What this control covers
Objectives for responsible AI development shall be defined, measurable where practical, and integrated into AI lifecycle governance.
Why it matters
Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.
How to implement
AWS
Use CodeBuild with VPC-isolated build environments and CodeArtifact for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with AWS Signer.
Azure
Use Azure DevOps Pipelines with mandatory approvals on production environments and Microsoft Defender for DevOps for secret scanning across GitHub/ADO/GitLab in one pane.
GCP
Vertex AI Model Registry with model-card metadata, Model Garden for vetted base models, and Sensitive Data Protection on training/inference inputs.
GitHub
Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.
On-premises
Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.
Evidence to collect
policy_document— A signed, version-controlled policy stating leadership intent and the named owner.code_repo_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Approved governance objectives should define measurable or reviewable expectations for responsible AI development. Repository and lifecycle evidence should demonstrate those objectives are embedded in development planning, review, and implementation activities. Focus: Objectives for responsible development of AI systems.
Quick checklist
- Define — Ai Systems / Governance
- Develop — Ai Systems / Governance
- Govern — Ai Systems / Governance
Related articles on this site
- S3 Lifecycle Management
- Employee Lifecycle Management
- NIST 800-171 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
- NIST 800-171 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.