For Heads-of · Practitioner
LLM Security Control Checklist
Forty-two concrete controls across the ten OWASP GenAI LLM Top 10 2026 categories, with status, evidence and review tracking, plus a content-source inventory that defines the scope of any injection test.
- llm security
- owasp
- prompt injection
- controls
- adversarial testing
Why this tool exists
Turn the OWASP category list into something a team can work through per system and evidence afterwards. The controls are weighted towards what actually changes outcomes, meaning what the model is authorised to do and what happens to its output, because prompt injection cannot be prevented and the achievable goal is bounding the consequence.
How it's used
Used when assessing an LLM-based system before deployment, when preparing evidence for an audit or a supervisory question, or when a security function needs to establish what it does and does not currently cover. The Content Sources sheet is used on its own to scope an adversarial test, since it enumerates every channel that can reach the model's context.
What you get
Seven sheets. A system register, a content-source inventory, 42 controls mapped to the ten 2026 OWASP categories with status and evidence fields, an adversarial test log keyed to model and prompt version, a calculated dashboard, and a reference sheet recording what moved between the 2025 and 2026 lists.
The sheet worth starting with
Content Sources. It lists everything that can reach the model's context: uploaded documents, retrieved pages, email bodies, calendar entries, database fields, file metadata, tool responses. That inventory is the scope of an injection test. Most teams test the chat box and stop, and the chat box is the least dangerous entrance.
Why the controls are weighted the way they are
There is no syntactic boundary between instructions and data in a language model context, so every prompt-level defence is probabilistic. OWASP's 2026 revision made the same point: Excessive Agency rose from LLM06 to LLM03, its largest upward move, while prompt injection held LLM01. The attack did not change. What it reaches did.
Version currency
OWASP published the GenAI LLM Top 10 2026 on 4 August 2026, and the category names and numbering here follow that release. Confirm against the published document before citing a specific code in a regulatory submission.
What completing it does not mean
It makes the gaps visible. It does not make a system secure, and it is not a certification.
Further reading
See the companion article, Prompt Injection and System Prompt Hardening, the security pillar, and the prompt injection glossary entry.
Available formats
Downloads route through a short-lived signed link.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM03 | Excessive Agency |
| OWASP Top 10 for LLM Applications | LLM01 | Prompt Injection |