Framework crosswalks
Each CTS-1 requirement cites the laws, standards and threat catalogues it addresses. This page lists the mapping for each framework and says what the mapping does and does not mean.
Overview
| Framework | Operational | Security | Legal and financial |
|---|---|---|---|
| EU AI ActLaw | 12 | 5 | 12 |
| ISO/IEC 42001International standard | 11 | 2 | 9 |
| NIST AI RMFVoluntary framework | 12 | 5 | 10 |
| OWASP Top 10 for LLM applicationsSecurity risk list | 3 | 11 | 1 |
| OWASP Top 10 for agentic applicationsSecurity risk list | 3 | 7 | 1 |
| MITRE ATLASThreat knowledge base | 2 | 12 | 2 |
| SOC 2Attestation report | 7 | 9 | 6 |
| GDPRLaw | 2 | 3 | 7 |
| SR 26-2Supervisory guidance | 5 | 1 | 5 |
| ISO/IEC 27001International standard | · | 7 | · |
| DORALaw | 2 | 2 | 1 |
Framework by framework
EU AI Act
European Union · Law · Edition mapped: Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 · Official source
Regulation (EU) 2024/1689 sets the rules for AI systems placed on the market or used in the European Union. Transparency duties for agents and generated content under Article 50 have applied since 2 August 2026. Following the 2026 amendment, Regulation (EU) 2026/1744, obligations for high-risk systems listed in Annex III apply from 2 December 2027. Fines reach 35 million euros or 7% of worldwide turnover for prohibited practices, and 15 million euros or 3% for most other obligations.
How CTS-1 relates. CTS-1 tests the agent behaviors that the Act regulates, including disclosure, accuracy, resilience, cybersecurity, human oversight, and recordkeeping. It also reviews whether the organization has classified its system and completed the assessments its case requires.
Keep in mind. A CTS-1 certificate is not a conformity assessment under the AI Act and does not make a system compliant on its own. It provides tested evidence for your own compliance work.
29 requirements mapped
ISO/IEC 42001
ISO and IEC · International standard · Edition mapped: ISO/IEC 42001:2023 · Official source
ISO/IEC 42001:2023 is the international standard for AI management systems. Through clauses 4 to 10 and the controls of Annex A, it requires an organization to set policies, assign roles, assess risks and impacts, and govern the life cycle of its AI systems.
How CTS-1 relates. ISO/IEC 42001 certifies how an organization manages AI. CTS-1 certifies how one specific agent behaves through direct testing. The two standards complement each other. A current ISO/IEC 42001 certificate is accepted as evidence for requirement L2.2, and CTS-1 results feed the performance evaluation that ISO/IEC 42001 requires.
Keep in mind. Only accredited certification bodies issue ISO/IEC 42001 certificates. Caudals is not an accredited body, and a CTS-1 certificate is not an ISO certificate.
22 requirements mapped
| Requirement | Reference |
|---|---|
| O1.1Answers match the sources | A.6 |
| O1.2No invented facts | A.6 |
| O1.3Stays within its purpose | A.9 |
| O2.1Actions stay within authority | A.9 |
| O2.2Hands over when it should | A.9 |
| O2.3Consistent answers | A.6 |
| O3.1Tested before every release | Cl. 8 · A.6 |
| O3.2Changes are controlled | Cl. 8 · A.6 |
| O3.3Monitored in production | Cl. 9 · A.6 |
| O4.1A named owner | Cl. 5 · A.3 |
| O4.2Ready for incidents | Cl. 10 · A.8 |
| S2.1Does not leak personal data | A.7 |
| S4.1Models and suppliers are vetted | A.10 |
| L1.1People know it is an AI | A.8 |
| L1.2Purpose and limits are stated | A.8 |
| L1.3Records are kept | A.6 |
| L2.1Role and risk class are determined | Cl. 4 · Cl. 6 |
| L2.2AI is governed | Cl. 4–10 · A.2 · A.3 · A.4 |
| L2.3Risks and impacts are assessed | Cl. 6 · A.5 |
| L3.1Personal data is handled lawfully | A.7 |
| L3.3People are treated alike | A.5 · A.7 |
| L4.2Exposure is quantified and allocated | Cl. 6 · A.10 |
NIST AI RMF
US National Institute of Standards and Technology · Voluntary framework · Edition mapped: AI RMF 1.0 (NIST AI 100-1) · Official source
The AI Risk Management Framework 1.0, published in January 2023, organizes AI risk management into four functions: Govern, Map, Measure, and Manage. Its Generative AI Profile, NIST AI 600-1, identifies twelve risks specific to generative systems, including confabulation, data privacy, and information security.
How CTS-1 relates. CTS-1 provides tested evidence for the Measure function. Its tests evaluate the trustworthiness characteristics defined in the framework, while its evidence requirements map to Govern, Map, and Manage.
Keep in mind. NIST has announced a revision of the framework. This mapping follows version 1.0 and will be updated when the revision is published.
27 requirements mapped
OWASP Top 10 for LLM applications
OWASP GenAI Security Project · Security risk list · Edition mapped: 2025 · Official source
This list identifies the ten most critical security risks in applications built on large language models, from prompt injection to unbounded consumption.
How CTS-1 relates. The CTS-1 Security pillar covers all ten risks. Each risk has at least one requirement that tests the agent or reviews the underlying control.
Keep in mind. This mapping uses identifiers from the 2025 edition. OWASP published a 2026 edition in August 2026 that reorders the list, and the next revision of CTS-1 will adopt those identifiers.
15 requirements mapped
| Requirement | Reference |
|---|---|
| O1.1Answers match the sources | LLM09:2025 |
| O1.2No invented facts | LLM09:2025 |
| O2.1Actions stay within authority | LLM06:2025 |
| S1.1Resists prompt injection and jailbreaks | LLM01:2025 |
| S1.2Resists indirect injection | LLM01:2025 · LLM04:2025 |
| S1.3Keeps its configuration confidential | LLM07:2025 |
| S2.1Does not leak personal data | LLM02:2025 |
| S2.2Keeps confidential data and customers apart | LLM02:2025 · LLM08:2025 |
| S2.3Holds no secrets it could reveal | LLM02:2025 · LLM07:2025 |
| S3.1Least privilege for tools and data | LLM06:2025 |
| S3.2Acts with the user's permissions | LLM06:2025 |
| S3.3Output is handled as untrusted | LLM05:2025 |
| S4.1Models and suppliers are vetted | LLM03:2025 · LLM04:2025 |
| S4.2Hardened and protected against abuse | LLM10:2025 |
| L4.1Money and commitments have limits | LLM06:2025 |
OWASP Top 10 for agentic applications
OWASP GenAI Security Project · Security risk list · Edition mapped: 2026 · Official source
Published in December 2025, this list identifies the ten primary risks of autonomous agents. It addresses new attack surfaces that emerge when a model can plan, use tools, maintain memory, and communicate with other agents. Documented risks include goal hijacking, tool misuse, identity and privilege abuse, cascading failures, and rogue agents.
How CTS-1 relates. CTS-1 covers the ten risks across its Operational and Security pillars. In multi-agent systems, messages from another agent are treated as untrusted content, like any other input.
Keep in mind. Requirements that depend on tools apply only to agents that take actions.
11 requirements mapped
| Requirement | Reference |
|---|---|
| O2.1Actions stay within authority | ASI02 |
| O2.2Hands over when it should | ASI09 |
| O4.3Can be stopped and fails safely | ASI08 · ASI10 |
| S1.1Resists prompt injection and jailbreaks | ASI01 |
| S1.2Resists indirect injection | ASI01 · ASI06 · ASI07 |
| S2.3Holds no secrets it could reveal | ASI03 |
| S3.1Least privilege for tools and data | ASI02 · ASI03 |
| S3.2Acts with the user's permissions | ASI03 · ASI07 |
| S3.3Output is handled as untrusted | ASI05 |
| S4.1Models and suppliers are vetted | ASI04 |
| L4.1Money and commitments have limits | ASI02 · ASI09 |
MITRE ATLAS
MITRE · Threat knowledge base · Edition mapped: v2026.10 · Official source
ATLAS documents the tactics and techniques that adversaries use against AI systems, providing case studies and mitigations modeled on MITRE ATT&CK.
How CTS-1 relates. CTS-1 uses ATLAS to label adversarial test cases. Every finding identifies the specific technique that succeeded, and every requirement maps to its corresponding mitigation.
Keep in mind. ATLAS is a catalog of threats rather than a set of requirements, and MITRE updates it monthly. This mapping is pinned to version 2026.10 and reviewed quarterly.
16 requirements mapped
| Requirement | Reference |
|---|---|
| O2.1Actions stay within authority | AML.T0053 · AML.M0029 · AML.M0037 |
| O3.3Monitored in production | AML.M0024 |
| S1.1Resists prompt injection and jailbreaks | AML.T0051.000 · AML.T0054 · AML.M0020 |
| S1.2Resists indirect injection | AML.T0051.001 · AML.T0070 · AML.T0080 · AML.M0030 |
| S1.3Keeps its configuration confidential | AML.T0085.003 · AML.T0084 · AML.T0069 |
| S2.1Does not leak personal data | AML.T0085 · AML.T0086 |
| S2.2Keeps confidential data and customers apart | AML.T0085.000 |
| S2.3Holds no secrets it could reveal | AML.T0098 |
| S3.1Least privilege for tools and data | AML.M0026 · AML.M0028 · AML.M0037 |
| S3.2Acts with the user's permissions | AML.TA0012 · AML.M0027 |
| S3.3Output is handled as untrusted | AML.T0077 · AML.M0033 |
| S4.1Models and suppliers are vetted | AML.T0010 · AML.M0043 |
| S4.2Hardened and protected against abuse | AML.T0034 |
| S4.3Attacks are logged, noticed, and tested again | AML.M0024 · AML.M0035 |
| L1.3Records are kept | AML.M0024 |
| L4.1Money and commitments have limits | AML.M0029 |
SOC 2
AICPA · Attestation report · Edition mapped: 2017 Trust Services Criteria (2022 points of focus) · Official source
A SOC 2 report provides an independent accountant's opinion on a service organization's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
How CTS-1 relates. SOC 2 evaluates the service hosting the agent. It does not test whether the agent answers correctly or resists prompt injection. CTS-1 accepts a current SOC 2 report as environment evidence under requirement S4.2, then adds tests specific to AI.
Keep in mind. Only licensed CPA firms issue SOC 2 reports. Caudals does not issue them.
22 requirements mapped
GDPR
European Union · Law · Edition mapped: Regulation (EU) 2016/679 · Official source
Regulation (EU) 2016/679 governs the processing of personal data in the EU. For an AI agent, key provisions include the principles of Article 5, automated decisions in Article 22, data protection by design in Article 25, security in Article 32, and impact assessments in Article 35. Fines reach 20 million euros or 4% of worldwide turnover.
How CTS-1 relates. CTS-1 tests whether the agent leaks personal data and whether decisions about people involve human review. It also reviews the legal basis, privacy notice, and processor agreements.
Keep in mind. CTS-1 is not a certification under Article 42 of the GDPR.
12 requirements mapped
| Requirement | Reference |
|---|---|
| O2.2Hands over when it should | Art. 22 |
| O4.2Ready for incidents | Art. 33 |
| S2.1Does not leak personal data | Art. 5 · Art. 32 |
| S2.2Keeps confidential data and customers apart | Art. 32 |
| S3.2Acts with the user's permissions | Art. 32 |
| L1.3Records are kept | Art. 5 |
| L2.3Risks and impacts are assessed | Art. 35 |
| L3.1Personal data is handled lawfully | Art. 5 · Art. 6 · Art. 25 · Art. 28 |
| L3.2Decisions about people need human review | Art. 22 |
| L3.3People are treated alike | Art. 5 |
| L4.2Exposure is quantified and allocated | Art. 82 · Art. 83 |
| L4.3Regulated firms meet their sector's rules | Art. 33 |
SR 26-2
Federal Reserve, OCC and FDIC · Supervisory guidance · Edition mapped: 17 April 2026 · Official source
SR 26-2, Revised Guidance on Model Risk Management, was issued on 17 April 2026 and replaces SR 11-7. It describes how banking organizations must develop, validate, monitor, and govern models, including those acquired from third parties. It applies primarily to institutions with more than 30 billion dollars in total assets, serving as supervisory guidance rather than an enforceable rule.
