G.2.1 Upper management support
Control Details
Objective
Upper management understands the business risks of insecure software and supports the resources necessary for secure software development.
Definition
An upper management (e.g., c-suite) leadership team understands the business risk of insecure software development, including AI models used and delivered, and of violating compliance and privacy obligations. The team is responsible for the entire software development process and deploying secure software to production. The commitment of this team is communicated to personnel associated with development-related roles and is backed up by the commitment to allocating adequate resources and making sometimes-difficult business decisions for security over faster release dates.
Assessment Questions
- Please describe upper management's commitment to secure software development practices involving AI models.
- In what way is this commitment publicly demonstrated and communicated to development roles and responsibilities?
- Comment on the adequacy of resources dedicated to secure software development.