Updated logo, readme

Author: robmoffat

README.md

@@ -4,9 +4,15 @@ sidebar_position: 1
 title: Agentic SDLC Risk Framework
 ---
 
+<p align="center">
+  <img src="/img/R1_logo_round_white.svg" alt="Risk First Logo" width="120" />
+</p>
+
 # Agentic Software Development Risk Framework
 
-A risk framework for **agentic AI software development** — addressing the unique threats that emerge when humans employ AI systems to help write, modify, and deploy code.
+**[agentic-software-development.riskfirst.org](https://agentic-software-development.riskfirst.org)**
+
+A risk framework for **agentic AI software development** — addressing the unique threats that emerge when AI systems autonomously write, modify, and deploy code.
 
 ## Why This Exists
 
@@ -16,25 +22,45 @@ Existing AI governance frameworks like **NIST AI RMF** and **ISO/IEC 42001** foc
 - Model lifecycle governance
 - Organizational accountability
 
-Conversely, this risk framework covers the exact use-case that AI is no longer just making decisions inside software — it is becoming the **primary producer and modifier** of software itself.   This shifts risk from *"bad AI decision"* to *"unsafe evolving codebase"* — a completely different class of risk that current frameworks don't address.
+But AI is no longer just making decisions inside software — it is becoming the **primary producer and modifier** of software itself. This shifts risk from *"bad AI decision"* to *"unsafe evolving codebase"* — a completely different class of risk that current frameworks don't address.
 
-## Risk-First
+## Part of Risk-First
 
-This framework builds on [Risk-First Software Development](https://riskfirst.org) principles and can be navigated there as HTML (which provides a more joined up experience than just looking at these markdown files).
+This framework is part of [Risk-First Software Development](https://riskfirst.org) and builds on Risk-First principles. Navigate the framework at [agentic-software-development.riskfirst.org](https://agentic-software-development.riskfirst.org) for a more joined-up experience.
+
+See also: [Societal AI Risk Framework](https://societal-ai-risk.riskfirst.org) — addressing civilisation-scale risks from advanced AI systems.
 
 ## What This Framework Covers
 
-### Threat Categories
+### Capabilities
+
+The capabilities of generative coding systems that create attack surface — Code Generation, Tool Calling, Execution, Autonomous Planning, Multi-Agent Orchestration, and more.
+
+### Risks
+
+Threats unique to or amplified by agentic software development — Code Security, Supply Chain, Autonomy & Control, Prompt Injection, Human Factors, and more.
+
+### Controls
+
+Practices and safeguards to address agentic risk.
 
-Risks unique to or amplified by agentic software development. 
+## External Framework Mappings
 
-### Control Families
+Threats in this framework are mapped to established security and AI governance standards:
 
-Controls to address agentic risk.
+| Framework | Description |
+|-----------|-------------|
+| [MITRE ATLAS](https://atlas.mitre.org/) | Adversarial Threat Landscape for AI Systems |
+| [OWASP Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Critical security risks for autonomous AI (2026) |
+| [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/) | Security risks for LLM applications (2025) |
+| [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework) | AI Risk Management Framework |
+| [NIST SSDF](https://csrc.nist.gov/Projects/ssdf) | Secure Software Development Framework |
+| [SLSA](https://slsa.dev/) | Supply-chain Levels for Software Artifacts |
+| [ISO/IEC 42001](https://www.iso.org/standard/81230.html) | AI Management System standard |
 
-### Capabilities
+## Schema & Validation
 
-The capabilities of generative coding systems that give rise to the threats.
+This framework uses schemas based on the [OpenSSF Gemara](https://gemara.openssf.org) project — a GRC Engineering Model for Automated Risk Assessment. Gemara provides a logical model for compliance activities and standardized schemas (in CUE format) for automated validation and interoperability.
 
 ## Contributing
 

docs/tags.yml

@@ -0,0 +1,13 @@
+---
+Capability:
+  description: Core capabilities that AI agents possess in software development contexts
+  label: Capability
+  permalink: Capability
+Control:
+  description: Practices and controls that mitigate risks from agentic AI in software development
+  label: Control
+  permalink: Control
+Threat:
+  description: Risks and threats arising from AI agents in software development
+  label: Threat
+  permalink: Threat

docusaurus.config.js

@@ -7,7 +7,7 @@ const config = {
   tagline: 'A Risk Framework for Agentic AI Software Development',
   favicon: 'img/favicon.ico',
 
-  url: 'https://agentic.riskfirst.org',
+  url: 'https://agentic-software-development.riskfirst.org',
   baseUrl: '/',
   trailingSlash: false,
 
@@ -47,8 +47,9 @@ const config = {
       navbar: {
         title: 'Agentic SDLC',
         logo: {
-          alt: 'Agentic SDLC Logo',
-          src: 'img/logo.svg',
+          alt: 'Risk First Logo',
+          src: 'img/R1_logo_round_white.svg',
+          srcDark: 'img/R1_logo_round_black.svg',
         },
         items: [
           { to: '/risks', label: 'Risks', position: 'left' },