Artifacts: Version-Controlled Work Products & Deliverables
An artifact is any tangible, version-controlled work product created, modified, or consumed during the engineering process. This includes code, test scripts, architecture decision records, risk management files, and automated compliance logs. In regulated software, artifacts are not optional paperwork—they serve as the primary legal evidence that safety, security, and quality controls were actively followed.
Artifacts as Immutable Evidence
In deterministic and regulated engineering, an artifact is any version-controlled work product that records decisions, defines system specifications, contains executable code, or provides automated test proof. Artifacts serve as both the inputs and outputs of activities, creating an unbroken chain of custody across the software lifecycle.
1. Specification Artifacts
User Needs, Software Requirements Specifications (SRS), and interface contracts defining "what" the system must do.
2. Engineering Artifacts
Source code, Infrastructure as Code (IaC) templates, Dockerfiles, and Architecture Decision Records (ADRs).
3. Verification Artifacts
Automated unit and integration test reports, SAST/DAST security scans, and code review audit records.
4. Governance Artifacts
Design History Files (DHF), Traceability Matrices (RTM), Risk Management Plans (ISO 14971), and SBOMs.
Artifact Input / Output Traceability Flow
Every activity consumes upstream artifacts and produces downstream artifacts, ensuring complete audit traceability:
| Activity | Input Artifacts | Output Artifacts | Compliance Value |
|---|---|---|---|
| Requirements Elicitation | User Needs, Clinical Workflows | Software Requirements Specification (SRS) | ISO 13485 Cl. 7.3.3 (Design Input) |
| Threat Modeling | Architecture Diagram, Data Flow Maps | STRIDE Threat Model Report & Mitigations | ISO 27001 A.8.25 (Secure SDLC) |
| Automated Verification | Committed Code, Test Specs | CI Test Execution Logs, Coverage Reports | IEC 62304 Cl. 5.5 (Software Testing) |
Audit artifact input/output traceability for a medical device software release.
Community Discussion & Feedback
Attributed peer feedback and official Netspective architecture notes.