THE OPEN STANDARD
AISS — The Ayliea AI Security Standard
A practitioner-auditable AI security control framework. 10 domains. 56 sub-controls. Published under CC-BY-4.0 at github.com/Ayliea/aiss.
What is AISS?
AISS is an AI-specific security control framework purpose-built for organizations deploying generative, predictive, and agentic AI. It complements general-purpose security frameworks like NIST CSF and ISO 27001 with controls that address the unique threat surface of organizational AI adoption — shadow AI, prompt injection, RAG-store poisoning, synthetic content provenance, agentic-action authorization, model supply chain, and more.
Each of the 56 sub-controls cites its authoritative source — NIST AI 600-1, OWASP LLM Top 10, MITRE ATLAS, EU AI Act, and others — so practitioners and auditors can trace every requirement back to a published standard. The full JSON spec, per-domain narratives, framework crosswalks, methodology, and governance documents live in a single public repository licensed under CC-BY-4.0.
STRUCTURE
10 Control Domains
Each domain breaks down into sub-controls with explicit requirements, assessment questions, implementation guidance, evidence requirements, and crosswalks to peer frameworks.
INTEROPERABILITY
Crosswalked to 9 Peer Frameworks
AISS does not replace your existing frameworks — it integrates with them. Every sub-control maps to its peer references in published standards.
Per-framework reverse-mapping documents: browse the /crosswalks directory →
THE MOAT
Why publish the standard openly?
Most compliance scoring is opaque because opacity is where vendor pricing leverage lives. AISS takes the opposite position by design — and structurally, VC-funded competitors cannot follow.
Reproducible scoring
Anyone with this document and your answers can recompute your score — no proprietary algorithm, no vendor magic.
Auditor-grade transparency
Auditors can verify every sub-control's source citation, weight, and rubric against the published spec.
Community-governed
Practitioners, researchers, and regulators can propose changes via a public RFC process. Decisions are recorded in writing.
Crosswalked, not duplicated
AISS maps to 9 peer frameworks so your AISS findings translate directly to whatever standard your auditor cares about.
How AISS is governed
The standard evolves through a public, written process. Anyone — practitioner, auditor, researcher, vendor, regulator — can propose changes.
RFC process
File a Request for Comment for new controls, control changes, crosswalk additions, or methodology changes. Errata and clarifications follow a lighter-weight path. Every accepted RFC is recorded in writing under /rfcs.
Open discussion
Open-ended questions, interpretation discussions, and community show-and-tell happen on GitHub Discussions. Security issues in the standard itself are reported privately — see SECURITY.md.
Run an AISS assessment
Ayliea's assessment platform is a reference implementation of AISS. Take a full assessment, see your score with transparent math, and receive AI-personalized remediation guidance — or fork the standard and build your own.