---
title: Framework & Approach | Cimbiotic
description: The five areas every Cimbiotic assessment covers, how the framework maps to NIST AI RMF and ISO/IEC 42001, and the commitments we publish.
image: https://www.cimbiotic.ai/hubfs/cimbiotic-og.png
---

[Skip to content](https://www.cimbiotic.ai/framework#main)

[Cimbiotic](https://www.cimbiotic.ai/)

Menu

[Home](https://www.cimbiotic.ai/)[AI Red Teaming](https://www.cimbiotic.ai/ai-red-teaming)[CimAssure](https://www.cimbiotic.ai/cimassure)[Pricing](https://www.cimbiotic.ai/pricing)[About](https://www.cimbiotic.ai/about)[Insights](https://www.cimbiotic.ai/insights) [Free Scorecard](https://www.cimbiotic.ai/scorecard)

---

Framework & approach

# What we test, and how

This framework is what we apply today, to associations, through CimAssure: the Baseline that starts every engagement and the regular testing that follows. Criteria for certifying vendors are separate and not yet published.

Beyond the chat window

## Assistants and agents we test

### Assistants that can act in a chat

Some chat assistants can do things for members: issue refunds, change account details, cancel registrations. CimAssure tests whether they can be talked into actions they should not take, and tags those tests against the OWASP Top 10 for Agentic Applications. Because these tests could trigger real actions, they run only after a Cimbiotic analyst confirms the client has authorized action testing on a test account. That confirmation is recorded on every scan.

### AI that works without a chat window

Some AI never talks to a member in a chat. It reads the member-services inbox, processes renewals or registers people for events, and acts on its own. Agent Assurance tests what that kind of agent does, not only what it says. We send test requests through the agent's real channel, such as the inbox, using Cimbiotic test members and Cimbiotic-owned addresses, and capture every reply word for word. Decoy members and documents raise a critical finding if the agent ever touches one. Each year we also review the agent's safeguards and score them against the OWASP Agentic Top 10, the NIST AI RMF and ISO 42001. See [Agent Assurance](https://www.cimbiotic.ai/pricing#agent).

This includes agents that run on their own, such as an AI that watches the member-services inbox. CimAssure plants a test email, waits for the agent's next run, then judges what happened. Every scan includes a routine check, so a quiet result is never mistaken for a pass.

Five areas

## The framework

Every CimAssure engagement, from the Baseline onward, uses the same five areas, in the same order. Most organizations score unevenly, and the pattern matters more than the total.

### 1. Inventory and visibility

What AI is running, including features switched on inside software you already pay for and tools staff or chapters adopted themselves. You cannot govern what you cannot see, so this comes first.

### 2. Human review and accountability

Who checks the work, and who answers for it. Where AI touches decisions about individual people — certification eligibility, exam scoring, awards, discipline, member scoring — whether a person decides, and whether that decision is recorded.

### 3. Member and member-company data

Which member data reaches which system, and on what terms. For trade associations, whether competitively sensitive company data is in scope — an antitrust question as much as a privacy one.

### 4. Disclosure and transparency

What you can tell members, your Board and your chapters, and whether it is written down anywhere. This is the widest gap in the sector and usually the fastest to close.

### 5. Monitoring and response

Day two. Whether anyone reviews what the tools actually did, on a schedule, recorded — and what happens when something goes wrong, decided while nothing is on fire.

Where it sits

## Mapped to recognized standards, calibrated for your sector

The framework is anchored to **NIST AI RMF** and **ISO/IEC 42001**, the recognized reference points for AI risk management and AI management systems. We map to them deliberately, so findings translate when an accreditor, a regulator or a large member company asks.

What those standards do not do is fit an organization with fifteen staff. ISO/IEC 42001 certification is enterprise-grade — slow, costly, and delivered by bodies with multi-month waiting lists and no sector fluency. It also certifies a management system rather than watching a deployment day to day.

Cimbiotic is the sector-calibrated equivalent in discipline, not a certification: the same underlying approach, scoped and priced for associations, with the continuous monitoring and public disclosure layer those standards leave out.

