Defense · SCITT
SCITT for defense AI workflows
SCITT in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.
01 / The rule
What SCITT requires
Issuers of supply chain statements (e.g. software producers, auditors), operators of transparency services, and relying parties that verify them.
- 01Issuers sign statements as COSE_Sign1 messages about a specific artifact.
- 02Transparency services keep an append-only, non-equivocating log that cannot modify, delete or reorder entries.
- 03Transparency services publish and apply a registration policy, itself recorded on the log.
- 04Transparency services register a statement before releasing its COSE receipt (RFC 9942).
- 05Relying parties and auditors verify receipts and log consistency rather than trusting the operator.
02 / In this sector
In a defense AI workflow
Any statement about an AI artifact, such as a model card, evaluation result or dataset hash, can be registered and receipted. The RFC targets software supply chains and does not address AI specifically.
Program office leads and ATO-package owners.
NIST AI RMF · DoW RAI · OMB M-25-21.
03 / Records
Records to keep
- 01Signed statements with their COSE receipts
- 02Transparency service registration policy
- 03Auditor log consistency checks
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
RFC Editor
IETF Datatracker
RELATED
Related: SCITT: the full guide · SCITT for medicine · SCITT for law · SCITT for education