Bottom line: an AI-enabled application can inherit risk from the model and its development lifecycle even when the surrounding application follows conventional secure-development practices. Treat model data, code, weights, evaluations, packaging, release, integration, monitoring, and retirement as governed production assets.
\nNIST SP 800-218A is a community profile that augments the practices and tasks in SSDF version 1.1 with AI-model-specific practices, tasks, recommendations, considerations, notes, and references. NIST identifies producers of AI models, producers of systems that use those models, and acquirers of those systems as intended audiences. The profile is designed to be used together with SP 800-218, not as a replacement for it.
\nThe publication’s scope is generative AI and dual-use foundation model development across the software development lifecycle. That supports widening normal software-assurance work to include model-specific assets and processes.
\nThe profile does not certify a model, declare an AI system safe, or guarantee that an evaluation predicts every production behavior. It does not eliminate the need for use-case risk assessment, privacy review, security architecture, human oversight, supplier diligence, or incident response.
\nIt also does not establish that every AI feature warrants the same controls. Applicability depends on whether the organization develops a model, fine-tunes one, retrieves data for one, integrates an external service, or only consumes a bounded feature—and on what decisions or actions the system can influence.
\nThe following steps are DSE recommendations based on the cited source.
\nSelect one production AI feature and trace its model and application versions, data and dependency records, evaluation results, approvals, deployment record, permission tests, monitoring, known limitations, and rollback rehearsal. Record gaps as owned work rather than converting uncertainty into a claim of assurance.
\n