Reference Framework mapping F1.15 — validated framework mapping · Last updated: 2026-05-13
Framework mapping
Single source of truth (F1.15) for which fastpace primitive satisfies which control. Covers the AI-specific frameworks (NIST AI RMF, NIST AI 600-1, ISO/IEC 42001, EU AI Act), the infosec / cloud baselines (SOC 2, ISO 27001, NIST 800-53, NIST CSF, FedRAMP-M, HIPAA, DORA), and the financial-services + privacy regimes (GDPR, CCPA/CPRA, GLBA, PCI DSS, ECOA / Reg B, FCRA / Reg V, SOX / ITGC). Every claim references a shipped feature plus the artifact that demonstrates the control. A note on the financial regimes: fastpace supplies the records, access controls, encryption custody, provenance and prohibited-basis data minimization these rules require — it does not perform fair-lending statistical testing or disparate-impact analysis. See "What this matrix does NOT cover" for the ECOA boundary in particular.
This file is the canonical mapping. The /compliance page's FrameworkMatrix component, the AgentGovernance cards, and the engineer-to-security one-pager all source their control IDs from here. Keep this file the only place control IDs are written.
How to read this
Each section is one fastpace primitive . Inside each section, every row is:
Framework · Control ID · Maps to (one-line claim) · Evidence (file/artifact) · Runnable command
The Evidence column points at the file or command output that demonstrates the control today — auditor demos start there, not in marketing copy.
The Runnable column gives the exact CLI invocation that produces the evidence artifact. The generated compliance report (one-pager PDF emailed to prospects) sources both columns from this file — the PDF is verifiable by running the commands listed.
F0.1 — Cryptographic identity
Framework Control ID Maps to Evidence Runnable NIST AI RMF GOVERN-1.4 Identifiable accountability — every artifact tied to an install ~/.fastpace/identity/identity.jsonfastpace identity showNIST AI 600-1 GV-1.4-001 Accountability for GenAI artifacts identity manifest with fingerprint fastpace identity show --jsonISO/IEC 42001 §6.1.4 AI-system identification + ownership ~/.fastpace/identity/identity.jsonfastpace identity showEU AI Act Art. 9 (risk mgmt) Risk-management system has identifiable controllers install identifier + fingerprint fastpace identity showSOC 2 CC1.4 Authority and responsibility identity manifest + revocation log fastpace identity logISO 27001 A.5.16 Identity lifecycle for systems identity rotate / revoke history fastpace identity rotateFedRAMP-M IA-2 / IA-5 Identification of system components + key mgmt Ed25519 keypair, mode 0600 on private half fastpace identity show --pathsHIPAA §164.312(a)(2)(i) Unique user identification (admin-safeguard scope) per-install identity fastpace identity showPCI DSS Req 8.2 / 8.3 Unique ID per actor + strong authentication per-install Ed25519 identity fastpace identity showGLBA §314.4(c)(1) Access controls — authenticate + identify authorized users install identity + revocation log fastpace identity logSOX §404 (ITGC access) Unique identification of users with access to financial systems per-install identity + revocation log fastpace identity logNIST 800-53 IA-2 / IA-5 Identification + authentication; authenticator management Ed25519 keypair, mode 0600 on private half fastpace identity show --pathsNIST CSF PR.AA-01 Identities + credentials managed for authorized actors per-install identity fastpace identity show
F0.2 — Hash-chained signed audit log
Framework Control ID Maps to Evidence Runnable NIST AI RMF MEASURE-2.7 Tamper-evident logging of AI system activity fastpace/audit.logfastpace verifyNIST AI 600-1 MS-2.7-001 GenAI activity log with verifiable integrity hash-chained audit entries fastpace verify --jsonISO/IEC 42001 §9.2 Verifiable audit trail fastpace verify --json exit 0fastpace verify --jsonEU AI Act Art. 12 Logs that "permit traceability" chain + signatures fastpace verifySOC 2 CC8.1 Change-management evidence audit chain + signed receipts fastpace audit export-bundle --since 90dISO 27001 A.8.15 Tamper-evident event logs fastpace verify exit codefastpace verifyFedRAMP-M AU-2 / AU-9 Auditable events + protection of audit info hash chain + Ed25519 signatures fastpace verifyHIPAA §164.312(b) Audit controls — record + examine activity per-call signed receipts fastpace audit export-bundle --framework hipaaDORA Art. 9 / Art. 17 ICT-related incident logs audit chain feeds incident timeline fastpace audit export-bundle --since 30dGDPR Art. 32 Integrity of processing records tamper-evident chain fastpace verifyPCI DSS Req 10.2 / 10.3 Log all access; protect audit trails from modification hash-chained, signed audit entries fastpace verifyGLBA §314.4(c)(8) Monitoring + logging of access to customer information tamper-evident audit chain fastpace audit export-bundle --since 90dECOA §1002.12 Record retention — 25-month preservation of credit records tamper-evident chain over decision records fastpace audit export-bundle --framework ecoaFCRA §1681m Records supporting adverse-action notices, retained tamper-evidently hash-chained signed entries fastpace audit export-bundle --framework fcraSOX §404 (ITGC) Audit trail of changes affecting financial reporting hash-chained, signed audit entries fastpace verifyNIST 800-53 AU-2 / AU-12 Auditable events + audit-record generation hash chain + Ed25519 signatures fastpace verifyNIST CSF PR.PS-04 Log records are generated + protected for integrity tamper-evident audit chain fastpace verify
F0.3 — Discovery manifest
Framework Control ID Maps to Evidence Runnable NIST AI RMF MAP-1.1 AI system registration / discovery ~/.fastpace/manifest.jsonfastpace inventoryNIST AI 600-1 MP-1.1-001 GenAI inventory at known paths machine + per-repo manifests fastpace inventory --jsonISO/IEC 42001 §7.4 Documented information on AI systems in use <repo>/fastpace/manifest.jsonfastpace inventoryGDPR Art. 30 Records of processing activities machine + per-repo manifests fastpace inventory --jsonSOC 2 CC1.4 System inventory fastpace inventory --jsonfastpace inventory --jsonISO 27001 A.5.9 Asset inventory fastpace inventoryfastpace inventoryFedRAMP-M CM-8 System component inventory machine manifest at well-known path fastpace inventory --include-runtimesCCPA §1798.100 Inventory of personal information collected + its categories machine + per-repo manifests fastpace inventory --jsonGLBA §314.4(c)(2) Inventory + classification of customer-information data flows discovery manifest at well-known path fastpace inventoryNIST 800-53 CM-8 System component inventory machine manifest at well-known path fastpace inventory --include-runtimesNIST CSF ID.AM-01 Inventories of hardware / software / services maintained ~/.fastpace/manifest.jsonfastpace inventory
F0.4 — Agent identity & scope manifest
Framework Control ID Maps to Evidence Runnable NIST AI RMF GOVERN-1.4 Defined accountability per agent .claude/agents/<id>.md frontmatterfastpace agents list --jsonNIST AI RMF MEASURE-2.6 Operational characteristics + boundaries are measured per-session counters fastpace agents counters --since 7dISO/IEC 42001 §6.1.4 Identification of AI components agent identity manifests fastpace agents listEU AI Act Art. 14 Human-defined boundaries enforced at runtime agent-scope-guard hook decisions fastpace hooks show agent-scope-guardISO 27001 A.5.15 Least-privilege per actor bundled agents + fastpace grant fastpace grant listFedRAMP-M AC-3 / AC-6 Access enforcement + least privilege scope manifest + grant log fastpace grant list
F0.5 — Prompt redaction hook
Framework Control ID Maps to Evidence Runnable NIST AI RMF MAP-3.5 Data flowing into AI systems is governed fastpace/redaction.log roll-upfastpace redaction stats --since 30dISO/IEC 42001 §8.3 Data quality / sanitization upstream of AI redactor hits by pattern fastpace redaction stats --by patternEU AI Act Art. 10 Pre-prompt sanitization redaction log + prompt_redactor.config fastpace redaction statsGDPR Art. 5(1)(c) Data minimization redactor strips PII before prompt leaves box fastpace redaction stats --by patternHIPAA §164.514(b) Safe-harbor / de-identification at egress redaction patterns for 18 HIPAA identifiers fastpace redaction config --showPCI DSS Req 3.4 Mask / render PAN unreadable before it leaves the box redaction patterns for card-number formats fastpace redaction config --showCCPA §1798.100(c) Collection limited to what is reasonably necessary PII stripped before prompt egress fastpace redaction stats --by patternECOA §1002.5(b) Prohibited-basis information kept out of the decision pipeline race/sex/age patterns stripped pre-prompt fastpace redaction stats --by patternFCRA §1681b Consumer-report data limited to permissible purpose before egress PII stripped before prompt leaves the box fastpace redaction stats --by pattern
