AuditThis.ai

Reference register

Every source the prompts select from, by tier. Descriptions are this site's words; nothing is reproduced from the sources, and each source's own licence governs its use. Each entry's verification date is the date its repository page and licence file were fetched and read; an entry older than 180 days is marked for re-verification. The register as data is references.yml; how the tiers and triggers work is on the method page.

Tier 0: Conduct

ReferenceLicenceVerifiedRole
AIQT GuardrailsApache 2.02026-10-30Conduct standard for the assistant.

Tier 1: Always applied

ReferenceLicenceVerifiedRole
Secure ConfigCC0; vendored AIQT material Apache 2.02026-10-30Deployment exposure per service: TLS, human and machine authentication, MFA, access restriction, secrets, inbound and outbound network access, lifecycle.
GRC LibraryCC BY-SA 4.02026-10-30Governance, risk, compliance, privacy, AI governance, supply chain, secure development, resilience.
Whats.Going.On. (WGO)MIT2026-10-30Prompt-first audit method starting from a business concern; selects product, technical, operational, security, continuity, and business perspectives.
OWASP ASVSCC BY-SA 4.02026-10-30Application-layer security requirements, levelled.

Tier 2: Applied on trigger

ReferenceLicenceVerifiedTriggerRole
DataGrail Privacy Assessment skillNot read; the archive's own licence terms govern2026-10-30Personal data processedDrafts a privacy impact assessment in a 9-section structure, screens for high-risk processing, models inherent and residual risk to individuals.
OWASP Top 10 for LLM Applications, including the Agentic Top 10CC BY-SA 4.02026-10-30 and 2026-10-31AI components present; agentic path when agents with tool use are presentVulnerability taxonomy for LLM and agent components.
MITRE ATLAS dataApache 2.02026-10-30AI components presentAdversary tactics, techniques, and case studies for AI systems, as structured data.
SLSACommunity Specification License 1.02026-10-30Artefacts consumed by others, or build integrity bears on the decisionBuild integrity and provenance levels.
CycloneDX specificationApache 2.02026-10-31Third-party dependencies with supply chain bearing on the decisionSBOM format.
OWASP SCVSCC BY-SA 4.02026-10-31Third-party dependencies with supply chain bearing on the decisionVerification levels for components and SBOM practice.
OWASP SAMMCC BY-SA 4.02026-10-30Decision concerns the organizationSoftware assurance process maturity.
CHAOSS metricsMIT2026-10-30Due diligence, handover, or sustainability in the decisionProject health metrics: contributor concentration, responsiveness, release cadence.
Minimum Viable Secure ProductCC0 1.02026-10-31Project is or will be a supplier to other organizationsShort vendor-facing minimum baseline.
CSA Cloud Controls Matrix (CCM)CSA terms; no licence needed for internal use, customization or commercial use needs one (CCM page, read 2026-10-31)2026-10-31Owner opts into framework alignment at planning Step 0 and supplies the copyCloud security control framework used, at the owner's option, to organize the plan and the report by control domain and identifier.
CSA AI Controls Matrix (AICM)CSA terms; see the licensing FAQ (read 2026-10-31)2026-10-31Owner opts into framework alignment and AI components are presentAI-specific extension of the CCM used, at the owner's option, to organize AI findings by control domain and identifier.
OWASP Threat Modeling PlaybookCC BY-SA 4.02026-10-31New system, significant change, or no existing threat modelThreat modelling as a process; supplies the adversary and asset view that WGO's business view lacks.
Clean LanguageCC BY-SA 4.02026-10-30Written artefacts are deliverables or will be relied onProse quality of the project's written artefacts only.
DiátaxisCC BY-SA 4.02026-10-30Written artefacts are deliverables or will be relied onWhether the right kinds of documentation exist.

Tier 3: Supporting

ReferenceLicenceVerifiedRole
OWASP Web Security Testing GuideCC BY-SA 4.02026-10-31Test procedures for ASVS requirements.
OWASP AI Testing GuideCC BY-SA 4.02026-10-31Test procedures for LLM Top 10 and ATLAS findings.
OWASP Cheat Sheet SeriesCC BY-SA 4.02026-10-30Remediation guidance for Phase 5 and plan remediation sections.
NIST OSCAL contentUS public domain2026-10-31SP 800-53 catalogues and baselines as machine-readable data; authoritative identifiers when findings are mapped to 800-53.

Tools

ReferenceLicenceVerifiedTriggerRole
OpenSSF ScorecardApache 2.02026-10-30Source in a hosted git repositoryRepository hygiene checks: branch protection, pinned dependencies, token permissions, signed releases.
GitleaksMIT2026-10-31Source in a hosted git repositorySecrets in repository history.
promptfooMIT2026-10-31AI components presentPrompt, agent, and RAG red teaming.
garakApache 2.02026-10-31AI components presentLLM vulnerability scanning.
kube-benchApache 2.02026-10-31Kubernetes in scopeKubernetes configuration against the CIS Kubernetes Benchmark.
Considered and excluded

Recorded so that the decision is not re-litigated without new information. Candidates and the reason each was excluded: