Baseline Security Controls: Operate

The operate phase integrates trained model artifacts into applications and workflows for inference, enabling the system to interact with real-world data, users, and environments. Once deployed and in use, AI systems face new risks, including unauthorized access, data leakage, malicious inputs, degraded performance, and unexpected or unsafe outputs. This phase focuses on securing the model, its supporting infrastructure, and all data flows (at rest, in transit, and in use).

Key controls include

• Hardening APIs, interfaces, and integration points; network isolation; and sandboxing
• Securing user-facing interfaces and operational tools to prevent abuse, manipulation, or exploitation
• Detecting anomalous or unsafe outputs across all modalities
• Encrypting data at rest, in transit (e.g., between APIs), and in use through confidential computing technologies
• Validating, sanitizing, and constraining all inbound data and model inputs, regardless of modality.

Together, these measures help prevent misconfigurations, limit unauthorized access to models or weights, minimize the risk of leakage, and maintain integrity throughout the model’s deployment and operation.

Elements of the operate phase include

• Integration and external or customer-facing products: Integrate your model into public-facing applications for use by customers, partners, or external users, whether the AI system is the primary product or a supporting feature of your application. This includes providing API endpoints for customers, chat interfaces, upload portals, or open-source hosting repository links.
• Integration into internal operations: Many AI systems operate behind the scenes to support internal workflows. Examples include embedding models in internal dashboards or decision-support tools; using models to automate or assist with internal processes, data analysis, or laboratory operations; and deploying models trained on proprietary or sensitive data to internal user groups.

Integration and External Products

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Access control and authorization	IE.ACA-1	Implement access controls and encryption to secure API keys, credentials, and certificates	Implementing access controls and encryption for API keys, credentials, and certificates helps reduce the likelihood of unauthorized access and misuse of sensitive authentication data.
	IE.ACA-2	Assign unique API tokens to applications and restrict model access to minimum necessary privileges	Assigning unique API tokens and limiting model access to necessary privileges help reduce the risk of unauthorized access, excessive permissions, or misuse by applications.
Incident response and security operations	IE.IRSO-1	Provide clear reporting paths for harmful outputs and offer a bug bounty for jailbreaks	Providing reporting paths and bug bounty programs helps support timely identification and mitigation of such issues as prompt injection, insecure output handling, sensitive information disclosure, excessive agency, input manipulation, and output integrity risks.
	IE.IRSO-2	Monitor AI applications for unauthorized access and misuse; respond to security events	Monitoring AI applications for unauthorized access and misuse helps detect and respond to anomalous activities, reducing the likelihood of unauthorized model extraction, excessive permissions, or harmful actions.
Infrastructure security and configuration management	IE.ISCM-1	Apply hardening standards to servers, APIs, and deployment environments for integrated AI systems	Applying hardening standards to servers, APIs, and deployment environments helps reduce misconfigurations, resource abuse, and supply chain vulnerabilities.
	IE.ISCM-2	Use tools to check container configurations, dependencies, and runtime behaviors for vulnerabilities	Using tools to assess container configurations, dependencies, and runtime behaviors helps identify and mitigate vulnerabilities, reducing misconfigurations and supply chain risks.
Input validation	IE.IV-1	Implement strict input validation to filter harmful or sensitive data inputs	Strict input validation helps detect and filter harmful or sensitive data inputs, reducing the likelihood of unauthorized access, resource abuse, injection attacks, or manipulation of model outputs.
Network security and API protection	IE.NSAP-1	Protect APIs and services with firewalls, gateways, and network segmentation	Using firewalls, gateways, and network segmentation helps reduce unauthorized access, resource abuse, and misconfigurations by controlling and monitoring traffic between APIs and services.

Integration into Internal Operations

Subcategory	Identifier	Action or Control	Why the Control Is Relevant
Access control and authorization	II.ACA-1	Restrict AI model interface access to authorized users only	Restricting access to AI model interfaces to authorized users helps reduce the likelihood of unauthorized access or manipulation of AI models and APIs, supporting proper authentication and authorization mechanisms.
	II.ACA-2	Implement access controls and encryption to secure API keys, credentials, and certificates	Implementing access controls and encryption for API keys, credentials, and certificates helps reduce the risk of unauthorized access, misuse, or exposure of sensitive authentication data.
Anomaly detection	II.AD-1	Implement automated anomaly detection and block potentially malicious inbound and outbound traffic	Automated anomaly detection helps identify and block unusual or malicious traffic patterns, reducing the likelihood of resource abuse, unauthorized access, or crafted inputs designed to degrade model performance or manipulate outputs.
Data protection and privacy controls	II.DPPC-1	Encrypt data in transit between AI models, APIs, and applications	Encrypting data in transit helps protect sensitive information from interception or unauthorized access, reducing the risk of data disclosure or manipulation.
Incident response and security operations	II.IRSO-1	Monitor AI applications for unauthorized access and misuse; respond to security events	Monitoring helps detect and respond to unauthorized access or misuse, reducing the risk of unauthorized actions, model extraction attempts, or manipulation.
	II.IRSO-2	Provide clear reporting paths for harmful outputs and offer a bug bounty for jailbreaks	Providing reporting paths and bug bounty programs supports timely identification and remediation of harmful outputs, vulnerabilities, or attacks (such as prompt injection, insecure output handling, sensitive information disclosure, input manipulation, or output integrity issues).
Infrastructure security and configuration management	II.ISCM-1	Apply hardening standards to servers, APIs, and deployment environments for integrated AI systems	Applying hardening standards helps reduce misconfigurations, excessive resource use, unauthorized access, insecure plugins, and supply chain vulnerabilities within AI system infrastructure.
Network security and segmentation	II.NSS-1	Protect APIs and services with firewalls, gateways, and network segmentation	Using firewalls, gateways, and network segmentation helps reduce unauthorized access, resource abuse, and misconfigurations by isolating traffic and enforcing strict access controls, supporting secure integration into internal operations.
	II.NSS-2	Restrict LLM access to network resources, internal services, and APIs to mitigate insider threats	Restricting LLM access to internal services, APIs, and network resources helps limit autonomous interactions with sensitive systems, reducing the risk of insecure plugin behavior, unauthorized resource access, and server-side request forgery (SSRF)-related threats.
Security monitoring and logging	II.SML-1	Conduct regular monitoring and auditing of model-interface interactions to detect suspicious activities	Regular monitoring and auditing help identify unauthorized access, suspicious behavior, and potential misconfigurations, supporting the security and integrity of interactions with AI model interfaces.