F0.6 — fastpace inventory (machine roll-up)
Framework Control ID Maps to Evidence Runnable NIST AI RMF MAP-1.1 "Implement discovery tools to identify AI agents" fastpace inventory --jsonfastpace inventory --jsonISO/IEC 42001 §7.4 Documented information on AI systems machine manifest rollup fastpace inventory --include-hooksGDPR Art. 30 Article 30 register for AI processing fastpace inventoryfastpace inventory --jsonFedRAMP-M CM-8 System component inventory (with subcomponents) machine + per-repo manifests fastpace inventory --include-runtimesCCPA §1798.130 Record of personal-information categories for disclosure machine manifest rollup fastpace inventory --jsonGLBA §314.4(c)(2) Periodic data inventory across systems machine + per-repo manifests fastpace inventory --include-hooksNIST 800-53 CM-8 System component inventory (with subcomponents) machine + per-repo manifests fastpace inventory --include-runtimesNIST CSF ID.AM-02 Software platforms + applications inventoried machine manifest rollup fastpace inventory --include-hooks
F1.1 — Run manifest signing
Framework Control ID Maps to Evidence Runnable NIST AI RMF MEASURE-2.7 "Output documented" — every AI call has a signed receipt fastpace/manifests/<ts>.jsonfastpace audit export-bundle --framework nist-ai-rmfNIST AI RMF MAP-2.3 Operational context of each AI invocation captured manifest with model/runtime/endpoint fastpace audit export-bundle --framework nist-ai-rmfNIST AI 600-1 MS-2.7-002 GenAI per-invocation receipts per-call manifest with prompt/response hashes fastpace audit export-bundle --framework nist-ai-600-1ISO/IEC 42001 §8.4 Operational records of AI invocations manifests directory listing fastpace audit export-bundle --framework iso-42001EU AI Act Art. 12 Per-call receipts manifest schema + signed_by fingerprint fastpace audit export-bundle --framework eu-ai-actSOC 2 CC8.1 Change-management evidence (every AI-merged change) manifests + audit chain fastpace audit export-bundle --framework soc2FedRAMP-M AU-12 / SI-7 Audit-generation + software integrity signed per-call receipts fastpace audit export-bundle --framework fedramp-mHIPAA §164.312(c)(1) Integrity controls on ePHI processing hash-only receipts (no plaintext persistence) fastpace audit export-bundle --framework hipaaPCI DSS Req 10.2.1 Individual access to data captured in a signed receipt fastpace/manifests/<ts>.jsonfastpace audit export-bundle --framework pci-dssECOA §1002.9 / §1002.12 Per-decision record retained for the adverse-action trail signed manifest per AI-assisted decision fastpace audit export-bundle --framework ecoaFCRA §1681m Per-decision receipt backing an adverse-action notice signed manifest per decision fastpace audit export-bundle --framework fcraSOX §404 (ITGC) Change evidence — every AI-merged change has a signed receipt manifests + audit chain fastpace audit export-bundle --framework soxNIST 800-53 AU-12 / SI-7 Audit-record generation + software integrity signed per-call receipts fastpace audit export-bundle --framework nist-800-53
F1.3 — Circuit breaker on behavioral baseline divergence
Framework Control ID Maps to Evidence Runnable NIST AI RMF MANAGE-2.3 "Mechanisms to monitor + manage AI risks post-deployment" per-agent baseline + divergence pause fastpace circuit-breaker statusNIST AI RMF MANAGE-4.1 Decommissioning / pause path signed pause event in audit chain fastpace circuit-breaker historyISO/IEC 42001 §A.9.2 Performance monitoring session-shape baseline fastpace circuit-breaker baseline --showEU AI Act Art. 14(4)(b) Operator can stop or interrupt the system mechanical pause on divergence fastpace circuit-breaker armFedRAMP-M IR-4 Incident handling divergence event triggers pause + audit entry fastpace circuit-breaker statusDORA Art. 12 Detection of anomalous activity per-agent counters vs baseline fastpace circuit-breaker status --jsonNIST 800-53 IR-4 Incident handling — automated response divergence event triggers pause + audit entry fastpace circuit-breaker statusNIST CSF DE.AE-02 Anomalies + potentially adverse events analyzed per-agent counters vs baseline fastpace circuit-breaker status --json