**How the framework is tested.** The published criteria are applied to member-facing assistants through CimAssure’s versioned test library, mapped to the OWASP Top 10 for LLM Applications and for Agentic Applications, with an AIUC-1 mapping planned for Q4 2026. Each result keeps the assistant’s exact words, and a Cimbiotic analyst decides every verdict. [What is tested, and how](https://www.cimbiotic.ai/framework#tested).

What is tested

## A versioned test library, mapped to industry standards

Each test states what it checks, the exact messages sent, plain-language pass criteria, a severity and where it came from. Editing a test creates a new version, so every past result stays traceable to exactly what was asked. Tests are mapped to the OWASP Top 10 for LLM Applications and for Agentic Applications, an AIUC-1 mapping is planned for Q4 2026, and agent safeguards are scored against the NIST AI RMF and ISO 42001.

5

risk categories tested

52

tests currently in use, all versioned

10

OWASP LLM risks mapped: tested directly where possible, vendor questions where not

2

people behind every Assurance Statement: one writes it, another approves it

See all 52 tests by risk category

| Category | The question it answers | Tests |
| --- | --- | --- |
| Policy compliance | Does the assistant follow the organization's rules, disclose that it is an AI, avoid unauthorized refunds and hand difficult cases, such as a legal threat, to a person? | 12 |
| Bias and fairness | Does the answer change unfairly when only the member's name, age or background changes? | 2 |
| Accuracy and hallucination | Does it invent facts, citations, sources or abilities, or accept false “corrections” from users? | 8 |
| Data handling | Does it leak or repeat personal information, other members' data, internal documents or its own internal settings? | 14 |
| Safety and refusal | Does it decline harmful requests, keep its hidden instructions private, ignore planted commands, resist fake claims of authority and respond with care to a member in distress? | 16 |
| Total |  | **52** |

The 52 tests include 8 for assistants that answer from an organization's own documents, 15 for assistants that can take actions, and 3 for agents that run on their own (part of Agent Assurance). The library grows as new risks are published; new tests are drafts that no scan runs until an analyst approves them.

### The OWASP Top 10 for LLM Applications

OWASP is a nonprofit whose lists are widely used in security questionnaires. Some risks cannot be seen from outside an assistant, such as how its underlying model was trained. For those, CimAssure provides questions to put to the vendor instead of claiming coverage it does not have. Each client report counts only the tests actually run in that period.

See how each OWASP LLM risk is tested

| Risk | Coverage | What CimAssure looks at |
| --- | --- | --- |
| LLM01 Prompt injection | Tested | Jailbreak-style reframing, commands planted in documents, fake claims of authority |
| LLM02 Sensitive information disclosure | Tested | Personal data, other members' details, internal documents |
| LLM03 Excessive agency | Tested | Action tests, run only with the client's authorization |
| LLM04 Supply chain | Vendor questions | Not visible from outside the assistant |
| LLM05 Data and model poisoning | Partly testable | Does it trust planted or false information? Training data is covered by vendor questions |
| LLM06 Unbounded consumption | Partly testable | A single, polite over-long request, never a flood. Rate limits and cost caps are covered by vendor questions |
| LLM07 Misinformation | Tested | Invented facts, sources, citations and abilities |
| LLM08 Hidden context exposure | Tested | Hidden instructions, internal tools and settings, other people's conversations |
| LLM09 Vector and embedding weaknesses | Partly testable | Whether its document search surfaces restricted or other members' content |
| LLM10 Improper output handling | Tested | Hidden-image data leaks, live web code, planted payment links |

### The OWASP Top 10 for Agentic Applications

Seven of the ten agentic risks are tested directly. For the other three, CimAssure provides questions to put to the vendor.

See how each agentic risk is tested

| Risk | Coverage | What CimAssure looks at |
| --- | --- | --- |
| ASI01 Agent goal hijack | Tested | Instructions hidden in emails and documents, fake system messages |
| ASI02 Tool misuse | Tested | Sending messages from the official address, repeated actions |
| ASI03 Identity and privilege abuse | Tested | Using the assistant's own access on someone else's behalf |
| ASI04 Agentic supply chain | Vendor questions | Not visible from outside the assistant |
| ASI05 Unexpected code execution | Tested | Requests to run code |
| ASI06 Memory and context poisoning | Tested | A planted rule that resurfaces in a later conversation |
| ASI07 Insecure inter-agent communication | Vendor questions | Not visible from outside the assistant |
| ASI08 Cascading failures | Vendor questions | Not visible from outside the assistant |
| ASI09 Human-agent trust exploitation | Tested | Claiming an action was done when it wasn't |
| ASI10 Rogue agents | Tested | Open-ended permission to act |

### Mapped to AIUC-1 (Q4 2026)

AIUC-1 is a standard for AI agent security, safety and reliability, published by the Artificial Intelligence Underwriting Company. It is used to certify an AI vendor's product. CimAssure does a different job: it gives the organization that bought the product ongoing evidence of how it behaves as they have set it up. We have mapped our tests and our annual controls review to AIUC-1, so you can see which of its requirements CimAssure checks.

A test checks the outcome a requirement aims at, from the outside, the way a member would. It does not show how the vendor built the safeguard.

See the AIUC-1 requirement mapping

| AIUC-1 area | Tested from the outside | Reviewed in the annual controls assessment |
| --- | --- | --- |
| Data and privacy | A003 limiting what data the agent can reach · A004 protecting confidential material · A005 no data crossing between users · A006 no leaks of personal information · A007 copyright and trademarks · A008 passwords a member shares | A001, A002 data policies · A003, A006 · A008 credentials stored safely |
| Security | B001 security testing (hidden instructions, jailbreaks) · B005 harmful or tricky requests · B006 no unauthorized actions · B009 no excessive output | B002 detecting hostile input · B004 scraping and floods · B006 · B007 who can change the agent · B008 securing where it runs |
| Safety | C003 no harmful replies · C004 staying within its job · C005 high-risk replies · C006 unsafe content in replies · C007 sending high-risk cases to a person | C001 a written list of risks · C002 testing before launch · C007 · C008 ongoing monitoring · C009 reaching a person |
| Reliability | D001 no made-up facts · D003 limits and approvals on actions | D003 |
| Accountability | E010 acceptable-use rules, enforced · E016 telling people it is an AI, including when asked to pretend to be human · E018 disclosure testing | E001 to E003 incident plans · E004 owners and change approvals · E005 data storage · E006 vendor and model checks · E008 process reviews · E009 outside access · E011 processing locations · E015 activity logs · E016 |
| Society | F001 no help with cyberattacks, such as phishing emails | — |

Some AIUC-1 requirements cover a vendor's internal engineering and paperwork, which cannot be seen from outside. For those, CimAssure asks the vendor or the client for evidence instead of claiming coverage it does not have.

Our commitments

## What to Expect from Us

### We charge for the process, never the outcome

The fee covers the work. It does not buy a passing grade, and the price does not change with the finding.

### We publish the criteria

The framework is readable before you engage us. Every pass and fail decision has to be defensible against it.

### We tell the client what we find, including failures

An assurance provider that has never reported a failure is not providing assurance. A Baseline reports what it finds to you, and a CimAssure test can end in a Red rating. Reports go to the client, not the public.

### We take no commissions or stakes from vendors

No referral fees, no equity, no revenue share, no board seats. No fee depends on the finding, and all material commercial relationships are disclosed.

### Your report is yours

Baseline reports, risk registers, CimAssure results and board summaries are confidential to the client. We do not publish them or share them with anyone you have not authorized. You decide who sees them and what to do about the findings. We do not publish a client’s findings, ratings or remediation status.

### We run on audited infrastructure

Cimbiotic runs on Render, whose platform holds a SOC 2 Type 2 report. Each client’s results stay separate: no client can see another client’s test results or data.

### We limit what the judge sees

Where an AI helps score a result, it sees only the test prompt and the assistant’s reply, never your member records or credentials. The AI provider does not train on it. If a reply contains real data, we redact it before it is judged. We keep the prompt and reply on record for audit.

### We keep test data apart from member data

Agent tests use test records and Cimbiotic test members, never your real member data. A Cimbiotic analyst confirms the authorization before any test that could trigger a real action.

Confidentiality

## What stays private, and what is public

**Private to the client:** findings, ratings, evidence (including assistant transcripts) and remediation status.

**Public:** this framework and its criteria. A client’s Trust Disclosure is public only if the client chooses to publish it, and we name a client only with written consent.

**Limits:** we may disclose confidential information where the law requires it, and where lawful we will tell the client first. The terms of each engagement are set out in its engagement agreement.

Available now

## What we offer today

### CimAssure

CimAssure is available now. Every engagement starts with a Baseline, then testing repeats on a regular schedule. The process and criteria are defined and published, and every engagement is run against them as written.

Looking ahead · not yet built

## Vendor Certification (planned)

### Planned: Vendor Certification

Vendor Certification is on our roadmap and is not offered today. It is separate from CimAssure, it will use its own product-level criteria, which have not been published, and it is the only one of our offers that results in a mark. When it launches, vendors will pay a published fee to be assessed, tested and, if they pass, issued the mark. The fee covers the process and does not change with the finding. We will keep the right to fail a product and to withdraw a mark, and we will take no commissions, equity, revenue share or board seats from any vendor we certify. A mark is a public statement by definition, and so is its status: if we withdraw a mark, that is public too.

For that scheme, Cimbiotic is aligning to **ISO/IEC 17065** as a certification scheme, which is the route by which an external body eventually vouches for our impartiality. We do not currently hold that accreditation, and we will not imply otherwise.

The criteria, scoring thresholds, assessor methodology and appeals process for Vendor Certification are being finalized and will be published before it launches. That standard excludes consultancy as an activity of a certification body. Accreditation applies to the certification scheme only.

## Related reading.

- [Where independent assurance fits in the AI governance stack](https://www.cimbiotic.ai/insights/where-independent-assurance-fits-in-the-ai-governance-stack)
- [GRC, explained for associations](https://www.cimbiotic.ai/insights/grc-explained-for-associations)
- [AI governance for associations: what boards should ask](https://www.cimbiotic.ai/insights/ai-governance-for-associations-what-boards-should-ask)

[**See all insights**](https://www.cimbiotic.ai/insights)

## See how you score against the five areas.

The free Scorecard walks the same framework in seventeen questions. No sign-up to see your result.

[Take the free Scorecard](https://www.cimbiotic.ai/scorecard)

Cimbiotic

Independent AI assurance for professional and trade associations, and the wider non-profit sector.

Humans Leading Change

#### Cimbiotic

- [CimAssure](https://www.cimbiotic.ai/cimassure)
- [Framework & approach](https://www.cimbiotic.ai/framework)
- [Pricing](https://www.cimbiotic.ai/pricing)
- [About](https://www.cimbiotic.ai/about)
- [Insights](https://www.cimbiotic.ai/insights)
- [Questions we get](https://www.cimbiotic.ai/questions)

#### Start

- [Free Trust Readiness Scorecard](https://www.cimbiotic.ai/scorecard)
- [Book a 30-minute call](https://calendly.com/rbawcum?utm_source=website&utm_medium=footer&utm_campaign=general&utm_content=footer)
- [inquiries@cimbiotic.ai](mailto:inquiries@cimbiotic.ai)

© 2026 Cimbiotic. Assurance, not a guarantee. Aligning to ISO/IEC 17065. Not currently accredited. [Privacy](https://www.cimbiotic.ai/privacy) Cookie settings

```json
{
  "@context" : "https://schema.org",
  "@type" : "WebPage",
  "description" : "Cimbiotic offers independent AI assurance for organizations, helping build trust through assessments and continuous monitoring of AI use, ensuring transparency and accountability.",
  "inLanguage" : "en-US",
  "isPartOf" : {
    "@id" : "https://www.cimbiotic.ai/#website"
  },
  "name" : "AI Trust Framework",
  "publisher" : {
    "@id" : "https://www.cimbiotic.ai/#org"
  },
  "url" : "https://www.cimbiotic.ai/framework"
}
```