Housing IT prepares eligibility models for production. Which control best protects model integrity before go-live?

Housing eligibility models that touch real cases need integrity controls before go-live: require model signing and verified serving paths so only approved artifacts execute in production. Signing binds a model build to a known producer and change record; verification at load or promotion time rejects tampered or substitute weights. Verified serving paths ensure models arrive through controlled registries and pipelines rather than ad-hoc copies. For eligibility determinations, integrity failures can silently alter outcomes for applicants, so cryptographic and procedural assurance is an architecture prerequisite, not a nice-to-have.

Deploying unsigned models from any USB stick left in the lobby bypasses chain of custody and invites malware or unauthorized model substitution. Allowing anyone to overwrite production weights without review removes change control and auditability. Skipping integrity checks because the filename “looks official” confuses naming convention with cryptographic assurance—attackers can rename files.

Exam caveat: integrity is about authentic approved artifacts on controlled paths; filename cosmetics and informal media are never substitutes for signing and verification.

Operational check: configure the housing serving environment to refuse unsigned models, promote only from a signed registry, log verification results, and periodically re-verify production digests against the approved bill of materials before eligibility batches run.