OWASP LLM Top 10: README

# OWASP Top 10 for LLMs Mapped to Cybersecurity Frameworks and Standards

Welcome to the "owaspllmtop10mapping" repository. This repository provides comprehensive mappings of the OWASP Top 10 vulnerabilities for Large Language Models (LLMs) to a range of established cybersecurity frameworks and standards. We aim to offer a resource that helps organizations align their LLM security practices with globally recognized cybersecurity guidelines.
Our baseline and guide is [OWASP Top 10 for Large Language Model Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/#) and it's [charter](https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/wiki/Charter).

## Mappings Overview

This repository includes mappings to the following frameworks and standards:

1. **[NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)**
   - Provides comprehensive guidelines for managing cybersecurity risk.
   - A foundational framework for cybersecurity recognized worldwide.

2. **ISO/IEC Standards**
   - [ISO/IEC 27001](https://www.iso.org/standard/54534.html) (Information Security Management)
   - [ISO/IEC 20547-4:2020](https://www.iso.org/standard/74438.html) (Big Data Reference Architecture Security and Privacy)
   - Crucial for global business compliance and establishing security controls.

3. **[MITRE ATT&CK](https://attack.mitre.org/)**
   - A detailed knowledge base for understanding and defending against cyber attacks.
   - Practical for threat modelling and security analysis.

4. **[CIS Controls](https://www.cisecurity.org/controls/)**
   - Developed by the Centre for Internet Security, offering actionable controls.
   - Well-regarded for practicality in strengthening cybersecurity defences.

5. **CVEs and CWEs**
   - [Common Vulnerabilities and Exposures (CVEs)](https://cve.mitre.org/)
   - [Common Weakness Enumeration (CWEs)](https://cwe.mitre.org/)
   - Essential for identifying and cataloging vulnerabilities.

6. **[FAIR](https://www.fairinstitute.org/what-is-fair)**
   - Factor Analysis of Information Risk focuses on risk quantification and management.
   - Helps organizations quantify cybersecurity risk in financial terms.

7. **[STRIDE](https://en.wikipedia.org/wiki/STRIDE_(security))**
   - A threat modelling methodology for identifying security threats.
   - Often used in the early stages of software development.

8. **[ENISA](https://www.enisa.europa.eu/)**
   - The European Union Agency for Network and Information Security provides broad cybersecurity advice.
   - Relevant especially for compliance and best practices in European contexts.

9. **[ASVS](https://owasp.org/www-project-application-security-verification-standard/)**
   - The Application Security Verification Standard, important for web application security.
   - Provides a basis for testing and assessing web application security controls.

10. **[SAMM](https://owaspsamm.org/model/)**
    - Software Assurance Maturity Model, useful for integrating security into software development.
    - Helps in benchmarking and improving software security practices.

11. **[MITRE ATLAS](https://atlas.mitre.org/)**
    - Focused on adversarial behaviours and may not cover all aspects of cybersecurity management.
    - Specific and detailed for threat modelling and analysis.

12. **[BSIMM](https://www.bsimm.com/)**
    - Building Security In Maturity Model, a tool for measuring and improving software security initiatives.
    - Best suited for software security practices within organizations.

13. **[OPENCRE](https://www.opencre.org/)**
    - A facilitator for understanding and implementing cybersecurity controls across different standards.
    - Acts as a bridge between various frameworks rather than a standalone guide.
   
14. **[CycloneDX Machine Learning Software Bill of Materials (SBOM)](https://cyclonedx.org/)**
    - Standard that provides advanced supply chain capabilities for cyber risk reduction.
    - Standard capable of representing software, hardware, services, and other types of inventory.

## Contributing

We welcome contributions from the community. Whether you're adding new mappings, refining existing ones, or providing translations, your input is valuable. Please see our [CONTRIBUTING.md](/CONTRIBUTING.md) file for guidelines on how to contribute.

## License

This project is licensed under the [MIT License](/LICENSE). See the LICENSE file for more details.

## Acknowledgments

- OWASP Foundation for their continuous efforts in improving web security.
- All contributors who have dedicated their time and effort to enhance this repository.