Compliance · NIST SP 800-171 (CMMC Level 2) and NIST SP 800-53 (FedRAMP)
Does AI code review meet CMMC Level 2 separation of duties?
No. NIST SP 800-171 3.1.4 and 800-53 AC-5 require separation of duties, and 3.4.3 and CM-3 require that changes be tracked, reviewed, approved and logged with security impact analysis. An AI reviewer is not a separate duty holder and does not produce an approval by a person. PSCO provides US-persons-only reviewers, a documented approval with security review on each change, and a log of every decision.
The mapping row
| Framework | Control | What it asks | How PSCO satisfies it |
|---|---|---|---|
| NIST SP 800-53 (FedRAMP); NIST SP 800-171 (CMMC Level 2) | AC-5 Separation of duties; CM-3 Configuration change control; SA-11 Developer testing; 800-171 3.1.4, 3.4.3 | Separate duties; track, review, approve and log changes with security impact analysis | US-persons-only reviewers; documented approval with security review on each change |
Suggested control wording
Name the approver. Name the standard.
Paste this into your control description. The first sentence is the control; the second names the reviewer and the standard they review against, which is what an auditor needs to accept an outside approver.
All changes to production code require approval from a qualified reviewer who is not the author. Reviewers are PSCO Officers, background-checked US-based engineers contracted by the company, who review each change against the company’s Security & Compliance Model before approval.
All Officers are US citizens or permanent residents working from the United States, with citizenship verified and recorded. No review work is routed offshore, which matters for CUI handling under CMMC.
What a CMMC auditor samples
Build the record so it is already there.
Auditors test change management by sampling. These are the facts they look for on each sampled change, and where PSCO puts them.
- 01Separation of duties between developers and approvers (3.1.4, AC-5).
- 02Change records showing review, approval and security impact analysis (3.4.3, CM-3).
- 03Developer testing and evaluation evidence (SA-11), which the model’s required checks enforce.
- 04Personnel evidence that reviewers are US persons where CUI is in scope.
Auditor Guide
Hand your auditor the design once. Then they recommend it.
Before public launch PSCO briefed audit firms that together cover most startup and mid-market SOC 2 reports on the control design, the Officer Dossier and the Evidence Pack. The Auditor Guide is their questions, answered, for your auditor to read before the first sample.
The control design, the Officer Dossier and the Evidence Pack, written for your auditor.
A short PDF that answers the questions audit firms asked when we briefed them: who the approver is, how they are qualified, what the attestation records, and how to sample it. Enter a work email and we send the guide.
See your exact price before you talk to anyone.
Connect GitHub, pick the repos in scope, and get a quote from your real PR history in two minutes.