Levels review C03

[ottosulin]

C03 Levels Review

Polishing pass on C03 (Model Lifecycle Management & Change Control) focused on level assignments and implementability.

Changes

C3.1.2: L1 -> L2

edit: removed; @RicoKomenda had already opened PR with same change.

C3.1.3: L1 -> L2

Rationale: Signature verification requires the same infrastructure as signing (C3.1.2). Deployment admission controllers must be integrated with verification logic, and model loading must include signature checks. Not trivial (L1). Consistent with C3.1.2 moving to L2.

C3.6.2: L3 -> L2

Rationale: Separation of duties for critical operations is a foundational control in ISO 27001 A.5.3 and a baseline expectation in SOC 2 CC8.1, not an advanced practice.

All major MLOps platforms support approval workflows natively: SageMaker Model Registry (PendingManualApproval), MLflow alias promotion gates with CI/CD approval. Fine-tuning SoD is no harder than code deployment SoD, which ASVS places at L2. The previous gap between C1.1.3 (basic approval, L1) and C3.6.2 (L3) was unjustified - ISO 27001 and SOC 2 do not grade SoD as three levels above basic approval.

[RicoKomenda]

@ottosulin you need to rebase because of the conflict, other than that, I would approve the PR!