AICM and AIUC-1, mapped to the controls you already run
Buyers ask for the CSA AI Controls Matrix (AICM) and AIUC-1. AutoGovern maps every ID of both to its anchor controls, so a control you register and test once counts toward each.
How to read the mapping
Full: our anchor controls cover the item's intent. Partial: they overlap but leave part of it out, so meeting them is never enough on its own. Not covered: our AI-governance anchors do not address it (most cloud-infrastructure controls); it says nothing about whether your organization meets it.
Disputed: our two analysts disagreed and the lower strength was kept.
This is AutoGovern's analysis, not an official CSA or AIUC crosswalk. Researched on 2026-10-16.
Whose IDs, whose words
Control and requirement IDs belong to the Cloud Security Alliance (AICM) and the Artificial Intelligence Underwriting Company (AIUC-1). Descriptions and mappings are AutoGovern's own; read the official standard for the requirement text.
Official pages: CSA AI Controls Matrix (AICM) v1.1 · AIUC-1 · the AIUC-1 standard
Two analysts mapped every item independently to the anchor controls; on disagreement the lower strength and the union of anchor controls were kept, and the item is marked disputed. This is AutoGovern's analysis, not an official CSA or AIUC crosswalk. "Not covered" means our AI-governance anchor controls do not address the item (most cloud-infrastructure controls). It does not mean an organization fails it.