NIST SP 800-218A PO.2.1: Roles and responsibilities across the SDLC cover AI model development security (High)

What does PO.2.1 require?

The roles and responsibilities the organisation defines for the development life cycle include security for AI model development throughout the life cycle, taking in model development, model operations and data science at least; where AI system producers, model producers or other third parties share the work, their roles can be set out in agreements.

Maintained by Gerard Blokdyk

Other controls in Prepare the Organization (PO) – NIST SP 800-218A

PO.1.1 Security requirements for development infrastructure and processes include AI model development (High)
PO.1.2 Policies carry the AI-specific security requirements for the software the organisation builds (High)
PO.1.3 Communicate AI model development security requirements to third-party component providers (Medium)
PO.2.2 Role-based training covers AI model threats, vulnerabilities and mitigations (High)
PO.2.3 Leadership commitment to secure development involving AI models (Medium)
PO.3.1 Plan automated toolchains that secure AI model development (High)
PO.3.2 Deploy, operate and verify the AI security toolchains (High)
PO.3.3 Tools generate artefacts evidencing secure AI development, including dataset attestations (Medium)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-218A controls