Law / Frameworks / Crosswalk / OWASP Agentic Top 10 to NIST CSF 2.0

The OWASP Top 10 for Agentic Applications, mapped to the NIST Cybersecurity Framework

4 of OWASP Agentic Top 10's controls connect to 2 of NIST CSF 2.0's through 10 laws in 4 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: OWASP Top 10 for Agentic Applications, 2026 edition, December 2025, OWASP GenAI Security Project
To: NIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), National Institute of Standards and Technology
See also: NIST CSF 2.0 to OWASP Agentic Top 10, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: owasp-agentic-top-10--nist-csf.csv · owasp-agentic-top-10--nist-csf.json

OWASP Agentic Top 10	NIST CSF 2.0	Laws	Jurisdictions	Where the laws stand
ASI01Agent Goal Hijack	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
ASI01Agent Goal Hijack	The 2 laws behind ASI01 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
ASI03Identity and Privilege Abuse	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
ASI03Identity and Privilege Abuse	The 2 laws behind ASI03 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
ASI04Agentic Supply Chain Vulnerabilities	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
ASI04Agentic Supply Chain Vulnerabilities	The 2 laws behind ASI04 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
ASI09Human-Agent Trust Exploitation	PR.PS-04Log records are generated and made available for continuous monitoring	8	4	4 in force, 4 not yet in force
ASI09Human-Agent Trust Exploitation	The 8 laws behind ASI09 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan

Not connected to the NIST CSF 2.0: 6 of OWASP Agentic Top 10's controls

No law we track reaches these

No duty in the laws we track reaches these controls.

ASI02 Tool Misuse and Exploitation
ASI05 Unexpected Code Execution (RCE)
ASI06 Memory & Context Poisoning
ASI07 Insecure Inter-Agent Communication
ASI08 Cascading Failures
ASI10 Rogue Agents

Lines of the scraping and news aggregation laws we track were not read against the NIST CSF 2.0, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the OWASP Agentic Top 10 through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws on	Read against the NIST CSF 2.0
AI	such lines on security, robustness, resilience, vulnerabilities and logs
scraping	not read
news aggregation	not read

Every duty line in the AI laws we track has been read against the framework for its subject.

Sources and licenses

OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.