          "label": "simulations_passed",
          "description": "Number of simulations that met acceptance criteria.",
          "regulatory_ref": "ISO 26262-4; FDA 21 CFR 11.10(a)"
        },
        "factor_c": {
          "label": "simulation_type_code",
          "description": "Simulation type: 0=fea, 1=cfd, 2=molecular, 3=thermal, 4=electromagnetic, 5=multiphysics, 6=custom.",
          "regulatory_ref": "ASME V&V 10 4.1"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All simulations must pass acceptance criteria."
      },
      "frameworks": {
        "ASME-VV10": "V&V 10 4.1",
        "DO-178C": "6.3",
        "EU-AI-ACT": "Art.15(1)",
        "FDA-21CFR11": "11.10(a)",
        "ISO-26262": "Part 4",
        "NIST-AI-RMF": "MEASURE 2.6"
      },
      "namespace": "AI"
    },
    "AI-ENG.3": {
      "procedure_id": "AI-ENG.3",
      "parent_control": "AI-ENG",
      "title": "Safety-Critical Review Gate",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_SAFETY_REVIEW_GATE",
      "factors": {
        "factor_a": {
          "label": "reviewers_required",
          "description": "Number of reviewers required for approval.",
          "regulatory_ref": "DO-178C 7.2; ISO 26262-2"
        },
        "factor_b": {
          "label": "reviewers_approved",
          "description": "Number of reviewers who approved the design.",
          "regulatory_ref": "FDA 21 CFR 11.10(g)"
        },
        "factor_c": {
          "label": "approval_type_code",
          "description": "Approval type: 0=peer, 1=pe_stamp, 2=safety_board, 3=regulatory, 4=independent_assessor.",
          "regulatory_ref": "DO-178C 7.2"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All required reviewers must approve."
      },
      "frameworks": {
        "ASME-VV10": "V&V 10 2.3",
        "DO-178C": "7.2",
        "EU-AI-ACT": "Art.14(1)",
        "FDA-21CFR11": "11.10(g)",
        "ISO-26262": "Part 2",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-ENG.4": {
      "procedure_id": "AI-ENG.4",
      "parent_control": "AI-ENG",
      "title": "Material Specification Compliance",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MATERIAL_COMPLIANCE",
      "factors": {
        "factor_a": {
          "label": "specifications_checked",
          "description": "Number of material/safety specifications checked.",
          "regulatory_ref": "ASME V&V 10 3.3; ISO 26262-8"
        },
        "factor_b": {
          "label": "specifications_met",
          "description": "Number of specifications the design meets.",
          "regulatory_ref": "DO-254 5.3; FDA 21 CFR 11.10(b)"
        },
        "factor_c": {
          "label": "standard_code",
          "description": "Standard body: 0=asme, 1=iso, 2=astm, 3=mil_spec, 4=fda_usp, 5=iec, 6=custom.",
          "regulatory_ref": "ASME V&V 10 3.3"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All checked specifications must be met."
      },
      "frameworks": {
        "ASME-VV10": "V&V 10 3.3",
        "DO-178C": "5.3",
        "EU-AI-ACT": "Art.15(3)",
        "FDA-21CFR11": "11.10(b)",
        "ISO-26262": "Part 8",
        "NIST-AI-RMF": "MANAGE 2.1"
      },
      "namespace": "AI"
    },
    "AI-ENG.5": {
      "procedure_id": "AI-ENG.5",
      "parent_control": "AI-ENG",
      "title": "Design Revision Chain",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DESIGN_REVISION_CHAIN",
      "factors": {
        "factor_a": {
          "label": "total_revisions",
          "description": "Total number of design revisions in the chain.",
          "regulatory_ref": "DO-178C 7.3; ASME V&V 10 2.4"
        },
        "factor_b": {
          "label": "ai_generated_revisions",
          "description": "Number of revisions generated by AI (vs human-modified).",
          "regulatory_ref": "FDA 21 CFR 11.10(e)"
        },
        "factor_c": {
          "label": "chain_status_code",
          "description": "Chain status: 0=in_progress, 1=approved, 2=rejected, 3=superseded, 4=archived.",
          "regulatory_ref": "ISO 26262-8 Ch.8"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1",
        "description": "At least one revision must exist in the chain."
      },
      "frameworks": {
        "ASME-VV10": "V&V 10 2.4",
        "DO-178C": "7.3",
        "EU-AI-ACT": "Art.12(1)",
        "FDA-21CFR11": "11.10(e)",
        "ISO-26262": "Part 8 Ch.8",
        "NIST-AI-RMF": "MAP 2.3"
      },
      "namespace": "AI"
    },
    "AI-ENG.6": {
      "procedure_id": "AI-ENG.6",
      "parent_control": "AI-ENG",
      "title": "Fabrication Release Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_FABRICATION_RELEASE",
      "factors": {
        "factor_a": {
          "label": "design_hash_verified",
          "description": "1 if final design hash matches approved design, 0 if mismatch.",
          "regulatory_ref": "DO-178C 5.5; FDA 21 CFR 11.10(f)"
        },
        "factor_b": {
          "label": "authorization_count",
          "description": "Number of fabrication authorizations received.",
          "regulatory_ref": "ISO 26262-4 7.4.4"
        },
        "factor_c": {
          "label": "release_type_code",
          "description": "Release type: 0=prototype, 1=limited_run, 2=mass_production, 3=field_modification, 4=emergency.",
          "regulatory_ref": "ASME V&V 10 5.1"
        }
      },
      "evaluation": {
        "expression": "factor_a == 1 and factor_b >= 1",
        "description": "Design hash must match and at least one authorization required."
      },
      "frameworks": {
        "ASME-VV10": "V&V 10 5.1",
        "DO-178C": "5.5",
        "EU-AI-ACT": "Art.16(a)",
        "FDA-21CFR11": "11.10(f)",
        "ISO-26262": "Part 4 7.4.4",
        "NIST-AI-RMF": "MANAGE 2.2"
      },
      "namespace": "AI"
    },
    "AI-FIN.1": {
      "procedure_id": "AI-FIN.1",
      "parent_control": "AI-FIN",
      "title": "Agent Transaction Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TRANSACTION_WITNESS",
      "factors": {
        "factor_a": {
          "label": "authorization_type",
          "description": "Authorization type: 0=none, 1=pre-approved, 2=human, 3=policy, 4=budget_limit.",
          "regulatory_ref": "EU AI Act Art. 14; NIST AI RMF MANAGE 2.2"
        },
        "factor_b": {
          "label": "amount_cents",
          "description": "Transaction amount in cents (integer).",
          "regulatory_ref": "SR 11-7 III.B"
        },
        "factor_c": {
          "label": "status",
          "description": "Transaction status: 0=pending, 1=authorized, 2=denied, 3=escalated.",
          "regulatory_ref": "EU AI Act Art. 14(4)"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1",
        "description": "Transaction must have some form of authorization (not 'none')."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 14",
        "NIST-AI-RMF": "MANAGE 2.2",
        "SR-11-7": "III.B",
        "GPAI-COP": "Rule 17"
      },
      "namespace": "AI"
    },
    "AI-TOOL.2": {
      "procedure_id": "AI-TOOL.2",
      "parent_control": "AI-TOOL",
      "title": "Tool Permission Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TOOL_PERMISSION",
      "factors": {
        "factor_a": {
          "label": "granted_tool_count",
          "description": "Number of tools granted to the agent at runtime.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.5"
        },
        "factor_b": {
          "label": "charter_match",
          "description": "1 if runtime tools match agent charter, 0 if drift detected.",
          "regulatory_ref": "EU AI Act Art. 9"
        },
        "factor_c": {
          "label": "permission_change_type",
          "description": "Permission change: 0=none, 1=added, 2=removed, 3=escalated.",
          "regulatory_ref": "OWASP-AGENTIC-10 A01"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Runtime tools must match the agent charter (no drift)."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 9",
        "NIST-AI-RMF": "GOVERN 1.5",
        "OWASP-AGENTIC-10": "A01",
        "FIVE-EYES-AGENTIC": "Principle 3"
      },
      "namespace": "AI"
    },
    "AI-LCM.1": {
      "procedure_id": "AI-LCM.1",
      "parent_control": "AI-LCM",
      "title": "Agent Lifecycle Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_LIFECYCLE_EVENT",
      "factors": {
        "factor_a": {
          "label": "event_type",
          "description": "Lifecycle event: 0=spawn, 1=checkpoint, 2=migrate, 3=terminate, 4=crash.",
          "regulatory_ref": "EU AI Act Art. 12; NIST AI RMF MAP 1.3"
        },
        "factor_b": {
          "label": "context_tokens",
          "description": "Number of context tokens at event time (integer).",
          "regulatory_ref": "EU AI Act Art. 12(2)"
        },
        "factor_c": {
          "label": "state_hash_present",
          "description": "1 if state hash was recorded, 0 if no state hash.",
          "regulatory_ref": "NIST AI RMF MAP 1.3"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0",
        "description": "All lifecycle events are recorded (always PASS for witnessing)."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 12",
        "NIST-AI-RMF": "MAP 1.3",
        "ISO-42001": "6.1.2",
        "FIVE-EYES-AGENTIC": "Principle 5"
      },
      "namespace": "AI"
    },
    "AI-JUR.1": {
      "procedure_id": "AI-JUR.1",
      "parent_control": "AI-JUR",
      "title": "Cross-Border Inference Routing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ROUTING_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "serving_region_code",
          "description": "ISO 3166 numeric code for serving region.",
          "regulatory_ref": "GDPR Art. 44-49"
        },
        "factor_b": {
          "label": "user_region_code",
          "description": "ISO 3166 numeric code for user region.",
          "regulatory_ref": "EU AI Act Art. 10(5)"
        },
        "factor_c": {
          "label": "compliance_status",
          "description": "Routing compliance: 0=unchecked, 1=compliant, 2=blocked, 3=override.",
          "regulatory_ref": "GDPR Art. 46"
        }
      },
      "evaluation": {
        "expression": "factor_c == 1 or factor_c == 2",
        "description": "Routing must be compliant or blocked (not unchecked or override without justification)."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 10(5)",
        "GDPR": "Art. 44-49",
        "NIST-AI-RMF": "GOVERN 1.7",
        "GPAI-COP": "Rule 5"
      },
      "namespace": "AI"
    },
    "AI-MOB.1": {
      "procedure_id": "AI-MOB.1",
      "parent_control": "AI-MOB",
      "title": "SIM-Bound Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_SIM_BOUND_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "sim_identity_hash",
          "description": "Hash of SIM identity binding (ICCID/IMSI). 0 if unavailable.",
          "regulatory_ref": "EU AI Act Art. 15(4)"
        },
        "factor_b": {
          "label": "offline_integrity",
          "description": "1 if offline attestation chain is intact, 0 if broken.",
          "regulatory_ref": "EU AI Act Art. 9(2)(c)"
        },
        "factor_c": {
          "label": "binding_method",
          "description": "SIM binding: 0=none, 1=iccid, 2=imsi_hash, 3=esim_eid, 4=dual_sim.",
          "regulatory_ref": "NIST AI RMF MANAGE 2.4"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Offline attestation chain must be intact."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 15(4)",
        "NIST-AI-RMF": "MANAGE 2.4"
      },
      "namespace": "AI"
    },
    "AI-MOB.2": {
      "procedure_id": "AI-MOB.2",
      "parent_control": "AI-MOB",
      "title": "Roaming Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ROAMING_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "home_network_hash",
          "description": "Hash of home network identifier.",
          "regulatory_ref": "EU AI Act Art. 9(7)"
        },
        "factor_b": {
          "label": "visited_network_hash",
          "description": "Hash of visited network identifier. Equals factor_a if not roaming.",
          "regulatory_ref": "EU AI Act Art. 9(7)"
        },
        "factor_c": {
          "label": "roaming_policy",
          "description": "Policy disposition: 0=allow, 1=restrict, 2=deny, 3=escalate.",
          "regulatory_ref": "NIST AI RMF GOVERN 1.1"
        }
      },
      "evaluation": {
        "expression": "factor_c <= 1",
        "description": "Roaming policy must be allow or restrict (not deny/escalate) for PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 9(7)",
        "NIST-AI-RMF": "GOVERN 1.1"
      },
      "namespace": "AI"
    },
    "AI-MOB.3": {
      "procedure_id": "AI-MOB.3",
      "parent_control": "AI-MOB",
      "title": "Dual-SIM Policy Enforcement",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DUAL_SIM_POLICY",
      "factors": {
        "factor_a": {
          "label": "active_sims",
          "description": "Number of active SIM profiles on device.",
          "regulatory_ref": "EU AI Act Art. 15(4)"
        },
        "factor_b": {
          "label": "policy_compliant",
          "description": "1 if dual-SIM routing complies with data residency policy, 0 otherwise.",
          "regulatory_ref": "GDPR Art. 44-49"
        },
        "factor_c": {
          "label": "routing_mode",
          "description": "Data routing: 0=primary_only, 1=failover, 2=load_balance, 3=geo_fenced.",
          "regulatory_ref": "NIS-2 Art. 21"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Dual-SIM routing must comply with data residency policy."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 15(4)",
        "GDPR": "Art. 44-49",
        "NIS-2": "Art. 21"
      },
      "namespace": "AI"
    },
    "AI-MOB.4": {
      "procedure_id": "AI-MOB.4",
      "parent_control": "AI-MOB",
      "title": "Peer-to-Peer Trust Mesh",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_P2P_TRUST_MESH",
      "factors": {
        "factor_a": {
          "label": "peer_count",
          "description": "Number of peers in local mesh.",
          "regulatory_ref": "NIST AI RMF MANAGE 2.2"
        },
        "factor_b": {
          "label": "verified_peers",
          "description": "Number of peers with verified trust credentials.",
          "regulatory_ref": "EU AI Act Art. 15(1)"
        },
        "factor_c": {
          "label": "mesh_mode",
          "description": "Mesh topology: 0=isolated, 1=relay, 2=direct, 3=broadcast.",
          "regulatory_ref": "NIST AI RMF MANAGE 2.4"
        }
      },
      "evaluation": {
        "expression": "factor_b >= 1",
        "description": "At least one peer must have verified trust credentials."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 15(1)",
        "NIST-AI-RMF": "MANAGE 2.2"
      },
      "namespace": "AI"
    },
    "AI-MOB.5": {
      "procedure_id": "AI-MOB.5",
      "parent_control": "AI-MOB",
      "title": "Bilateral Flush Correlation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_BILATERAL_FLUSH",
      "factors": {
        "factor_a": {
          "label": "local_anchor_count",
          "description": "Anchors buffered locally before flush.",
          "regulatory_ref": "EU AI Act Art. 12"
        },
        "factor_b": {
          "label": "correlated_count",
          "description": "Anchors successfully correlated with clearing house after flush.",
          "regulatory_ref": "EU AI Act Art. 12"
        },
        "factor_c": {
          "label": "flush_mode",
          "description": "Flush type: 0=manual, 1=connectivity_restored, 2=scheduled, 3=peer_relay.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.5"
        }
      },
      "evaluation": {
        "expression": "factor_b == factor_a",
        "description": "All locally buffered anchors must be correlated after flush."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 12",
        "NIST-AI-RMF": "MEASURE 2.5"
      },
      "namespace": "AI"
    },
    "AI-MOB.6": {
      "procedure_id": "AI-MOB.6",
      "parent_control": "AI-MOB",
      "title": "Trajectory Decision Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_TRAJECTORY_DECISION",
      "factors": {
        "factor_a": {
          "label": "attestation_required",
          "description": "1.0 if trajectory attestation is required by policy, 0.0 if voluntary.",
          "regulatory_ref": "EU AI Act Annex III(3a)",
          "default": 1.0
        },
        "factor_b": {
          "label": "safety_validated",
          "description": "1.0 if trajectory passed safety validation, 0.0 if failed or not validated.",
          "regulatory_ref": "EU AI Act Art. 9(2)(a)"
        },
        "factor_c": {
          "label": "safety_classification",
          "description": "Safety classification: 0=reserved, 1=nominal, 2=cautionary, 3=degraded, 4=emergency, 5=abort.",
          "regulatory_ref": "ISO/PAS 8800 Cl. 8"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "Trajectory must pass safety validation when attestation is required."
