57% of APPI you already have
OWASP Top 10 for LLM Applications 2025 already covers about 57% of APPI, leaving
9 of 21 controls as genuinely new work.
Already covered 3
Likely covered 9
New work 9
What is genuinely new work
Nothing in OWASP Top 10 for LLM Applications 2025 reaches these. This is the list to scope.
APPI-01Scope and Definitions
APPI-02Lawful Basis and Purpose Specification
APPI-03Notice at Acquisition
APPI-05Data Accuracy and Retention
APPI-08Supervision of Trustees
APPI-10Records of Third Party Provision
APPI-11Cross-Border Transfer Rules
APPI-14Cessation of Use and Provision
APPI-20Complaint Handling
Show the 12 you already have
APPI-06Security Control Measures
APPI-07Supervision of Employees
APPI-12Disclosure Request (Access)
APPI-04Special Care-Required Personal Information
APPI-09Restriction on Third Party Provision
APPI-13Correction, Addition, and Deletion
APPI-15Leakage Notification
APPI-16Anonymously Processed Information
APPI-17Pseudonymously Processed Information
APPI-18Personally Referable Information
APPI-19PPC Cooperation and Investigation
APPI-21Governance and DPO Equivalent
How this is calculated
Already covered means a mapping runs from a control in OWASP Top 10 for LLM Applications 2025 to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition