> ## Documentation Index
> Fetch the complete documentation index at: https://www.botgauge.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance view

> See how BotGauge red-team results map to OWASP LLM Top 10, OWASP Agentic, MITRE ATLAS, and NIST frameworks. Item statuses, coverage, and key caveats.

The **Compliance** tab on an agent shows which requirements of well-known frameworks your results relate to, and how each one came out. Use it to see where you have test evidence and where you need other evidence.

## What it is, and what it is not

The compliance view is your red-team results organized by framework requirement. It is not a certification, an audit, or legal advice. BotGauge doesn't say you are "compliant" and doesn't give a compliance score. It uses the same results shown in your reports, and it reports coverage plainly, for example "assessed 5 of 5 applicable items (7 in the framework)".

## Frameworks

The view starts from a single run, shown at the top as **From** with the test type, when it finished, and the run name. Each framework appears as a card.

| Framework | Scope |
| - | - |
| OWASP LLM Top 10 | 2025, 7 risks mapped of 10 |
| OWASP API Top 10 | 2023, 3 risks |
| MITRE ATLAS | 6 techniques |
| NIST AI RMF | 3 risks |
| OWASP Agentic | 2026, 10 risks |
| NIST AI 600-1 | 2024, 12 risks |
| EU AI Act | Regulation 2024/1689, 9 obligations (3 are documentation duties, listed but not testable) |
| ISO/IEC 42001 | 7 Annex A controls |
| SOC 2 | 13 Trust Services criteria |
| GDPR | 3 articles (Art. 5, 22, 32) |

Each card shows how many items breached, how many are likely, how many applicable items were assessed out of the total in the framework, when it was assessed, and whether the mapping has been reviewed.

## Item statuses

A colored bar on each card uses the following legend.

| Status | Meaning |
| - | - |
| Finding | A related rule has a breach. |
| Signal | A related rule has a likely, unconfirmed breach. |
| Assessed, no finding | Related rules were tested and nothing broke. |
| Not assessed | No rule in this run maps to the item. |

**Not assessed** is a gap, not a pass. It means BotGauge had nothing to test for that item in this run.

## Open a framework

Choose a framework card to see its items. For the OWASP LLM Top 10, for example, the page shows how many risks are mapped and which aren't covered (LLM03 Supply chain, LLM04 Data and model poisoning, and LLM10 Unbounded consumption), and a table with these columns.

| Column | Meaning |
| - | - |
| Risk | The framework item, for example LLM01 Prompt injection |
| Tested with | The rules that map to it, and how many |
| Attacks | How many attacks ran against those rules |
| Result | The number of breaches, or "No breach found", with the worst example and its severity |

A risk with no related rule shows **Not tested** with "No rule in this run maps to it."

Items are mapped from your rules, standard attacks, and context channels. One breach can touch several risks. Export gives the full evidence for every control.

## Important caveats

Red teaming covers only part of each framework. Policies, documentation, governance, and human oversight processes need their own evidence.

Map results to frameworksSee how your red-team results map to OWASP, MITRE, and NIST in [BotGauge](https://cloud.botgauge.com).

[Open compliance →](https://cloud.botgauge.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.