Baseline Security for Every AI System

These are the baseline security controls every AI system should implement regardless of model type, modality, or architecture. They represent foundational safeguards that reduce common vulnerabilities before layering on model-specific or architecture-specific risk-mitigation measures.

Security controls keep your AI system from becoming an easy target. They act as the first line of defense, reducing the likelihood that weaknesses in infrastructure, data handling, or operational processes can be leveraged before an attacker even touches the model itself.

The practices in this section cover secure design, development, deployment, operation, and retirement of AI models, drawing on proven guidance and best practices from the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), NIST, and the United Kingdom’s National Cyber Security Centre (NCSC), among others.

While rooted in cybersecurity, software development, and data security best practices, these controls have been adapted to AI systems’ broader attack surfaces, including data integrity, model misuse, system tampering, insider misuse, and exposure of sensitive information. They ensure that your organization establishes a strong baseline before deploying or integrating AI capability.

Cross–AI Lifecycle Presence of Baseline Security Controls

Many baseline security controls appear across multiple phases of the AI lifecycle—intentionally. AI security is cumulative: A weakness in an earlier phase (e.g., data governance during Design) can undermine strong safeguards later (e.g., strict access controls during Operation).

The table below provides a quick, high-level map showing where each control family is relevant across the lifecycle phases. It helps users

• see which controls recur and therefore require persistent attention
• understand where redundancy is intentional, because different lifecycle phases require different implementations of the same security principle
• orient themselves before diving into detailed tables, which contain phase-specific implementations, examples, and subcategories.

The detailed tables in each section offer significantly more information—unique identifiers, descriptive context, implementation guidance, and risk rationale. This master table simply acts as a navigation aid, reducing cognitive load and helping users understand the structure and logic behind the more detailed controls.

Control Family	Design	Develop	Deploy	Operate	Retire
1. Model weight protection and access control	✔	✔	✔	✔	✔
2. Compute security (infrastructure and environment hardening)	✔	✔	✔	✔	✔
3. Data security, integrity, and governance	✔	✔	✔	✔	✔
4. Personnel or human talent security	✔	✔	➖	✔	✔
5. Secure development practices (software development lifecycle, code security, environment isolation)	✔	✔	✔	✔	➖
6. Input/output filtering and monitoring	➖	✔	✔	✔	➖
7. Deployment safeguards (sandboxing, API hardening, attestation)	➖	➖	✔	✔	➖
8. Supply chain security and provenance	✔	✔	✔	✔	✔
9. Capability and output-aware evaluation (red teaming, safety tests)	✔	✔	✔	➖	➖
10. Risk assessment, governance and documentation	✔	✔	✔	✔	✔

✔ = control family appears in that lifecycle phase.

The following sections will detail these security controls by each AI lifecycle phase—design, develop, deploy, operate, and retire—to show how each control family (and its corresponding security controls) are implemented in practice at different stages. Some controls appear repeatedly across phases, and this repetition is intentional: The same high-level safeguards (e.g., access control) often require different implementations depending on the lifecycle stage. Use the master table to see where controls recur across the lifecycle; then, refer to the phase-specific sections for information needed to apply those controls effectively.