Ai Software Composition Analysis (Sca)
Objective
Identify and remediate vulnerabilities in AI framework dependencies and libraries.
Control / requirement
Dependency scanning + CVE matching + automated patching.
Business impact
Vulnerable dependencies enable supply chain attacks. Estimated exposure: $500k–$5M.
Validation approach
Test ID: D4-CTL-07-VTS-001 Test Type: Automated Test Design: Scan AI project dependencies for known CVEs; measure detection and remediation tracking. Execution Steps: 1. Run SCA scan on AI codebase 2. Match dependencies against CVE database 3. Generate vulnerability report 4. Verify patch/remediation workflow Pass Criteria: critical_cves_scanned = 100%; remediation_plan_documented = True; scan_coverage >= 95% Independent Verification: Auditor runs independent SCA scan and compares results.
Expected evidence
Not separately specified in the available source.
Mapping and source
Not separately specified in the available source.
Implementation guidance
Translate the requirement into system-specific procedures, responsible roles, technical configurations and review conditions. Retain evidence showing both design and operating performance. Where the source provides no separate implementation instruction, do not infer that a single technical mechanism is sufficient.
Assessment considerations
- Confirm scope and applicability.
- Inspect control design and responsible ownership.
- Test representative operation and adverse conditions where appropriate.
- Evaluate evidence provenance, completeness and contradictory evidence.
- Record limitations and notably absent outcomes.