      },
      "frameworks": {
        "EU-AI-ACT": "Annex III(3a), Art. 9(2)(a)",
        "ISO-PAS-8800": "Cl. 6, Cl. 7, Cl. 8",
        "NIST-AI-RMF": "MANAGE 4.1, MEASURE 2.6",
        "UNECE-WP29": "R157"
      },
      "namespace": "AI"
    },
    "AI-MOB.7": {
      "procedure_id": "AI-MOB.7",
      "parent_control": "AI-MOB",
      "title": "VLA Inference Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_VLA_INFERENCE",
      "factors": {
        "factor_a": {
          "label": "inference_occurred",
          "description": "1.0 if VLA inference call was executed.",
          "regulatory_ref": "EU AI Act Art. 12(1)",
          "default": 1.0
        },
        "factor_b": {
          "label": "latency_ms",
          "description": "VLA inference latency in milliseconds.",
          "regulatory_ref": "EU AI Act Art. 15(1)"
        },
        "factor_c": {
          "label": "succeeded",
          "description": "1 if inference completed successfully, 0 if exception or timeout.",
          "regulatory_ref": "EU AI Act Art. 9(4)(b)"
        }
      },
      "evaluation": {
        "expression": "factor_c == 1",
        "description": "VLA inference must complete successfully."
      },
      "frameworks": {
        "EU-AI-ACT": "Art. 12(1), Art. 15(1), Art. 9(4)(b)",
        "ISO-PAS-8800": "Cl. 9, Cl. 10",
        "NIST-AI-RMF": "MEASURE 2.5, MAP 3.2",
        "UNECE-WP29": "R157"
      },
      "namespace": "AI"
    },
    "AI-MDL.8": {
      "procedure_id": "AI-MDL.8",
      "parent_control": "AI-MDL",
      "title": "Model Registry Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MDL_REGISTRY",
      "factors": {
        "factor_a": {
          "label": "registry_entries_expected",
          "description": "Number of model versions expected in the approved model registry.",
          "regulatory_ref": "EU AI Act Art. 11; NIST 800-53 CM-3"
        },
        "factor_b": {
          "label": "registry_entries_verified",
          "description": "Number of model versions confirmed present and integrity-checked.",
          "regulatory_ref": "EU AI Act Art. 11; NIST AI RMF GOVERN 1.5"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All expected model versions must be present and verified in the registry."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.11",
        "NIST-800-53": "CM-3",
        "NIST-AI-RMF": "GOVERN 1.5"
      },
      "namespace": "AI"
    },
    "AI-EMRG.1": {
      "procedure_id": "AI-EMRG.1",
      "parent_control": "AI-EMRG",
      "title": "Emergency Override Lifecycle Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_EMRG_OVERRIDE_LIFECYCLE",
      "factors": {
        "factor_a": {
          "label": "override_trigger_type",
          "description": "Trigger: 0=emergency_stop, 1=operator_command, 2=escalation_protocol, 3=external_responder.",
          "regulatory_ref": "EU AI Act Art. 14; IEC 61511"
        },
        "factor_b": {
          "label": "authorization_level",
          "description": "Authority: 0=operator, 1=supervisor, 2=site_manager, 3=emergency_responder.",
          "regulatory_ref": "EU AI Act Art. 14; NIST 800-53 IR-4"
        },
        "factor_c": {
          "label": "fallback_state_activated",
          "description": "Fallback: 0=safe_state, 1=legacy_controller, 2=manual_mode, 3=degraded_operation, 4=full_shutdown.",
          "regulatory_ref": "IEC 61511; CISA AI in OT Sec. 4.1"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "Authorization level must meet or exceed the minimum required for the trigger type."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.14",
        "NIST-AI-RMF": "GOVERN 1.1",
        "NIST-800-53": "IR-4"
      },
      "namespace": "AI"
    },
    "AI-DRIFT.2": {
      "procedure_id": "AI-DRIFT.2",
      "parent_control": "AI-DRIFT",
      "title": "Consequence-Mapped Drift Threshold Response",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DRIFT_CONSEQUENCE_MAPPED",
      "factors": {
        "factor_a": {
          "label": "drift_magnitude",
          "description": "Statistical divergence value (PSI, KL, etc.) quantized to configurable precision.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b); OCC 2026-13"
        },
        "factor_b": {
          "label": "consequence_category_triggered",
          "description": "Highest consequence category: 0=safety, 1=environmental, 2=financial, 3=operational, 4=reputational.",
          "regulatory_ref": "ISA-18.2; EU AI Act Art. 9(2)(b)"
        },
        "factor_c": {
          "label": "response_action_taken",
          "description": "Graduated response: 0=notification_only, 1=increased_monitoring, 2=throttle, 3=circuit_breaker, 4=forced_failover, 5=emergency_shutdown.",
          "regulatory_ref": "OCC 2026-13 / SR 26-2"
        }
      },
      "evaluation": {
        "expression": "factor_c >= factor_b",
        "description": "Response escalation must match or exceed consequence severity."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(2)(b)",
        "NIST-AI-RMF": "MEASURE 2.6",
        "NIST-800-53": "SI-2",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-ASSESS.1": {
      "procedure_id": "AI-ASSESS.1",
      "parent_control": "AI-ASSESS",
      "title": "Champion-Challenger Assessment Witnessing",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_ASSESS_CHAMPION_CHALLENGER",
      "factors": {
        "factor_a": {
          "label": "inputs_processed",
          "description": "Number of identical inputs routed to both champion and challenger models.",
          "regulatory_ref": "EU AI Act Art. 15; OCC 2026-13"
        },
        "factor_b": {
          "label": "max_divergence_observed",
          "description": "Highest divergence metric observed across all evaluation intervals (x1000 scale).",
          "regulatory_ref": "OCC 2026-13 / SR 26-2"
        },
        "factor_c": {
          "label": "acceptance_threshold_breached",
          "description": "1 = acceptance criteria breached, 0 = within bounds.",
          "regulatory_ref": "EU AI Act Art. 15; NIST AI RMF MAP 2.3"
        }
      },
      "evaluation": {
        "expression": "factor_c == 0",
        "description": "Acceptance criteria must NOT be breached for PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.15",
        "NIST-AI-RMF": "MAP 2.3",
        "NIST-800-53": "SA-11",
        "SR-11-7": "IV.A"
      },
      "namespace": "AI"
    },
    "AI-REACH.1": {
      "procedure_id": "AI-REACH.1",
      "parent_control": "AI-REACH",
      "title": "Hazard Reachability Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_HAZARD_REACHABILITY",
      "factors": {
        "factor_a": {
          "label": "hazards_assessed",
          "description": "Total number of known model hazards/limitations assessed for operational reachability.",
          "regulatory_ref": "EU AI Act Art. 53; ISO 42001 6.1.2"
        },
        "factor_b": {
          "label": "hazards_mitigated",
          "description": "Number of hazards confirmed mitigated (blocked by guardrails, sandboxing, or vendor controls).",
          "regulatory_ref": "EU AI Act Art. 53; ISO 42001 6.1.2"
        },
        "factor_c": {
          "label": "reachability_method",
          "description": "Assessment method: 0=manual, 1=automated, 2=vendor_attested.",
          "regulatory_ref": "EU AI Act Art. 53; ISO 42001 8.4"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All assessed hazards (A) must be mitigated (B) for PASS."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.53",
        "ISO-42001": "6.1.2",
        "NIST-AI-RMF": "MAP 3.5"
      },
      "namespace": "AI"
    },
    "AI-DECOM.1": {
      "procedure_id": "AI-DECOM.1",
      "parent_control": "AI-DECOM",
      "title": "AI System Decommissioning Lifecycle Witness",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DECOMMISSION_LIFECYCLE",
      "factors": {
        "factor_a": {
          "label": "dependencies_mapped",
          "description": "Total downstream dependencies identified (systems, data consumers, API callers, shared infrastructure).",
          "regulatory_ref": "EU AI Act Art. 9; ISO 42001 8.2"
        },
        "factor_b": {
          "label": "dependencies_resolved",
          "description": "Number of dependencies resolved (migrated, replaced, acknowledged, or transferred).",
          "regulatory_ref": "EU AI Act Art. 9; ISO 42001 8.2"
        },
        "factor_c": {
          "label": "disposal_method",
          "description": "Disposal method: 0=archived, 1=destroyed, 2=isolated, 3=transferred.",
          "regulatory_ref": "EU AI Act Art. 9; ISO 42001 A.6.2.5"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All mapped dependencies (A) must be resolved (B) before decommissioning completes."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "ISO-42001": "8.2",
        "NIST-AI-RMF": "GOVERN 1.7"
      },
      "namespace": "AI"
    },
    "AI-RECOMM.1": {
      "procedure_id": "AI-RECOMM.1",
      "parent_control": "AI-RECOMM",
      "title": "AI System Re-commissioning Validation Witness",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_RECOMMISSION_VALIDATION",
      "factors": {
        "factor_a": {
          "label": "checks_required",
          "description": "Total safety checks required before re-enabling, defined by the organization's re-commissioning policy per EU AI Act Art. 72.",
          "regulatory_ref": "EU AI Act Art. 72; ISO 42001 10.2"
        },
        "factor_b": {
          "label": "checks_passed",
          "description": "Number of safety checks that passed during re-commissioning validation.",
          "regulatory_ref": "EU AI Act Art. 72; ISO 42001 10.2"
        },
        "factor_c": {
          "label": "recommission_type",
          "description": "Re-commissioning type: 0=full_validation, 1=shadow_mode, 2=limited_scope.",
          "regulatory_ref": "EU AI Act Art. 72; ISO 42001 10.2"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All required checks (A) must pass (B) for the system to be re-commissioned."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.72",
        "ISO-42001": "10.2",
        "NIST-AI-RMF": "MANAGE 4.1"
      },
      "namespace": "AI"
    },
    "AI-FREEZE.1": {
      "procedure_id": "AI-FREEZE.1",
      "parent_control": "AI-FREEZE",
      "title": "Model Parameter Freeze Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_PARAMETER_FREEZE",
      "factors": {
        "factor_a": {
          "label": "config_items_locked",
          "description": "Count of discrete configuration items (model weight files, hyperparameter entries, boundary logic rules) subject to operational freeze.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b); ISO 42001 A.6.2.4"
        },
        "factor_b": {
          "label": "config_items_verified",
          "description": "Number of configuration items confirmed unchanged via checksum, hash, or configuration management attestation.",
          "regulatory_ref": "EU AI Act Art. 9(2)(b); ISO 42001 A.6.2.4"
        },
        "factor_c": {
          "label": "lock_scope",
          "description": "Freeze scope: 0=weights_only, 1=config_and_params (hyperparams + thresholds), 2=full_stack (includes guardrails, prompts, tools).",
          "regulatory_ref": "EU AI Act Art. 9(2)(b); ISO 42001 A.6.2.4"
        }
      },
      "evaluation": {
        "expression": "factor_b >= factor_a",
        "description": "All locked config items (A) must be verified unchanged (B)."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9(2)(b)",
        "ISO-42001": "A.6.2.4",
        "NIST-800-53": "CM-3"
      },
      "namespace": "AI"
    },
    "AI-SAMPLE.1": {
      "procedure_id": "AI-SAMPLE.1",
      "parent_control": "AI-SAMPLE",
      "title": "Probabilistic Witnessing Summary",
      "category": "AI",
      "scope": "ai_infrastructure",
      "check_type": "AI_SAMPLE_SUMMARY",
      "factors": {
        "factor_a": {
          "label": "skipped_count",
          "description": "Number of inferences not individually witnessed during the sampling window.",
          "regulatory_ref": "NIST AI RMF MEASURE 2.6"
        },
        "factor_b": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "regulatory_ref": "N/A"
        },
        "factor_c": {
          "label": "reserved",
          "description": "Reserved for future use. Always 0.",
          "regulatory_ref": "N/A"
        }
      },
      "evaluation": {
        "expression": "true",
        "description": "Summary anchors always PASS. They record the count of non-witnessed inferences for audit completeness."
      },
      "frameworks": {
        "NIST-AI-RMF": "MEASURE 2.6",
        "EU-AI-ACT": "Art.12"
      },
      "namespace": "AI"
    },
    "AI-DENSITY.1": {
      "procedure_id": "AI-DENSITY.1",
      "parent_control": "AI-DENSITY",
      "title": "Witnessing Density Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DENSITY_ATTESTATION",
      "factors": {
        "factor_a": {
          "label": "expected_anchors",
          "description": "Expected number of witness anchors for the evaluation period based on density policy.",
          "regulatory_ref": "EU AI Act Art. 9 (continuous risk management)"
        },
        "factor_b": {
          "label": "actual_anchors",
          "description": "Actual number of witness anchors observed during the evaluation period.",
          "regulatory_ref": "NIST AI RMF MEASURE"
        },
        "factor_c": {
          "label": "density_status",
          "description": "Density evaluation result: 0=sufficient, 1=insufficient, 2=degraded.",
          "regulatory_ref": "EU AI Act Art. 9; NIST AI RMF MEASURE 2.6"
        }
      },
      "evaluation": {
        "expression": "factor_c == 0",
        "description": "PASS when witnessing density is sufficient for the regulatory requirement. FAIL when insufficient or degraded."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.9",
        "NIST-AI-RMF": "MEASURE 2.6",
        "ISO-42001": "A.6.2.6"
      },
      "namespace": "AI"
    },
    "AI-DEL.2": {
      "procedure_id": "AI-DEL.2",
      "parent_control": "AI-DEL",
      "title": "Delegation Boundary Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_DEL_BOUNDARY",
      "factors": {
        "factor_a": {
          "label": "max_depth",
          "description": "Maximum permitted delegation depth from root human authorization.",
          "regulatory_ref": "NIST AI Agent Standards Initiative; Singapore IMDA Agentic Framework"
        },
        "factor_b": {
          "label": "actual_depth",
          "description": "Observed delegation depth at evaluation time.",
          "regulatory_ref": "EU AI Act Art. 14 (human oversight)"
        },
        "factor_c": {
          "label": "boundary_action",
          "description": "Action taken at boundary: 0=blocked, 1=warned, 2=escalated, 3=allowed.",
          "regulatory_ref": "NIST AI Agent Standards Initiative"
        }
      },
      "evaluation": {
        "expression": "factor_c != 3 || factor_b <= factor_a",
        "description": "PASS if depth within bounds (allowed) or boundary was enforced (blocked/warned/escalated when exceeded). FAIL only when depth exceeds max AND action is allowed."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.14",
        "NIST-AI-RMF": "GOVERN 1.4",
        "SINGAPORE-IMDA": "Agentic Framework",
        "ISO-42001": "A.4.3"
      },
      "namespace": "AI"
    },
    "AI-MCP.1": {
      "procedure_id": "AI-MCP.1",
      "parent_control": "AI-MCP",
      "title": "MCP Security Posture Attestation",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_MCP_SECURITY",
      "factors": {
        "factor_a": {
          "label": "total_checks",
          "description": "Total number of observable security checks evaluated.",
          "regulatory_ref": "NSA/CSA MCP Security Best Practices"
        },
        "factor_b": {
          "label": "checks_passed",
          "description": "Number of security checks that passed. Never reveals which checks failed.",
          "regulatory_ref": "NIST AI Agent Standards Initiative"
        },
        "factor_c": {
          "label": "posture_score",
          "description": "Security posture score 0-100 derived from checks_passed/total_checks.",
          "regulatory_ref": "NSA/CSA MCP Security Best Practices; OWASP Agentic Top 10"
        }
      },
      "evaluation": {
        "expression": "factor_c >= 75",
        "description": "PASS when posture score is 75 or higher. FAIL when score is below 75. Only attests observable checks -- stdio transport cannot verify TLS."