F1.6 — Least-privilege bootstrap (fastpace grant)
Framework Control ID Maps to Evidence Runnable NIST AI RMF GOVERN-3.2 Risk-tier-driven controls grant entries with --reason fastpace grant listISO/IEC 42001 §6.1.3 Determining controls based on risk agents.default_policy = deny-allfastpace grant auditISO 27001 A.5.15 / A.8.2 Access control + privileged access mgmt bundled vs deny-all + grant log fastpace grant list --jsonFedRAMP-M AC-6 / AU-12 Least privilege + audit of access decisions grant entries signed into audit chain fastpace grant audit --since 90dPCI DSS Req 7.2.1 Access by business need-to-know; default deny deny-all default + signed grant log fastpace grant list --jsonGLBA §314.4(c)(1) Limit access to authorized users (least privilege) bundled vs deny-all + grant audit fastpace grant audit --since 90dSOX §404 (ITGC access) Logical access restricted to least privilege; access reviewed deny-all default + signed grant log fastpace grant audit --since 90dNIST 800-53 AC-6 Least privilege bundled vs deny-all + grant log fastpace grant list --jsonNIST CSF PR.AA-05 Access permissions managed on least-privilege + separation grant entries with --reason fastpace grant list
F1.8 — Risk-tier-classified exception workflow
Framework Control ID Maps to Evidence Runnable NIST AI RMF GOVERN-3.2 Tiered approval based on risk exception entries with risk tier + TTL fastpace exception listISO/IEC 42001 §6.1.3 Risk-treatment options selection tier from {low, medium, critical, irreversible, exfil_eligible} fastpace exception request --tier critical --reviewer <user>EU AI Act Art. 9(2)(d) Risk-management measures with review named-reviewer + TTL fields fastpace exception auditSOC 2 CC3.4 Risk identification with mitigation signed request/revoke/expiry in audit fastpace exception audit --since 90dFedRAMP-M CA-5 Plan of action + milestones for exceptions TTL field forces revisit fastpace exception auditDORA Art. 8 Risk-management framework with traceability full lifecycle in chain fastpace exception audit --jsonSOX §404 (ITGC) Segregation of duties — named-reviewer approval for exceptions signed request/revoke/expiry in audit fastpace exception audit --since 90dNIST 800-53 CA-5 Plan of action + milestones for exceptions TTL field forces revisit fastpace exception audit
F1.10 — Sensitivity-tagged context
Framework Control ID Maps to Evidence Runnable NIST AI RMF MAP-3.5 Data classification before AI ingestion fastpace/context/*.md frontmatterfastpace context list --by-sensitivityISO/IEC 42001 §8.3 Data classification sensitivity tag schema fastpace context list --jsonGDPR Art. 32 Appropriate technical measures incl. classification restricted files refused by F0.5 redactor fastpace context auditISO 27001 A.5.12 Information classification sensitivity overview in fastpace ui fastpace context listHIPAA §164.514 Limited dataset / minimum necessary sensitivity-tag-driven access fastpace context audit --filter restrictedPCI DSS Req 3.2 / 3.3 Classify + minimize stored account data sensitivity-tag schema on context files fastpace context list --by-sensitivityCCPA §1798.121 Limit use of sensitive personal information restricted tag refused by F0.5 redactor fastpace context audit --filter restrictedGLBA §314.4(c)(2) Classification of customer information sensitivity overview fastpace context listECOA §1002.5(b) Governing collection of prohibited-basis attributes prohibited-basis fields tagged restricted fastpace context audit --filter restrictedFCRA §1681b Consumer-report fields classified + access-limited sensitivity tag schema fastpace context list --by-sensitivity
F1.11 — Approved-runtime registry
Framework Control ID Maps to Evidence Runnable NIST AI RMF MANAGE-2.4 Bound to vendor / runtime allowlist runtimes.allowed[] in fastpace.config.yamlfastpace runtimes listISO/IEC 42001 §6.1.4 / §A.6 Third-party AI service control runtime-guard hook decisions fastpace runtimes auditEU AI Act Art. 25 Approved-vendor enforcement block log fastpace runtimes audit --blocks-onlyFedRAMP-M SA-9 External information system services runtime allowlist + block log fastpace runtimes list --jsonDORA Art. 28-30 Third-party ICT-service-provider register runtimes.allowed + endpoint per entry fastpace runtimes list --include-endpointsPCI DSS Req 12.8 Manage third-party service providers with due diligence runtimes.allowed + endpoint per entry fastpace runtimes list --include-endpointsNIST 800-53 SA-9 External information-system services governed runtime allowlist + block log fastpace runtimes list --json
