What this control covers
A controlled AI system design and development process shall be established, implemented, and continually improved.
Why it matters
Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.
How to implement
AWS
Use CodeBuild with VPC-isolated build environments and CodeArtifact for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with AWS Signer.
Azure
Use Azure DevOps Pipelines with mandatory approvals on production environments and Microsoft Defender for DevOps for secret scanning across GitHub/ADO/GitLab in one pane.
GCP
Vertex AI Model Registry with model-card metadata, Model Garden for vetted base models, and Sensitive Data Protection on training/inference inputs.
GitHub
Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.
Evidence to collect
policy_document— A signed, version-controlled policy stating leadership intent and the named owner.code_repo_scan— See the iCompaas Evidence library for the canonical source for this evidence type.ticketing_workflow— See the iCompaas Evidence library for the canonical source for this evidence type.
Policies, repository controls, and workflow evidence should demonstrate an established and controlled AI design and development process, including reviews, approvals, and continuous improvement activities. Focus: AI system design and development process.
Quick checklist
- Develop — Development Process
Related articles on this site
- NIST 800-171 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
- NIST 800-171 3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to
- NIST 800-171 3.13.3 Separate user functionality from system management functionality.
- CMMC 2.0 CM.2.061 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.