      },
      "frameworks": {
        "NSA-CSA-MCP": "MCP Security Best Practices",
        "NIST-AI-RMF": "GOVERN 1.7",
        "OWASP-AGENTIC": "A01-A10",
        "EU-AI-ACT": "Art.15",
        "ISO-42001": "A.8.1"
      },
      "namespace": "AI"
    },
    "AI-PROV.1": {
      "procedure_id": "AI-PROV.1",
      "parent_control": "AI-PROV",
      "title": "Model Provenance Chain",
      "category": "AI",
      "scope": "ai_governance",
      "check_type": "AI_PROV_CHAIN",
      "factors": {
        "factor_a": {
          "label": "chain_length",
          "description": "Number of provenance links in the model lineage (training, fine-tuning, distillation, deployment).",
          "regulatory_ref": "NIST AI RMF MAP 1.1; G7 Hiroshima AI Code of Conduct"
        },
        "factor_b": {
          "label": "integrity_verified",
          "description": "Whether provenance chain integrity was verified: 1=verified, 0=unverified.",
          "regulatory_ref": "EU AI Act Art. 11 (technical documentation)"
        },
        "factor_c": {
          "label": "link_type",
          "description": "Type of provenance link: 0=training, 1=fine_tuning, 2=deployment, 3=distillation.",
          "regulatory_ref": "NIST AI RMF MAP 1.1"
        }
      },
      "evaluation": {
        "expression": "factor_b == 1",
        "description": "PASS when provenance chain integrity is verified. FAIL when unverified."
      },
      "frameworks": {
        "EU-AI-ACT": "Art.11",
        "NIST-AI-RMF": "MAP 1.1",
        "G7-HIROSHIMA": "AI Code of Conduct",
        "ISO-42001": "A.7.3"
      },
      "namespace": "AI"
    },
    "NHI-SCOPE.1": {
      "procedure_id": "NHI-SCOPE.1",
      "parent_control": "NHI-SCOPE",
      "title": "Credential Scope Attestation",
      "category": "NHI",
      "scope": "nhi_governance",
      "check_type": "NHI_CREDENTIAL_SCOPE",
      "factors": {
        "factor_a": {
          "label": "credential_id_hash",
          "description": "SHA-256[:16] hash of the reported credential identifier. SWT3 witnesses the caller's report; it is not the credential authority.",
          "regulatory_ref": "NIST 800-53 IA-4; EU AI Act Art. 9(4)(c)"
        },
        "factor_b": {
          "label": "scope_hash",
          "description": "SHA-256[:16] hash of the canonical scope string (sorted, lowercased, deterministic serialization).",
          "regulatory_ref": "NIST 800-53 AC-6(1); NIST AI RMF MANAGE 2.4"
        },
        "factor_c": {
          "label": "ttl_seconds",
          "description": "Reported time-to-live of the credential in seconds. 0 = non-expiring.",
          "regulatory_ref": "NIST 800-53 IA-5(13)"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b != ''",
        "description": "PASS when both credential identifier and scope are reported and hashed."
      },
      "frameworks": {
        "NIST-800-53": "IA-4",
        "EU-AI-ACT": "Art.9(4)(c)",
        "NIST-AI-RMF": "MANAGE 2.4",
        "FIVE-EYES-AGENTIC": "FE-3",
        "OWASP-AGENTIC": "MCP-07",
        "NIS-2": "Art.21(2)(i)"
      },
      "namespace": "NHI"
    },
    "NHI-CYCLE.1": {
      "procedure_id": "NHI-CYCLE.1",
      "parent_control": "NHI-CYCLE",
      "title": "Credential Lifecycle Event Witnessing",
      "category": "NHI",
      "scope": "nhi_governance",
      "check_type": "NHI_CREDENTIAL_LIFECYCLE",
      "factors": {
        "factor_a": {
          "label": "event_type",
          "description": "Reported lifecycle event: 1=issued, 2=activated, 3=suspended, 4=expired, 5=revoked.",
          "regulatory_ref": "NIST 800-53 IA-5; EU AI Act Art. 12(1)"
        },
        "factor_b": {
          "label": "credential_id_hash",
          "description": "SHA-256[:16] hash of the reported credential identifier.",
          "regulatory_ref": "NIST 800-53 IA-4"
        },
        "factor_c": {
          "label": "issuer_hash",
          "description": "SHA-256[:16] hash of the identity provider name (e.g., Entra ID, Okta, CyberArk).",
          "regulatory_ref": "NIST 800-53 IA-8"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 5 and factor_b != ''",
        "description": "PASS when event type is valid (1-5) and credential identifier is reported."
      },
      "frameworks": {
        "NIST-800-53": "IA-5",
        "EU-AI-ACT": "Art.12(1)",
        "NIST-AI-RMF": "GOVERN 1.7",
        "FIVE-EYES-AGENTIC": "FE-3",
        "OWASP-AGENTIC": "MCP-01",
        "NIS-2": "Art.21(2)(i)"
      },
      "namespace": "NHI"
    },
    "NHI-PRIV.1": {
      "procedure_id": "NHI-PRIV.1",
      "parent_control": "NHI-PRIV",
      "title": "Privilege Change Witnessing",
      "category": "NHI",
      "scope": "nhi_governance",
      "check_type": "NHI_PRIVILEGE_CHANGE",
      "factors": {
        "factor_a": {
          "label": "credential_id_hash",
          "description": "SHA-256[:16] hash of the reported credential identifier whose privileges changed.",
          "regulatory_ref": "NIST 800-53 AC-6; EU AI Act Art. 9(4)(c)"
        },
        "factor_b": {
          "label": "previous_scope_hash",
          "description": "SHA-256[:16] hash of the previous canonical scope string. 0 if newly created.",
          "regulatory_ref": "NIST 800-53 AC-6(5)"
        },
        "factor_c": {
          "label": "new_scope_hash",
          "description": "SHA-256[:16] hash of the new canonical scope string after privilege change.",
          "regulatory_ref": "NIST 800-53 AC-6(5)"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_c != ''",
        "description": "PASS when credential and new scope are reported. Auditors compare factor_b to factor_c to detect escalation."
      },
      "frameworks": {
        "NIST-800-53": "AC-6",
        "EU-AI-ACT": "Art.9(4)(c)",
        "NIST-AI-RMF": "MANAGE 2.4",
        "FIVE-EYES-AGENTIC": "FE-4",
        "OWASP-AGENTIC": "MCP-07",
        "NIS-2": "Art.21(2)(d)"
      },
      "namespace": "NHI"
    },
    "NHI-ROTATE.1": {
      "procedure_id": "NHI-ROTATE.1",
      "parent_control": "NHI-ROTATE",
      "title": "Credential Rotation Attestation",
      "category": "NHI",
      "scope": "nhi_governance",
      "check_type": "NHI_CREDENTIAL_ROTATION",
      "factors": {
        "factor_a": {
          "label": "old_credential_hash",
          "description": "SHA-256[:16] hash of the outgoing credential identifier.",
          "regulatory_ref": "NIST 800-53 IA-5(1)"
        },
        "factor_b": {
          "label": "new_credential_hash",
          "description": "SHA-256[:16] hash of the incoming credential identifier.",
          "regulatory_ref": "NIST 800-53 IA-5(1)"
        },
        "factor_c": {
          "label": "rotation_reason",
          "description": "Reason for rotation: 1=scheduled, 2=compromise, 3=policy, 4=manual.",
          "regulatory_ref": "NIST 800-53 IA-5(1); NIST AI RMF MANAGE 4.2"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b != '' and factor_a != factor_b",
        "description": "PASS when old and new credentials are distinct and both reported."
      },
      "frameworks": {
        "NIST-800-53": "IA-5(1)",
        "EU-AI-ACT": "Art.9(9)",
        "NIST-AI-RMF": "MANAGE 4.2",
        "FIVE-EYES-AGENTIC": "FE-3",
        "OWASP-AGENTIC": "MCP-01",
        "NIS-2": "Art.21(2)(i)"
      },
      "namespace": "NHI"
    },
    "NHI-AGENT.1": {
      "procedure_id": "NHI-AGENT.1",
      "parent_control": "NHI-AGENT",
      "title": "Agent-to-Agent Credential Delegation",
      "category": "NHI",
      "scope": "nhi_governance",
      "check_type": "NHI_AGENT_DELEGATION",
      "factors": {
        "factor_a": {
          "label": "delegator_credential_hash",
          "description": "SHA-256[:16] hash of the delegating agent's credential identifier.",
          "regulatory_ref": "NIST 800-53 AC-2(7); EU AI Act Art. 14(4)"
        },
        "factor_b": {
          "label": "delegatee_credential_hash",
          "description": "SHA-256[:16] hash of the receiving agent's credential identifier.",
          "regulatory_ref": "NIST 800-53 AC-2(7)"
        },
        "factor_c": {
          "label": "delegation_depth",
          "description": "Depth in the delegation chain: 1=direct delegation, 2+=chained delegation.",
          "regulatory_ref": "NIST 800-53 AC-6(2)"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b != '' and factor_c >= 1",
        "description": "PASS when both delegator and delegatee are identified and delegation depth is valid."
      },
      "frameworks": {
        "NIST-800-53": "AC-2(7)",
        "EU-AI-ACT": "Art.14(4)",
        "NIST-AI-RMF": "MANAGE 2.4",
        "FIVE-EYES-AGENTIC": "FE-4",
        "OWASP-AGENTIC": "MCP-07,MCP-09",
        "NIS-2": "Art.21(2)(d)"
      },
      "namespace": "NHI"
    },
    "NHI-REVOKE.1": {
      "procedure_id": "NHI-REVOKE.1",
      "parent_control": "NHI-REVOKE",
      "title": "Credential Revocation Attestation",
      "category": "NHI",
      "scope": "nhi_governance",
      "check_type": "NHI_CREDENTIAL_REVOCATION",
      "factors": {
        "factor_a": {
          "label": "revoked_credential_hash",
          "description": "SHA-256[:16] hash of the revoked credential identifier.",
          "regulatory_ref": "NIST 800-53 IA-5(2)"
        },
        "factor_b": {
          "label": "reason_code",
          "description": "Reason for revocation: 0=unspecified, 1=model_recall, 2=policy_violation, 3=data_contamination, 4=consent_withdrawal, 5=regulatory_order, 6=error_correction.",
          "regulatory_ref": "NIST 800-53 IA-5(2); EU AI Act Art. 16(i)"
        },
        "factor_c": {
          "label": "cascade_flag",
          "description": "Whether revocation cascades to delegated credentials: 1=cascade, 0=single credential only.",
          "regulatory_ref": "NIST 800-53 AC-2(7)"
        }
      },
      "evaluation": {
        "expression": "factor_a != ''",
        "description": "PASS when revoked credential is identified. Revocation itself is valid evidence (verdict always PASS)."
      },
      "frameworks": {
        "NIST-800-53": "IA-5(2)",
        "EU-AI-ACT": "Art.16(i)",
        "NIST-AI-RMF": "MANAGE 4.2",
        "FIVE-EYES-AGENTIC": "FE-3",
        "OWASP-AGENTIC": "MCP-01",
        "NIS-2": "Art.21(2)(i)"
      },
      "namespace": "NHI"
    },
    "HBOM-INV.1": {
      "procedure_id": "HBOM-INV.1",
      "parent_control": "HBOM-INV",
      "title": "Hardware Inventory Attestation",
      "category": "HBOM",
      "scope": "hardware_governance",
      "check_type": "HBOM_HARDWARE_INVENTORY",
      "factors": {
        "factor_a": {
          "label": "component_count",
          "description": "Number of hardware components in the reported inventory manifest.",
          "regulatory_ref": "EU CRA Art. 10(9); NIST 800-53 CM-8"
        },
        "factor_b": {
          "label": "manifest_hash",
          "description": "SHA-256[:16] hash of the serialized hardware inventory manifest.",
          "regulatory_ref": "EU CRA Art. 10(9)"
        },
        "factor_c": {
          "label": "delta_from_baseline",
          "description": "Number of components added or removed since last attestation. 0 = no change.",
          "regulatory_ref": "NIST 800-53 CM-8(3)"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_b != ''",
        "description": "PASS when at least one component is inventoried and manifest hash is reported."
      },
      "frameworks": {
        "EU-CRA": "Art.10(9)",
        "NIST-800-53": "CM-8",
        "NIST-AI-RMF": "GOVERN 1.6",
        "ISO-42001": "A.7.4"
      },
      "namespace": "HBOM"
    },
    "HBOM-LIFE.1": {
      "procedure_id": "HBOM-LIFE.1",
      "parent_control": "HBOM-LIFE",
      "title": "Component Lifecycle Witnessing",
      "category": "HBOM",
      "scope": "hardware_governance",
      "check_type": "HBOM_COMPONENT_LIFECYCLE",
      "factors": {
        "factor_a": {
          "label": "event_type",
          "description": "Lifecycle event: 1=installed, 2=commissioned, 3=maintained, 4=degraded, 5=decommissioned, 6=recycled.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 77; NIST 800-53 SA-22"
        },
        "factor_b": {
          "label": "component_hash",
          "description": "SHA-256[:16] hash of the component serial number or identifier.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 77"
        },
        "factor_c": {
          "label": "age_days",
          "description": "Component age in days since installation. 0 if newly installed.",
          "regulatory_ref": "NIST 800-53 SA-22"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 6 and factor_b != ''",
        "description": "PASS when event type is valid and component is identified."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.77",
        "EU-CRA": "Art.10(12)",
        "NIST-800-53": "SA-22",
        "ISO-42001": "A.7.4"
      },
      "namespace": "HBOM"
    },
    "HBOM-THERM.1": {
      "procedure_id": "HBOM-THERM.1",
      "parent_control": "HBOM-THERM",
      "title": "Thermal Profile Attestation",
      "category": "HBOM",
      "scope": "hardware_governance",
      "check_type": "HBOM_THERMAL_PROFILE",
      "factors": {
        "factor_a": {
          "label": "ambient_temp_c",
          "description": "Reported ambient temperature in Celsius at the measurement point.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14; ASHRAE TC 9.9"
        },
        "factor_b": {
          "label": "component_temp_c",
          "description": "Reported component or exhaust temperature in Celsius.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14"
        },
        "factor_c": {
          "label": "threshold_exceeded",
          "description": "1 = thermal threshold exceeded (alarm condition), 0 = within bounds.",
          "regulatory_ref": "ASHRAE TC 9.9; NIST 800-53 PE-14"
        }
      },
      "evaluation": {
        "expression": "factor_c == 0",
        "description": "PASS when thermal readings are within acceptable thresholds."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.14",
        "NIST-800-53": "PE-14",
        "ISO-42001": "A.7.4",
        "CSRD": "ESRS-E1"
      },
      "namespace": "HBOM"
    },
    "HBOM-WATER.1": {
      "procedure_id": "HBOM-WATER.1",
      "parent_control": "HBOM-WATER",
      "title": "Water Consumption Witnessing",
      "category": "HBOM",
      "scope": "hardware_governance",
      "check_type": "HBOM_WATER_CONSUMPTION",
      "factors": {
        "factor_a": {
          "label": "liters_consumed",
          "description": "Reported water consumption in liters for the measurement interval.",
          "regulatory_ref": "CSRD ESRS-E3; EU Energy Efficiency Directive 2023/1791"
        },
        "factor_b": {
          "label": "wue_ratio",
          "description": "Water Usage Effectiveness ratio (liters per kWh of IT load). Multiplied by 1000 for integer transmission.",
          "regulatory_ref": "EU Energy Efficiency Directive 2023/1791"
        },
        "factor_c": {
          "label": "source_type",
          "description": "Water source: 1=municipal, 2=recycled, 3=rainwater, 4=groundwell, 5=mixed.",
          "regulatory_ref": "CSRD ESRS-E3"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 0 and factor_b > 0",
        "description": "PASS when consumption and WUE ratio are reported with valid values."
      },
      "frameworks": {
        "CSRD": "ESRS-E3",
        "EU-EED": "Art.12",
        "ISO-42001": "A.7.4",
        "NIST-800-53": "SA-15"
      },
      "namespace": "HBOM"
    },
    "HBOM-PUE.1": {
      "procedure_id": "HBOM-PUE.1",
      "parent_control": "HBOM-PUE",
      "title": "Power Usage Effectiveness Attestation",
      "category": "HBOM",
      "scope": "hardware_governance",
      "check_type": "HBOM_POWER_USAGE_EFFECTIVENESS",
      "factors": {
        "factor_a": {
          "label": "total_facility_kw",
          "description": "Reported total facility power draw in kilowatts.",
          "regulatory_ref": "EU Energy Efficiency Directive 2023/1791 Art. 12"
        },
        "factor_b": {
          "label": "it_load_kw",
          "description": "Reported IT equipment power draw in kilowatts.",
          "regulatory_ref": "EU Energy Efficiency Directive 2023/1791 Art. 12"
        },
        "factor_c": {
          "label": "pue_x1000",
          "description": "PUE ratio multiplied by 1000 (e.g., 1200 = PUE 1.2). Integer transmission for factor math.",
          "regulatory_ref": "EU EED Art. 12; ISO 30134-2"
        }
      },
      "evaluation": {
        "expression": "factor_b > 0 and factor_c >= 1000",
        "description": "PASS when IT load is reported and PUE is >= 1.0 (physically valid)."
      },
      "frameworks": {
        "EU-EED": "Art.12",
        "CSRD": "ESRS-E1",
        "ISO-30134": "Part 2",
        "NIST-800-53": "SA-15"
      },
      "namespace": "HBOM"
    },
    "HBOM-SUPPLY.1": {
      "procedure_id": "HBOM-SUPPLY.1",
      "parent_control": "HBOM-SUPPLY",
      "title": "Hardware Supply Chain Provenance",
      "category": "HBOM",
      "scope": "hardware_governance",
      "check_type": "HBOM_SUPPLY_CHAIN_PROVENANCE",
      "factors": {
        "factor_a": {
          "label": "supplier_hash",
          "description": "SHA-256[:16] hash of the supplier or manufacturer identifier.",
          "regulatory_ref": "EU CRA Art. 10(9); NIST 800-53 SA-12"
        },
        "factor_b": {
          "label": "provenance_verified",
          "description": "1 = supply chain documentation verified, 0 = unverified.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 39"
        },
        "factor_c": {
          "label": "country_of_origin_hash",
          "description": "SHA-256[:16] hash of the ISO 3166-1 country code of component origin.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 39; EU Conflict Minerals Reg 2017/821"
        }
      },
      "evaluation": {
        "expression": "factor_a != '' and factor_b == 1",
        "description": "PASS when supplier is identified and provenance documentation is verified."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.39",
        "EU-CRA": "Art.10(9)",
        "EU-CONFLICT-MINERALS": "2017/821",
        "NIST-800-53": "SA-12"
      },
      "namespace": "HBOM"
    },
    "DPP-SOH.1": {
      "procedure_id": "DPP-SOH.1",
      "parent_control": "DPP-SOH",
      "title": "Battery State of Health Attestation",
      "category": "DPP",
      "scope": "digital_product_passport",
      "check_type": "DPP_STATE_OF_HEALTH",
      "factors": {
        "factor_a": {
          "label": "soh_percent_x100",
          "description": "Reported State of Health as percentage multiplied by 100 (e.g., 9230 = 92.30%). Integer transmission.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        },
        "factor_b": {
          "label": "cycle_count",
          "description": "Reported number of charge/discharge cycles completed.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        },
        "factor_c": {
          "label": "capacity_kwh_x100",
          "description": "Reported remaining capacity in kWh multiplied by 100. Integer transmission.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_b >= 0",
        "description": "PASS when SoH is reported with valid positive value and cycle count is non-negative."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.14(1)",
        "CSRD": "ESRS-E1",
        "EU-EED": "Art.12"
      },
      "namespace": "DPP"
    },
    "DPP-CHRG.1": {
      "procedure_id": "DPP-CHRG.1",
      "parent_control": "DPP-CHRG",
      "title": "Charge/Discharge Cycle Witnessing",
      "category": "DPP",
      "scope": "digital_product_passport",
      "check_type": "DPP_CHARGE_DISCHARGE_CYCLE",
      "factors": {
        "factor_a": {
          "label": "event_type",
          "description": "Cycle event: 1=charge_start, 2=charge_complete, 3=discharge_start, 4=discharge_complete.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        },
        "factor_b": {
          "label": "energy_kwh_x100",
          "description": "Energy transferred in kWh multiplied by 100. Integer transmission.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        },
        "factor_c": {
          "label": "peak_temp_c",
          "description": "Peak battery temperature in Celsius during the cycle event.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1); IEC 62619"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 4 and factor_b >= 0",
        "description": "PASS when event type is valid and energy value is non-negative."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.14(1)",
        "IEC-62619": "Sec.7",
        "CSRD": "ESRS-E1"
      },
      "namespace": "DPP"
    },
    "DPP-DEGRAD.1": {
      "procedure_id": "DPP-DEGRAD.1",
      "parent_control": "DPP-DEGRAD",
      "title": "Battery Degradation Event Witnessing",
      "category": "DPP",
      "scope": "digital_product_passport",
      "check_type": "DPP_DEGRADATION_EVENT",
      "factors": {
        "factor_a": {
          "label": "degradation_type",
          "description": "Degradation cause: 1=calendar_aging, 2=thermal_stress, 3=overcharge, 4=deep_discharge, 5=mechanical, 6=unknown.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        },
        "factor_b": {
          "label": "soh_delta_x100",
          "description": "Reported SoH drop (percentage points x100) attributed to this event.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        },
        "factor_c": {
          "label": "ambient_temp_c",
          "description": "Ambient temperature in Celsius at time of degradation event.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 6",
        "description": "PASS when degradation type is reported with a valid code."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.14(1)",
        "IEC-62619": "Sec.7",
        "CSRD": "ESRS-E1"
      },
      "namespace": "DPP"
    },
    "DPP-EOL.1": {
      "procedure_id": "DPP-EOL.1",
      "parent_control": "DPP-EOL",
      "title": "End-of-Life / Recycling Handoff Witnessing",
      "category": "DPP",
      "scope": "digital_product_passport",
      "check_type": "DPP_END_OF_LIFE",
      "factors": {
        "factor_a": {
          "label": "disposition_type",
          "description": "Disposition: 1=recycling, 2=repurpose, 3=refurbishment, 4=landfill, 5=hazmat_disposal.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 59; EU WEEE Directive 2012/19"
        },
        "factor_b": {
          "label": "handler_hash",
          "description": "SHA-256[:16] hash of the receiving recycler/handler organization identifier.",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 59"
        },
        "factor_c": {
          "label": "final_soh_x100",
          "description": "Final SoH at time of handoff (percentage x100).",
          "regulatory_ref": "EU Battery Reg 2023/1542 Art. 14(1)"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 5 and factor_b != ''",
        "description": "PASS when disposition type is valid and receiving handler is identified."
      },
      "frameworks": {
        "EU-BATTERY-REG": "Art.59",
        "EU-WEEE": "2012/19",
        "CSRD": "ESRS-E5",
        "ISO-42001": "A.7.4"
      },
      "namespace": "DPP"
    },
    "ADR-EVENT.1": {
      "procedure_id": "ADR-EVENT.1",
      "parent_control": "ADR-EVENT",
      "title": "Demand Response Event Witnessing",
      "category": "ADR",
      "scope": "energy_governance",
      "check_type": "ADR_DEMAND_RESPONSE_EVENT",
      "factors": {
        "factor_a": {
          "label": "event_type",
          "description": "DR event phase: 1=signal_received, 2=curtailment_start, 3=curtailment_end, 4=restoration.",
          "regulatory_ref": "FERC Order 2222; EU Clean Energy Package Art. 17"
        },
        "factor_b": {
          "label": "committed_kw",
          "description": "Committed curtailment magnitude in kilowatts.",
          "regulatory_ref": "FERC Order 2222"
        },
        "factor_c": {
          "label": "signal_source_hash",
          "description": "SHA-256[:16] hash of the grid operator / ISO signal identifier.",
          "regulatory_ref": "FERC Order 2222; EU Clean Energy Package"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 4 and factor_b > 0",
        "description": "PASS when event phase is valid and committed curtailment is positive."