F2.1 — Correction-event tracking + Reliability Score
Framework Control ID Maps to Evidence Runnable NIST AI RMF MEASURE-2.5 Accuracy, robustness, reliability metrics Reliability Score over rolling window fastpace reliability --window 60dNIST AI 600-1 MS-2.5-003 GenAI output-quality measurement correction events with severity classification fastpace reliability --jsonISO/IEC 42001 §9.1 Performance evaluation corrections log + score fastpace reliability --by-severityEU AI Act Art. 15 Accuracy + robustness severity-classified corrections fastpace reliability --since 90dSOC 2 CC4.1 Monitoring of controls rolling reliability score fastpace reliability --jsonECOA §1002.6 Ongoing measurement of AI-assisted decisioning quality severity-classified correction events fastpace reliability --since 90dFCRA §1681e(b) Procedures to assure maximum possible accuracy, measured rolling reliability score + correction events fastpace reliability --since 90d
F2.3 — Provenance Trailer Block + verify-provenance proof tree
Framework Control ID Maps to Evidence Runnable NIST AI RMF MAP-2.3 Operational context of each AI invocation captured trailer block on commit + cross-layer proof fastpace verify-provenance <sha>NIST AI RMF MEASURE-2.7 Tamper-evident output documentation trailer → manifest → audit-chain join fastpace verify-provenance <sha> --jsonISO/IEC 42001 §8.4 Operational records of AI invocations full proof tree per commit fastpace verify-provenance <sha>EU AI Act Art. 12 Logs that permit traceability per-commit cross-layer verification fastpace verify-provenance <sha>SOC 2 CC8.1 Change-management evidence (AI-attributed commits) trailer block on every AI commit fastpace verify-provenance <sha>FedRAMP-M SI-7 Software, firmware, information integrity signed provenance trail fastpace verify-provenance <sha> --jsonPCI DSS Req 6.3 Track changes to bespoke software with integrity proof trailer block → manifest → audit join fastpace verify-provenance <sha>GLBA §314.4(c)(4) Secure development practices, evidenced per change cross-layer provenance proof per commit fastpace verify-provenance <sha> --jsonECOA §1002.9 Inputs behind an adverse-action reason are traceable provenance trail ties decision → model + inputs fastpace verify-provenance <sha>FCRA §1681e(b) Inputs to a consumer-report decision are traceable cross-layer provenance proof per commit fastpace verify-provenance <sha>SOX §404 (ITGC change) Every change authorized + traceable to its source trailer block → manifest → audit join fastpace verify-provenance <sha>NIST 800-53 SI-7 Software, firmware, information integrity signed provenance trail fastpace verify-provenance <sha> --jsonNIST CSF PR.PS-06 Secure software-development practices, evidenced per change full proof tree per commit fastpace verify-provenance <sha>
F2.4 — CycloneDX-AI Bill of Materials per release
Framework Control ID Maps to Evidence Runnable NIST AI RMF MAP-2.1 Document AI system characteristics fastpace bom show --release <tag>fastpace bom show --release <tag>NIST AI 600-1 MP-2.1-001 GenAI Bill of Materials CycloneDX-AI 1.6-aiml-draft envelope fastpace bom show --jsonISO/IEC 42001 §7.4 / §A.7 Information about the AI system components + services + formulation fastpace bom showEU AI Act Art. 11 Technical documentation BOM + reliability + provenance summary fastpace bom show --release <tag>SOC 2 CC8.1 Release evidence signed BOM per release fastpace bom verify <release>FedRAMP-M SR-4 / SR-5 Supply-chain provenance + acquisition strategy CycloneDX-AI envelope fastpace bom show --release <tag> --jsonDORA Art. 28 ICT third-party register components block in BOM fastpace bom show --filter componentsPCI DSS Req 6.3.2 Inventory of bespoke + third-party software components CycloneDX-AI components block fastpace bom show --filter componentsGLBA §314.4(c)(4) Component inventory supporting secure development signed BOM per release fastpace bom show --release <tag>SOX §404 (ITGC SDLC) Inventory of software components under change control signed BOM per release fastpace bom show --release <tag>NIST 800-53 SR-4 / SR-5 Supply-chain provenance + acquisition strategy CycloneDX-AI envelope fastpace bom show --release <tag> --json
