Supply Chain Integrity

Production model and container artifacts shall have verified provenance/integrity—proven by signature, attestation, or digest verification with unverified pulls blocked, not by digest pins in Dockerfiles alone.

Artifact

Signature / attestation / provenance / checksum verification config (cosign, Notation, SLSA, OCI, or equivalent); Digest or signature verification logs for production model/container pulls in the sample window; Proof unverified pulls are blocked (admission policy, registry policy, or deploy gate; measuredAt ≤90 days)

Pass condition

Provenance/integrity verification is configured for production model and/or container artifacts (signature, attestation, OCI provenance, and/or checksum/ digest); 100% of production model/container pulls in the sample window verify against expected digest or signature; unverified pulls are blocked (measuredAt ≤90 days). If no production model or container artifacts are pulled, score NOT_APPLICABLE.

Production external AI tools, MCP servers, agent plugins, and high-impact integrations shall be inventoried with version pins, named owners, and recurring review—proven by an inventory covering those surfaces with 0 unpinned “latest”/floating entries, not by CI Action SHA pins or package lockfiles alone.

Artifact

Inventory of production external AI tools, MCP servers, agent plugins, and high-impact integrations with version pins, owners, review dates ≤180 days, and 0 unpinned latest/floating entries (measuredAt ≤90 days)

Pass condition

100% of production external AI tools, MCP servers, agent plugins, and high-impact integrations have version pin + owner + review date ≤180 days; 0 unpinned “latest” (or floating) entries in production (inventory evidence measuredAt ≤90 days). If none of those surfaces exist in production, score NOT_APPLICABLE.

Production AI artifacts—including language dependencies, OCI/container images, serverless packages, and model-serving runtimes—shall be scanned for vulnerabilities before promotion, with organization-defined critical findings blocking deploy unless waived with owner and expiry—not by scanning app deps while skipping inference servers or CUDA stacks.

Artifact

Vulnerability scanner config + promote-path critical block (org policy) + retained scan results with 100% coverage and 0 skipped scans for production AI artifacts (measuredAt ≤90 days); critical waivers with owner + expiry ≤14 days

Pass condition

100% of production AI artifacts in the sample window (language dependencies, OCI/container images, serverless packages, and model-serving runtimes including inference servers and accelerator libraries in scope) were vulnerability-scanned with no skipped scans; findings that are critical per organizational policy block promotion unless waived with named owner and expiry ≤14 days; scan results are retained (evidence measuredAt ≤90 days). If no production AI artifacts are built or deployed, score NOT_APPLICABLE.

Production deployment policy shall enforce blocking of unsigned, unapproved, and revoked-signature AI artifacts on the deploy path—proven by policy plus deny/verification logs, not by signing in CI or digest pins alone. Applies via Kubernetes admission, pipeline gates, cloud deploy policies, artifact registry rules, or AI-platform promote gates—not Kubernetes-only.

Artifact

Deployment policy configuration (admission, pipeline, cloud deploy policy, registry, or AI-platform gate) + deny/verification logs for unsigned, unapproved, and revoked/untrusted signatures (measuredAt ≤90 days)

Pass condition

Production deployment policy is enforced on AI artifact deploy/promote paths; unsigned artifacts are blocked; unapproved artifacts are blocked; revoked or untrusted signatures are rejected; deployment or admission deny/ verification logs prove enforcement (measuredAt ≤90 days). If no production AI artifacts are deployed (models/containers/serverless AI packages), score NOT_APPLICABLE. Required from capability Level 5 (advanced mandatory)—not a Tier 2/Core baseline.

Production model and container (or equivalent AI package) deploys should verify signatures or attestations at deploy/promote time and reject unsigned artifacts—proven by the last successful verified deploy plus a recorded unsigned-reject test or canary, not by CI signing or digest pins alone.

Artifact

Verify-on-deploy / promote-path policy + last production deploy verification log (signature/attestation success) + recorded unsigned-reject test/canary/deny log (measuredAt ≤90 days)

Pass condition

The last production model/container (or equivalent AI package) deploy verified a signature or attestation successfully; an unsigned artifact is rejected in a recorded test, canary, or deny log within 90 days (evidence measuredAt ≤90 days). If no production model/container AI artifacts are deployed, score NOT_APPLICABLE.

Each production model pin should have a machine-readable MBOM (or SBOM plus model-specific metadata) retained ≥90 days and linked from the model registry—proven by registry linkage and retained artifacts, not by a container-image SBOM that omits model weights and serving components.

Artifact

Machine-readable MBOM (preferred) or SBOM + model-specific metadata per production model pin; registry links; retention ≥90 days; coverage export (measuredAt ≤90 days)

Pass condition

100% of production model pins have a machine-readable MBOM (or SBOM plus model-specific metadata covering weights/adapters/tokenizers and serving stack as applicable) retained ≥90 days and linked from the model registry entry (coverage evidence measuredAt ≤90 days). If no production model pins exist, score NOT_APPLICABLE.