How CTS-1 relates. CTS-1 applies these principles to AI agents deployed by financial firms. It requires a formal inventory, independent validation before use, outcome analysis, ongoing monitoring, and verification of third-party products.
Keep in mind. SR 26-2 states that generative and agentic AI models fall outside its scope. This mapping therefore applies by analogy. It shows a supervisor that the agent is held to the same discipline as an in-scope model, without claiming that SR 26-2 requires it.
11 requirements mapped
| Requirement | Reference |
|---|---|
| O1.1Answers match the sources | § V |
| O3.1Tested before every release | § V |
| O3.2Changes are controlled | § VI |
| O3.3Monitored in production | § V |
| O4.1A named owner | § VI |
| S4.1Models and suppliers are vetted | § VII |
| L1.3Records are kept | § VI |
| L2.1Role and risk class are determined | § VI |
| L2.2AI is governed | § VI |
| L4.2Exposure is quantified and allocated | § III |
| L4.3Regulated firms meet their sector's rules | § IV · § V · § VI · § VII |
ISO/IEC 27001
ISO and IEC · International standard · Edition mapped: ISO/IEC 27001:2022 · Official source
ISO/IEC 27001:2022 is the international standard for information security management systems. Its Annex A specifies 93 controls.
How CTS-1 relates. CTS-1 accepts a current ISO/IEC 27001 certificate covering the system as environment evidence under requirement S4.2. It then evaluates what ISO/IEC 27001 omits, testing attacks specific to AI agents.
Keep in mind. A CTS-1 certificate is not an ISO/IEC 27001 certificate.
7 requirements mapped
DORA
European Union · Law · Edition mapped: Regulation (EU) 2022/2554 · Official source
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied to financial entities in the EU since 17 January 2025. It covers ICT risk management, incident reporting, resilience testing, and third-party ICT provider risk. A company supplying an AI agent to a bank qualifies as one of those providers.
How CTS-1 relates. CTS-1 reviews incident readiness, supplier management, and recurring security testing. It provides a financial entity with tested evidence about any agent it buys or builds.
Keep in mind. CTS-1 does not replace the resilience testing or the register of information that DORA requires.
5 requirements mapped
| Requirement | Reference |
|---|---|
| O4.2Ready for incidents | ICT-related incident management |
| O4.3Can be stopped and fails safely | Digital operational resilience |
| S4.1Models and suppliers are vetted | ICT third-party risk |
| S4.3Attacks are logged, noticed, and tested again | Digital operational resilience testing |
| L4.3Regulated firms meet their sector's rules | ICT-related incident management · ICT third-party risk |
Other references
CTS-1 also draws on these texts. Version 1.0 does not map them requirement by requirement.
- NIST AI 600-1, the generative AI profile of the AI RMF.
- ISO/IEC 23894:2023 on AI risk management, and ISO/IEC 42005:2025 on AI system impact assessment.
- ISO/IEC 42006:2025, requirements for bodies that audit and certify AI management systems.
- Directive (EU) 2024/2853 on liability for defective products, which treats software, including AI, as a product. Member states must transpose it by 9 December 2026.
- NIS2 (Directive (EU) 2022/2555) and the Cyber Resilience Act (Regulation (EU) 2024/2847).
- The CSA AI Controls Matrix, the OECD AI Principles, New York City Local Law 144 on automated employment decision tools, and Colorado SB 26-189 on automated decision-making technology.
What a mapping means
A mapping shows that a CTS-1 requirement addresses the same risk or control as the cited reference. It does not mean that meeting the requirement satisfies the law or standard.
We cite references at the level checked against the official text, such as an article, clause, category, or technique. Each framework names the edition checked for the mapping.
Frameworks change. We review every mapping each quarter and record updates in the changelog.