F4.x — AI-Native Maturity Score (9 sub-scores)
Framework Control ID Maps to Evidence Runnable NIST AI RMF GOVERN-4.1 Organizational AI-governance maturity weighted aggregate over 9 sub-scores fastpace maturity showNIST AI RMF MEASURE-1.3 Methods to evaluate AI risks chosen + documented each sub-score deterministic from primitives fastpace maturity show --jsonISO/IEC 42001 §10.1 Continual improvement scorecard trend over time fastpace maturity history --since 180dSOC 2 CC4.2 Self-assessment evidence maturity report fastpace maturity showNIST CSF GV.RM-01 Risk-management objectives established + agreed weighted aggregate over 9 sub-scores fastpace maturity showNIST 800-53 PM-9 Organization-wide risk-management strategy scorecard trend over time fastpace maturity history --since 180d
F5.1 — Audit-chain coverage gauge (cross-primitive)
Framework Control ID Maps to Evidence Runnable NIST AI RMF MEASURE-3.3 Quantitative measurement of AI-system performance % AI commits with complete evidence chain fastpace audit coverageNIST AI RMF MANAGE-4.1 "Risks are tracked over time" 60-day rolling window + status bands fastpace audit coverage --window 60dNIST AI 600-1 MS-3.3-001 GenAI quantitative evidence-quality figure coverage figure + threshold + band fastpace audit coverage --jsonISO/IEC 42001 §9.1 Performance evaluation (quantitative) single coverage figure fastpace audit coverage --basis enterpriseEU AI Act Art. 12 Traceability quality measurement cross-primitive verification figure fastpace audit coverageSOC 2 CC4.1 Monitoring controls — operating effectiveness banded gauge: green ≥95% / yellow ≥80% fastpace audit coverage --jsonFedRAMP-M CA-7 Continuous monitoring gauge feeds continuous-monitoring dashboard fastpace audit coverage --since 30dPCI DSS Req 10.4 Review logs + security events for coverage % AI commits with complete evidence chain fastpace audit coverageSOX §404 (ITGC) Monitoring of IT general controls' operating effectiveness % AI commits with complete evidence chain fastpace audit coverageNIST 800-53 CA-7 Continuous monitoring gauge feeds continuous-monitoring dashboard fastpace audit coverage --since 30dNIST CSF DE.CM-01 Networks + assets monitored to detect adverse events banded coverage gauge fastpace audit coverage --json
F5.2 — Signed outcome snapshot (procurement-grade attestation)
Framework Control ID Maps to Evidence Runnable NIST AI RMF GOVERN-5.1 Mechanisms for ongoing AI risk + performance reporting signed JSON envelope, offline-verifiable fastpace outcome snapshotISO/IEC 42001 §9.1 / §9.3 Performance reporting to management bundled metric + contracted threshold fastpace outcome snapshot && fastpace outcome verify <file>EU AI Act Art. 17 Quality-management system documentation tamper-evident snapshot fastpace outcome snapshotSOC 2 CC4.1 / CC7.5 Monitoring + system performance reporting signed attestation per cycle fastpace outcome snapshotFedRAMP-M CA-2 / CA-7 Security assessments + continuous monitoring offline-verifiable signed artifact fastpace outcome verify <snapshot.json>DORA Art. 5 Governance + organisational framework year-over-year trajectory artifact fastpace outcome renewal-reportSOX §302 Management certification backed by a signed attestation signed JSON envelope, offline-verifiable fastpace outcome snapshot && fastpace outcome verify <file>NIST 800-53 CA-2 / CA-7 Security assessments + continuous monitoring offline-verifiable signed artifact fastpace outcome verify <snapshot.json>
F6.1 — Customer-Managed Keys (CMK) with audit-chain integration
Framework Control ID Maps to Evidence Runnable NIST AI RMF MANAGE-3.2 Pre-trained models + sensitive data risk treatment customer-held KEK + envelope encryption fastpace cmk statusISO/IEC 42001 §A.6.2.6 Information security in AI X25519 + AES-256-GCM envelopes fastpace cmk encrypt <file>GDPR Art. 32 / Art. 28 Encryption + processor controls KEK at fastpace/cmk/kek.priv mode 0600 fastpace cmk statusSOC 2 CC6.1 Logical + physical access controls customer-exclusive key custody fastpace cmk status --jsonISO 27001 A.8.24 Use of cryptography standard primitives (RFC 7748 / 5869 / SP 800-38D) fastpace cmk statusFedRAMP-M SC-12 / SC-13 Cryptographic key establishment + use rotation lifecycle signed into audit fastpace cmk rotateHIPAA §164.312(a)(2)(iv) Encryption + decryption (addressable) customer-held KEK fastpace cmk encrypt <ePHI-file>DORA Art. 9(2)(c) Encryption of data at rest + in transit per-artifact envelope encryption fastpace cmk encrypt <file>PCI DSS Req 3.5 / 3.6 / 3.7 Protect stored account data; key-management lifecycle customer-held KEK; rotation signed into audit fastpace cmk rotateCCPA §1798.150 Reasonable security (encryption) for personal information X25519 + AES-256-GCM envelopes; customer custody fastpace cmk statusGLBA §314.4(c)(3) Encryption of customer information at rest + in transit per-artifact envelope encryption fastpace cmk encrypt <file>FCRA §628 (Disposal Rule) Secure disposal of consumer-report info via key destruction customer-held KEK; envelope encryption fastpace cmk rotateNIST 800-53 SC-12 / SC-13 Cryptographic key establishment + use rotation lifecycle signed into audit fastpace cmk rotateNIST CSF PR.DS-01 Data-at-rest protected via encryption X25519 + AES-256-GCM envelopes fastpace cmk status
Validation status
status: validated-against-published-text means every control ID above was cross-checked against the framework's published text on 2026-05-13. When that date drifts more than 3 months out of date, the auditor should treat the mapping as advisory — re-validate before the next audit cycle.
Open: when the EU AI Act implementing acts publish their final article numbering, re-verify Articles 9, 10, 11, 12, 14, 15, 17, 25.
What this matrix does NOT cover
For honesty in the generated PDF, the prospect-facing report explicitly calls out controls fastpace does NOT cover, so the document is not a sales doc only. Out-of-scope (the customer must source elsewhere):
Physical security controls (data-center locks, badging) — fastpace is a local-first developer tool; PE-* in FedRAMP / A.7.* in ISO 27001 are the customer's hosting story.Personnel security (background checks, training records) — PS-* in FedRAMP / A.6.* in ISO 27001.Continuous network monitoring of the corporate fleet — SC-7 / IDS is a customer-network concern; fastpace runs on developer workstations.Model-weight provenance for third-party model vendors — fastpace records which model was called (F1.1) but cannot attest the upstream training-data provenance of e.g. Anthropic Claude or OpenAI GPT; that is the model vendor's responsibility.Business-continuity / disaster-recovery testing — CP-* in FedRAMP / DORA Art. 11; out of scope for a developer-side tool.Fair-lending statistical testing (ECOA / Reg B) — the heart of ECOA compliance is disparate-impact / adverse-impact statistical analysis of lending outcomes. fastpace does NOT compute fairness statistics. What it provides is the substrate ECOA also requires: 25-month decision-record retention (§1002.12), provenance tying an adverse-action reason to its inputs (§1002.9), and prohibited-basis data minimization (§1002.5(b)). Source the statistical testing from a dedicated model-fairness tool.Cardholder-data-environment network segmentation (PCI DSS) — Req 1 (firewalls) and the CDE network boundary are infrastructure concerns; fastpace maps the logging, access, key-management and secure-development requirements that touch the developer workflow, not network topology.SOX entity-level + financial-statement controls — fastpace maps the IT general controls (ITGC: change management, logical access, monitoring) that auditors test under §404. Entity-level controls, financial-reporting close processes, and management's §302 assertions about the financials themselves are out of scope — fastpace supplies the ITGC evidence, not the accounting controls.FCRA dispute-resolution + furnisher obligations — the consumer-dispute process (§1681i), reinvestigation duties, and furnisher accuracy obligations (§1681s-2) are business processes, not developer-tool concerns. fastpace maps the accuracy procedures, adverse-action records, permissible- purpose minimization and secure disposal that touch the AI pipeline.The generated PDF reproduces this section verbatim — the credibility of the in-scope claims depends on the honesty of the out-of-scope list.
fastpace is a division of Stanfis, LLC