5 posts tagged with “Cicd Compliance”
Auditor-ready CI/CD means producing six day-one artefacts without the pre-fieldwork scramble. What each one is, and the test of whether yours would survive.
ISO 42001 AI pipeline controls cover four Annex A lifecycle controls, and only when the pipeline builds an AI system. Using Copilot does not put you in scope.
SOC 2 CI/CD evidence already lives in your pipeline: the change-management, access, and operations records, produced continuously for CC6, CC7, and CC8.
A CI/CD audit trail an auditor can use is small, structured, and indexable. The schema to capture per change, where it already lives, and how long to keep it.
The ISO 27001 CI/CD controls auditors check, mapped to pipeline evidence: which Annex A controls a software-delivery audit touches and what proves each one.