GAISSF™ · CONTROL CONTEXT
Identify the requirement, applicable control and evidence expectation.
FRAMEWORKS
Four frameworks. Different operational roles.
ODA3 Institute publishes distinct instruments for AI safety and security controls, incident description, incident response and Physical AI. They establish context for examination, not a finding about a particular deployment.
ODA3 / EVIDENCE SYSTEM↗
DISTINCT INSTRUMENTS
01
GAISSF™Control context
02
UAIF™Incident description
03
AI-IRF™Response lifecycle
04
PAI-SF™Physical AI security
Frameworks inform the question; evidence determines the finding.
THE ECOSYSTEM
Choose the instrument by the question.
The four frameworks are complementary, not interchangeable.
CONTROL CONTEXT
GAISSF™
AI safety and security control context. 9 domains · 59 controls.
INCIDENT DESCRIPTION
UAIF™
Common taxonomy and schema for describing AI incidents.
INCIDENT RESPONSE
AI-IRF™
Lifecycle for preparing, investigating, responding and learning.
PHYSICAL AI
PAI-SF™
Physical AI security and Kinetic Zero Trust. 12 domains · 41 controls.
FRAMEWORK RELATIONSHIPS
How the frameworks work together.
This is a conceptual information flow between distinct published instruments. It describes the records and decisions that should connect; it does not represent an operating software integration.
PAI-SF™ · PHYSICAL AI
Where physical effects are possible, apply the relevant sensing, autonomy, command and action controls.
UAIF™ · INCIDENT RECORD
Structure a material AI incident with its identity, causal context, impact and supporting records.
AI-IRF™ · RESPONSE
Use the incident context for investigation, containment, recovery and operational learning.
Findings and lessons can inform review of the relevant GAISSF™ and PAI-SF™ controls, with the source and limits of each record preserved.
Explore platform interoperability →FROM FRAMEWORK TO EVIDENCE
A requirement does not prove implementation.
A control tells an organization what to establish. A system claim requires records tied to a defined version, environment and period. Provenance and verification determine whether those records can support a finding.
Define
Requirement and relevant control objective.
Examine
Evidence, provenance and checks against defined criteria.
Conclude
Finding and limitation for the particular system.
MAPPINGS & CROSSWALKS
Show relationships without claiming equivalence.
A mapping states a documented relationship under its scope. The result may be Supported, Partial, Gap or Unknown. Conformity requires the applicable obligation, actual implementation and supporting evidence.
Supported
Relationship supported for the stated scope.
Partial
Some but not all elements addressed.
Gap
No sufficient element under the defined mapping.
Unknown
Insufficient basis to determine the relationship.
PUBLICATION CONTROL
Use the versioned specification.
Framework titles and counts are orientation. The applicable version, control text, scope, source basis and usage terms are established by the primary publications at docs.oda3.org.
CURRENT BOUNDARY
Published frameworks; distinct assurance work.
Publishing, using or mapping a framework does not establish regulatory compliance, effectiveness in deployment, certification or independent conformance. The evidence model is being tested and machine-readable structures remain in development.