--- title: "Evidence for the framework your reviewer names" canonical: https://pharosone.ai/compliance publisher: PharosOne (Agentic Mind, Inc.) updated: 2026-10-22 license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)" cite_as: "\"Evidence for the framework your reviewer names\". PharosOne, 2026-10-22. https://pharosone.ai/compliance" --- # Evidence for the framework your reviewer names > One engagement mapped to the framework your reviewer names: SOC 2 CC4.1, PCI DSS 11.4, DORA Art. 24 and 25, MiCA, ISO 27001 A.8, EU AI Act Art. 9 and 15, ISO 42001 and AIUC-1. URL: https://pharosone.ai/compliance One engagement, mapped to the clause your reviewer reads. The stack answers SOC 2, PCI DSS, DORA and ISO 27001; the agents on it answer the EU AI Act, ISO 42001 and AIUC-1. **PharosOne supplies the evidence.** Accredited auditors issue the certificates. Frameworks one engagement maps to: SOC 2, PCI DSS, DORA, MiCA, ISO 27001, EU AI Act, ISO 42001 and AIUC-1. ## Each framework asks in its own words. The SOW names the framework you face, and the report answers in its clauses. | Framework | What it asks for | What you receive | | --- | --- | --- | | SOC 2 (CC4.1) | Ongoing or separate evaluations of internal control; the points of focus name penetration testing | The pentest report with dates, scope and method, and the retest letter | | PCI DSS v4.0.1 (11.4) | External and internal penetration testing at least every 12 months and after significant changes; findings corrected and retested | A test against the cardholder data environment with a named methodology, and the retest | | DORA (Art. 24–25) | A testing programme with tests at least yearly on systems that support critical or important functions | The test inside your programme, systems mapped to those functions, findings and remediation | | MiCA (crypto-asset service providers) | Authorised CASPs fall under DORA, so the same testing programme applies | The DORA test and report, written for the CASP's supervisor | | ISO 27001:2022 (A.8.8, A.8.29) | Management of technical vulnerabilities; security testing in development and acceptance | A findings register mapped to the controls, with treatment status | | EU AI Act (Art. 9 and 15) | Testing against prior defined metrics and thresholds; resilience against attempts to alter use, outputs or performance | Adversarial test results for the agent with the metric and the date; runtime flags from Radar | | ISO/IEC 42001 | An AI management system with Annex A controls, audited every year | Findings mapped to the Annex A controls, ready for the annual audit | | AIUC-1 | Security and safety evidence for AI agents across 50 controls, with quarterly retests | Engine results for the 24 controls a behavioural test can show, quarterly retests, runtime findings by control | ## AIUC-1 splits into tests and documents. Of its 50 active controls, the engine tests 24 by behaviour; the other 26 need documents or other evidence. - **24** controls tested by the engine and the team, with the evidence attached - **26** controls closed with documents or other evidence: policies, records, the process behind the agent Accredited auditors issue the AIUC-1 certificate. PharosOne supplies the test evidence and does not issue certificates. ## Each standard runs on its own clock. Continuous testing covers the quarterly retests, and Radar keeps the runtime record between them. - **AIUC-1**: quarterly retests - **ISO 42001**: annual audit - **EU AI Act**: continuous ## Five standards in one crosswalk, before the call. - [AIUC-1](https://pharosone.ai/research/ai-standards-crosswalk#aiuc-1): A certification standard for AI agents: its active controls, quarterly retests, and which controls a test can evidence. - [ISO/IEC 42001](https://pharosone.ai/research/ai-standards-crosswalk#iso-iec-42001): An AI management system standard: the clauses a test feeds and the ones only documents can close. - [EU AI Act](https://pharosone.ai/research/ai-standards-crosswalk#eu-ai-act): The articles that call for testing and logs, with the date each obligation applies. - [NIST AI RMF](https://pharosone.ai/research/ai-standards-crosswalk#nist-ai-rmf): A voluntary framework: where measurement fits, under MEASURE 2.7. - [OWASP Agentic Top 10](https://pharosone.ai/research/ai-standards-crosswalk#owasp-agentic-top-10): The ten agentic risk classes, ASI01 to ASI10, and the seven our crosswalk maps to AIUC-1 controls. ## Questions compliance owners ask first. ### Will my auditor accept the report? It follows PTES and OWASP WSTG, states scope, dates and method, and maps each finding to the clause you face. The retest letter documents that findings were fixed: PCI DSS 11.4.4 requires that, and other frameworks expect evidence of remediation. Whether a report is accepted is your auditor’s call. ### Can one engagement cover several frameworks? Yes. The same findings map to SOC 2, PCI DSS, DORA and ISO 27001 for the stack, and to the EU AI Act, ISO 42001 and AIUC-1 for the agents. The SOW lists every framework in scope. ### Who issues the AIUC-1 certificate? Accredited auditors. PharosOne supplies the third-party test evidence for the controls a behavioural test can show and for the quarterly retests. ### Does MiCA need a separate test? No. Authorised crypto-asset service providers fall under DORA, so one DORA-ready test and report serves both. ### How often do we need to test? PCI DSS asks for every 12 months and after significant changes, DORA at least yearly, and AIUC-1 every quarter. [Continuous testing](https://pharosone.ai/knowledge/continuous-testing) keeps the quarterly rhythm. ## Bring the framework and the audit date Thirty minutes with the engineer who runs the test. The SOW names your framework and follows within three days. [Book a scoping call](https://pharosone.ai/book) · [See prices](https://pharosone.ai/pricing) - Book at least 90 days before audit fieldwork. - Bring the previous report, if there is one. - List the agents with their tools and data flows. Source: PharosOne, "Evidence for the framework your reviewer names", https://pharosone.ai/compliance, updated 2026-10-22. --- PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt