G.1.3 Produce attestation
Control Details
Objective
Produce an audit trail for every step in the build process, the integrity/provenance of training data, and evidence of the use of secure software development practices.
Definition
Configure tools to generate attestations (aka evidence) to create an audit trail for every step in the build process and of the use of secure software development practices. These attestations should indicate conformance with record retention requirements, preserve the integrity of the findings and the authenticity of the information. For AI models, generate attestations of the integrity and provenance of the training datasets. Assign responsibility for creating attestations that tools cannot generate. Attestations should be immutable and published in the source repository releases, in the package registry, or elsewhere, with their existence recorded in a transparency log.. An attestation is a signed assertion that the record is trustworthy.
Assessment Questions
- Describe your automated or manual processes for producing attestations for the build process, the integrity/provenance of training data, and for the use of secure development practices?
- Where do you publish your attestations, e.g. source repositories, package registries, transparency logs?
- What are your auditability/retention requirements for these attestations?
- How is responsibility assigned for creating needed attestations that tools cannot generate?
- What tools or frameworks (e.g. TUF, in-toto) do you use to produce authenticated attestations?
- What is your rationale for providing self-attestation for your product?
- How do you ensure that the attestations are immutable?