Recognises a requirement cited to the wrong article or version
The citation does not say what the requirement says, or cites a retired version.
Can AI do this?
AI does this partly Some of the tested AI models master this; others do not show it. 2 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 92% | Mastered |
| gemini-3.5-flash-lite | Low cost | 36% | Not shown |
| gpt-6-luna | Low cost | 89% | Not shown |
| claude-haiku-5-5 | Low cost | 92% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The citation and the provision in force
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: RQ-005 MFA for the cardholder data environment cited as "PCI DSS v3.2.1 Req. 8.3" Acceptable: PCI DSS v4.0.1 Req. 8.4.2
Also known as: Wrong article or superseded version
Related knobits
Builds on
- S-152 Explains which regulations cover which bank data
- S-154 Explains PCI DSS requirements on stored card data
All 17 knobits of Register regulatory security requirements.
Source: Review checklist 01-regulatory-requirements, row 4 (PCI; 27001)