Framework overlap

Does AWS Well-Architected Security Pillar cover ASEAN Guide on AI Governance and Ethics?

You hold AWS Well-Architected Security Pillar and have been told to do ASEAN Guide on AI Governance and Ethics. Here is how much overlaps, control by control.

35% of ASEAN Guide on AI Governance and Ethics you already have

AWS Well-Architected Security Pillar already covers about 35% of ASEAN Guide on AI Governance and Ethics, leaving 24 of 37 controls as genuinely new work.

Already covered 0 Likely covered 13 New work 24

No control in AWS Well-Architected Security Pillar maps directly to one in ASEAN Guide on AI Governance and Ethics. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in AWS Well-Architected Security Pillar reaches these. This is the list to scope.

AIGE-HI-1
Establish AI objectives and assess against principles and risks
AIGE-HI-3
Determine the level of human involvement
AIGE-HI-5
Mitigate automation bias and protect affected groups
AIGE-IG-2
Define roles and responsibilities for AI oversight
AIGE-IG-4
Training, awareness and capability building
AIGE-IG-5
Periodic review of the governance model
AIGE-IG-6
Apply risk-based proportionality
AIGE-OM-1
Project governance and problem statement definition
AIGE-OM-10
Third-party and vendor AI governance
AIGE-OM-2
Data quality and representativeness
AIGE-OM-3
Bias identification and mitigation
AIGE-OM-5
Model explainability
AIGE-OM-6
Repeatability and reproducibility
AIGE-OM-7
Robustness and security testing
AIGE-OM-8
Traceability and auditability
AIGE-OM-9
Deployment, monitoring and review
AIGE-P1
Transparency and Explainability
AIGE-P2
Fairness and Equity
AIGE-P4
Human-centricity
AIGE-P6
Accountability and Integrity
AIGE-SI-1
Stakeholder communication policy and AI-use disclosure
AIGE-SI-2
Feedback channels
AIGE-SI-3
Decision review and recourse channels
AIGE-SI-4
Acceptable use policies
Show the 13 you already have
AIGE-HI-2
Assess probability and severity of harm
AIGE-HI-4
Document risk impact assessments
AIGE-IG-1
Establish internal AI governance structures and oversight body
AIGE-IG-3
AI ethics policies, standards and code of conduct
AIGE-NR-1
Nurture AI talent and upskill the workforce
AIGE-NR-2
Invest in AI research and development
AIGE-NR-3
Support the AI innovation ecosystem and investment
AIGE-OM-4
Data provenance, minimisation and protection
AIGE-P3
Security and Safety
AIGE-P5
Privacy and Data Governance
AIGE-P7
Robustness and Reliability
AIGE-RR-1
Establish an ASEAN Working Group on AI Governance
AIGE-RR-2
Foster regional alignment, cooperation and interoperability

How this is calculated

Already covered means a mapping runs from a control in AWS Well-Architected Security Pillar to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition