Baseline Security Controls: Design

• Algorithms contain the logic, components, and methods that shape system behavior and represent the intellectual property that give your system its competitive edge.
• Compute provides necessary processing power and may handle sensitive workloads.
• Data drive system behavior and may contain sensitive information.
• Human talent includes all privileged operators whose accesses and decisions directly influence system security.

Regardless of whether a system classifies images, interprets audio, predicts anomalies, or generates text, its security risks follow a similar lifecycle to text-based models and benefit from the same foundational controls.

Algorithms

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Cryptographic protection and confidential computing	A.CPCC-1	Use cryptographic keys to create a secure enclave for data during processing	Confidential computing helps ensure that data and model processing occur in a secure enclave, reducing the potential for unauthorized access and extraction of sensitive information.
	A.CPCC-3	Use secret key managers and encryption to protect API keys from unauthorized access	Protecting API keys with secret key managers and encryption helps ensure that authentication mechanisms are not compromised, reduces the likelihood of misconfigurations that could expose keys, and strengthens the supply chain by safeguarding critical components.
Data storage and access protection	A.DSAP-1	Encrypt data and implement access controls to prevent unauthorized access and theft	Encrypting data and implementing access controls helps ensure that only authorized entities can access sensitive data and models, mitigating the risk of unauthorized access, theft, and manipulation.
Network security and isolation	A.NSI-1	Segment networks to isolate sensitive infrastructure	Network segmentation helps reduce the likelihood of unauthorized access to sensitive infrastructure and limits exposure to sensitive information disclosure, model inversion, membership inference, and model skewing by isolating critical components.
Package security	A.PS-2	Use secure repositories that enforce strict security measures and vet packages	Using secure repositories helps ensure that only vetted and secure packages are used, preventing compromised components from entering the development pipeline.

Compute

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Access control and authorization	CC.ACA-1	Implement role-based access control (RBAC) to restrict data access based on user roles	RBAC helps ensure that only authorized users can access specific data and functionalities based on their roles, reducing the likelihood of unauthorized access and misuse.
	CC.ACA-2	Enable multifactor authentication (MFA) for all cloud data access	MFA helps ensure that even if authentication credentials are compromised, unauthorized access to cloud data is significantly reduced, thereby protecting against broken authentication and supply chain vulnerabilities.
Data protection and confidential computing	CC.DPCC-2	Store sensitive data in secure cloud environments with controlled access	Storing sensitive data in secure cloud environments with controlled access reduces the likelihood of unauthorized access and manipulation, ensuring sensitive information is protected and lowering the risk of data extraction and model skewing.
Network security and isolation	CC.NSI-1	Implement firewalls, intrusion detection system and intrusion protection system (IDS/IPS), and network segmentation in cloud-based training environments	Firewalls, IDS/IPS, and network segmentation help reduce the risk of unauthorized access, monitor and limit malicious traffic, and support proper configuration to protect against resource exhaustion, sensitive flow access, and supply chain attacks.
Continuous security monitoring	CC.CSM-1	Implement continuous security monitoring and protection for all cloud systems and networks	Continuous security monitoring helps detect configuration issues, abnormal activity, and potential component compromise across the AI system.
Training environment security	CC.TES-1	Harden training systems and environments to reduce attack surfaces	Hardened cloud training systems and environments reduce the risk of unauthorized access and manipulation, helping maintain the integrity and security of training data and components.

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Access control and authorization	COP.ACA-2	Implement RBAC to restrict model training initiation and modification to authorized users	Limiting who can initiate or modify model training helps ensure that only authorized users perform these actions, reducing the risk of unauthorized access or malicious modifications.
	COP.ACA-3	Limit entry to areas with sensitive data to authorized personnel only	Restricting physical access reduces the likelihood of unauthorized personnel directly accessing sensitive data, models, and systems, thereby mitigating risks of theft, tampering, and extraction.
Data integrity and backup systems	COP.DIBS-1	Implement an immutable backup storage system to ensure that all objects, especially log data, are unchangeable	Having backup systems helps ensure that log data and other objects remain unchanged, lowering the risk of unauthorized modifications that could lead to data poisoning, model skewing, or misconfigurations.
Data protection and confidential computing	COP.DPCC-2	Store sensitive data in secure environments with controlled access	Controls that protect sensitive data help reduce the likelihood of unauthorized access or extraction, decreasing the risk of information disclosure or manipulation.
Network security and isolation	COP.NSI-1	Deploy a firewall to scan and validate all requests and responses for attack signatures	The firewall scans and validates requests and responses to detect and block attack signatures, reducing the risk of unauthorized access, resource abuse, and malicious inputs.
Physical infrastructure security	COP.PIS-1	Implement badge and biometric systems, guards, and surveillance to control access	Restricting physical access to authorized personnel helps reduce the risk of theft, tampering, or side‑channel attacks on AI infrastructure.
	COP.PIS-2	Use closed‑circuit television (CCTV) and access logging with 90‑day retention to monitor access to compute facilities	Physical security controls help ensure that all entry and exit events are traceable and auditable for incident investigations and compliance.
	COP.PIS-3	Enforce secure storage, chain‑of‑custody tracking, and destruction for decommissioned hardware	Properly securing hardware reduces the likelihood of unauthorized recovery of sensitive data or model weights from discarded or relocated equipment.

Data

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Access control and authorization	D.ACA-1	Restrict access to sensitive data based on security clearance levels	Access controls help ensure that only authorized personnel with appropriate security clearance can access sensitive data and helps reduce the likelihood of unauthorized access and potential misuse.
Continuous security monitoring	D.CSM-1	Continuously monitor systems for unauthorized access or anomalies involving sensitive data	Monitoring enables detection and response to unauthorized access or anomalies helps reduce the risk of unauthorized data access, sensitive information disclosure, and model manipulation.
Cryptographic protection and encryption	D.CPE-2	Encrypt all sensitive data used or generated by AI-enabled applications	Encrypting sensitive data helps reduce the likelihood of unauthorized access and disclosure, ensuring data confidentiality and integrity and mitigating risks of sensitive information being extracted or inferred from AI models.
Data collection and minimization	D.DCM-2	Implement checks to ensure collection of only valid and authorized data	Data collection controls reduce the risk of unauthorized access or manipulation, lowering exposure to data poisoning attacks.
Data storage security and access control	D.DSSAC-1	Encrypt stored data and implement access controls to protect information at rest	Encrypting stored data and implementing access controls reduces the likelihood of unauthorized access and extraction of sensitive information, ensuring data integrity and confidentiality.
Data transmission security	D.DTS-1	Encrypt data in transit between AI models, APIs, and applications	Encrypting data in transit helps protect sensitive information from interception and unauthorized access, reducing the risk of disclosure and manipulation.
Third-party security	D.TPS-1	Rigorously vet data vendors and validate model outputs against trusted sources for poisoning	Vetting helps ensure that data vendors are trustworthy and model outputs are validated, reducing the likelihood of poisoning and supply chain attacks by improving detection and limiting exposure to compromised inputs.

Human Talent

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Access control and authorization	HT.ACA-1	Grant access to sensitive data only as needed, based on least privilege	Restricting access to sensitive data to those who need it helps reduce the likelihood of unauthorized access and potential data leaks.
	HT.ACA-2	Require MFA for physical access to critical areas	Adding authentication or verification steps helps reduce the risk of badge cloning or credential theft.
Access control and secure configuration training	HT.ACSCT-1	Implement access control configuration training, security awareness training, and role-based security training per applicable security standards	Training personnel responsible for implementing proper access control, authorization, and security configurations and ensuring compliance with standards (e.g., Cybersecurity Maturity Model Certification [CMMC] 2.0, NIST SP 800‑171) helps improve adherence to secure practices and reduces the risk of misconfigurations or improper access.
Cloud and infrastructure security	HT.CIS-1	Grant cloud access only to necessary users with minimum required permissions	Limiting cloud access to authorized users reduces the likelihood of unauthorized access and potential misuse or theft of AI models and data.
Physical security and access management	HT.PSAM-1	Restrict access to sensitive data based on security clearance levels	Allowing only personnel with the appropriate security clearance to access sensitive data helps reduce the likelihood of unauthorized access and potential misuse.
Role-based access	HT.RBA-1	Implement RBAC to restrict model training initiation and modification to authorized users	Allowing only authorized personnel to initiate or modify model training helps reduce the risk of unauthorized access or malicious modifications.
Security training and awareness programs	HT.STAP-1	Train employees and contractors on facility security policies and incident reporting	Ensuring that personnel understand access protocols helps reduce the likelihood of insider threats or accidental security breaches.
	HT.STAP-2	Train employees to identify and respond to social engineering attacks	Training employees to recognize social engineering attacks helps reduce the risk of manipulation attempts and unauthorized access to sensitive information.
	HT.STAP-3	Conduct regular security awareness, education, and training sessions for all employees	Ensuring that employees are aware of security best practices helps reduce the risk of misconfigurations, supply chain vulnerabilities, overreliance on AI systems, and inadvertent disclosure of sensitive information.
	HT.STAP-4	Train users to avoid inputting sensitive information and follow best practices for secure system interaction	Training users to avoid inputting sensitive information and to follow secure interaction practices helps reduce the likelihood of prompt injection, sensitive information disclosure, and input manipulation attacks by limiting exploitable inputs.