      },
      "frameworks": {
        "FERC-2222": "Order 2222",
        "EU-CEP": "Art.17",
        "EU-EED": "Art.12",
        "NIST-800-53": "SA-15"
      },
      "namespace": "ADR"
    },
    "ADR-BASE.1": {
      "procedure_id": "ADR-BASE.1",
      "parent_control": "ADR-BASE",
      "title": "Baseline Consumption Attestation",
      "category": "ADR",
      "scope": "energy_governance",
      "check_type": "ADR_BASELINE_CONSUMPTION",
      "factors": {
        "factor_a": {
          "label": "baseline_kw",
          "description": "Reported baseline power consumption in kilowatts (pre-event reference).",
          "regulatory_ref": "FERC Order 2222; PJM Manual 11"
        },
        "factor_b": {
          "label": "measurement_method",
          "description": "Baseline method: 1=metered_10day_avg, 2=regression, 3=real_time_meter, 4=deemed_savings.",
          "regulatory_ref": "FERC Order 2222"
        },
        "factor_c": {
          "label": "confidence_x1000",
          "description": "Confidence level of baseline estimate multiplied by 1000 (e.g., 950 = 95.0%).",
          "regulatory_ref": "PJM Manual 11"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_b >= 1 and factor_b <= 4",
        "description": "PASS when baseline power and valid measurement method are reported."
      },
      "frameworks": {
        "FERC-2222": "Order 2222",
        "EU-CEP": "Art.17",
        "EU-EED": "Art.12"
      },
      "namespace": "ADR"
    },
    "ADR-CURT.1": {
      "procedure_id": "ADR-CURT.1",
      "parent_control": "ADR-CURT",
      "title": "Curtailment Verification",
      "category": "ADR",
      "scope": "energy_governance",
      "check_type": "ADR_CURTAILMENT_VERIFICATION",
      "factors": {
        "factor_a": {
          "label": "actual_reduction_kw",
          "description": "Reported actual power reduction in kilowatts during the curtailment period.",
          "regulatory_ref": "FERC Order 2222; EU CEP Art. 17"
        },
        "factor_b": {
          "label": "committed_kw",
          "description": "Originally committed curtailment in kilowatts (from ADR-EVENT.1).",
          "regulatory_ref": "FERC Order 2222"
        },
        "factor_c": {
          "label": "compliance_ratio_x1000",
          "description": "Actual/committed ratio x1000 (e.g., 1050 = 105% of commitment met).",
          "regulatory_ref": "PJM Manual 11; FERC Order 2222"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_c >= 900",
        "description": "PASS when actual reduction is reported and compliance ratio is >= 90% of commitment."
      },
      "frameworks": {
        "FERC-2222": "Order 2222",
        "EU-CEP": "Art.17",
        "EU-EED": "Art.12"
      },
      "namespace": "ADR"
    },
    "ADR-SETTLE.1": {
      "procedure_id": "ADR-SETTLE.1",
      "parent_control": "ADR-SETTLE",
      "title": "Settlement Data Attestation",
      "category": "ADR",
      "scope": "energy_governance",
      "check_type": "ADR_SETTLEMENT_DATA",
      "factors": {
        "factor_a": {
          "label": "settlement_kwh_x100",
          "description": "Reported settlement quantity in kWh multiplied by 100. Integer transmission.",
          "regulatory_ref": "FERC Order 2222; PJM Manual 28"
        },
        "factor_b": {
          "label": "price_usd_x100",
          "description": "Settlement price in USD per MWh multiplied by 100. Integer transmission.",
          "regulatory_ref": "FERC Order 2222"
        },
        "factor_c": {
          "label": "event_count",
          "description": "Number of DR events included in this settlement period.",
          "regulatory_ref": "PJM Manual 28"
        }
      },
      "evaluation": {
        "expression": "factor_a > 0 and factor_c >= 1",
        "description": "PASS when settlement quantity is positive and at least one event is included."
      },
      "frameworks": {
        "FERC-2222": "Order 2222",
        "EU-CEP": "Art.17"
      },
      "namespace": "ADR"
    },
    "ADR-CARBON.1": {
      "procedure_id": "ADR-CARBON.1",
      "parent_control": "ADR-CARBON",
      "title": "Carbon Credit / REC Attestation",
      "category": "ADR",
      "scope": "energy_governance",
      "check_type": "ADR_CARBON_CREDIT",
      "factors": {
        "factor_a": {
          "label": "credit_type",
          "description": "Credit type: 1=REC, 2=carbon_offset, 3=EAC (energy attribute certificate), 4=GO (guarantee_of_origin).",
          "regulatory_ref": "EU CBAM 2023/956; EU RED III 2023/2413"
        },
        "factor_b": {
          "label": "quantity_mwh_x100",
          "description": "Credit quantity in MWh multiplied by 100 (for RECs/EACs) or tonnes CO2e x100 (for offsets). Integer transmission.",
          "regulatory_ref": "EU CBAM 2023/956"
        },
        "factor_c": {
          "label": "registry_hash",
          "description": "SHA-256[:16] hash of the credit registry identifier (e.g., M-RETS, PJM-GATS, AIB).",
          "regulatory_ref": "EU RED III 2023/2413"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 4 and factor_b > 0 and factor_c != ''",
        "description": "PASS when credit type is valid, quantity is positive, and registry is identified."
      },
      "frameworks": {
        "EU-CBAM": "2023/956",
        "EU-RED-III": "2023/2413",
        "CSRD": "ESRS-E1",
        "SEC-CLIMATE": "S-K Item 1504"
      },
      "namespace": "ADR"
    },
    "ADR-GRID.1": {
      "procedure_id": "ADR-GRID.1",
      "parent_control": "ADR-GRID",
      "title": "Grid Signal Correlation Attestation",
      "category": "ADR",
      "scope": "energy_governance",
      "check_type": "ADR_GRID_SIGNAL_CORRELATION",
      "factors": {
        "factor_a": {
          "label": "signal_type",
          "description": "Grid signal type: 1=emergency, 2=economic, 3=capacity, 4=frequency_regulation, 5=voltage_support.",
          "regulatory_ref": "FERC Order 2222; EU Clean Energy Package"
        },
        "factor_b": {
          "label": "response_latency_ms",
          "description": "Latency in milliseconds between grid signal receipt and curtailment action.",
          "regulatory_ref": "FERC Order 2222; NERC BAL-001"
        },
        "factor_c": {
          "label": "grid_operator_hash",
          "description": "SHA-256[:16] hash of the ISO/TSO/grid operator identifier.",
          "regulatory_ref": "FERC Order 2222; EU CEP Art. 17"
        }
      },
      "evaluation": {
        "expression": "factor_a >= 1 and factor_a <= 5 and factor_c != ''",
        "description": "PASS when signal type is valid and grid operator is identified."
      },
      "frameworks": {
        "FERC-2222": "Order 2222",
        "EU-CEP": "Art.17",
        "NERC": "BAL-001"
      },
      "namespace": "ADR"
    }
  },
  "namespaces": {
    "AI": "Artificial Intelligence governance, model integrity, inference witnessing (118 procedures)",
    "INF": "Infrastructure controls, OS hardening, network, database, web, container, endpoint",
    "FIN": "Financial services model risk management, SR 11-7 / OCC 2011-12 compliance",
    "CON": "Construction site accountability, structural verification, OSHA 1926 compliance",
    "HCF": "Healthcare AI accountability, diagnostic traceability, HIPAA / 21 CFR Part 11 compliance",
    "NHI": "Non-Human Identity governance, credential lifecycle witnessing, agent delegation auditing (6 procedures)",
    "HBOM": "Hardware Bill of Materials, component lifecycle, thermal/water/power attestation (6 procedures)",
    "DPP": "Digital Product Passport, battery state of health, charge cycle, degradation, end-of-life witnessing (4 procedures)",
    "ADR": "Automated Demand Response, curtailment verification, carbon credit attestation, grid signal correlation (6 procedures)"
  }
}