> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems
- URL: https://www.aigl.blog/deploying-ai-systems-securely-best-practices-for-deploying-secure-and-resilient-ai-systems/
- Published: 2026-09-19T09:15:12.000Z
- Updated: 2026-09-19T09:15:12.000Z
- Description: Joint cybersecurity information sheet from the NSA's AI Security Center, CISA, the FBI and partner agencies in Australia, Canada, New Zealand and the UK, setting out best practices for deploying and operating externally developed AI systems securely.
- Author: Jakub Szarmach
- Tags: Guidance, AI Security, Technical Controls, Security Operations, Supply Chain & Third-Party Risk, AI Governance, #aigl-library

## ⚡ Quick Summary

Published by the U.S. National Security Agency's Artificial Intelligence Security Center together with CISA, the FBI, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, the New Zealand NCSC and the UK NCSC, this joint cybersecurity information sheet gives best practices for deploying and operating AI systems securely. It expands the 'secure deployment' and 'secure operation and maintenance' sections of the *Guidelines for secure AI system development* and incorporates mitigations from *Engaging with Artificial Intelligence (AI)*.

The scope covers machine learning-based AI systems that an organisation deploys and operates but did not develop, especially on premises or in private cloud environments and in high-threat, high-value settings. Its stated goals are to improve the confidentiality, integrity and availability of AI systems, assure that known cybersecurity vulnerabilities are appropriately mitigated, and provide methodologies and controls to protect, detect and respond to malicious activity. The practices align with CISA and NIST cross-sector Cybersecurity Performance Goals, secure by design principles and Zero Trust, and are organised around securing the deployment environment, continuously protecting the AI system, and securing operation and maintenance.

## 🧩 What’s Covered

The report follows the order of a deployment lifecycle, attaching Cybersecurity Performance Goal references to individual measures.

- **Executive summary and scope**: defines 'AI systems' as machine learning-based systems, names the audiences (organisations deploying externally developed AI systems on premises or in private cloud) and states what is out of scope, namely organisations that only use AI systems deployed by others.
- **Secure the deployment environment**: governance measures such as aligning the AI system with organisational risk tolerance, defining stakeholder roles and accountability, requiring a threat model from the primary developer and building security requirements into contracts; plus architecture measures including boundary protections, two-person control and integrity for model weight access, a catalogue of trusted data sources to counter data poisoning and backdoors, and secure by design with Zero Trust.
- **Harden configurations and networks**: sandboxing models in hardened containers or virtual machines, firewall allow lists, patch management via the Common Security Advisory Framework, encryption of model weights, outputs and logs with keys held in a hardware security module, TLS in transit, phishing-resistant MFA, and a Zero Trust assumption of breach with detection, incident prioritisation and the ability to cut off access.
- **Continuously protect the AI system**: validation through cryptographic signatures and checksums, hashing and archiving each model release, version control of code and artifacts, adversarial testing, automated rollback with a human in the loop, supply chain evaluation, inspection of imported pre-trained models in a secure development zone, securing exposed APIs against prompt injection, monitoring model behaviour and hardening model weight storage.
- **Secure operation and maintenance**: role-based or preferably attribute-based access control, MFA and privileged access workstations for administrators, user awareness training, external audits and penetration testing, logging and monitoring that watches for data drift and repetitive inputs, full evaluation before version updates, immutable backups for high availability and disaster recovery, and irretrievable secure deletion at the end of a process.
- **Conclusion and closing material**: reiterates protecting model weights, preferring secure by design systems and a summary list of priority measures, followed by works cited, a disclaimer of endorsement, the document's purpose and contact channels for each authoring country.

## 💡 Why it matters?

For teams that must deploy a third-party or externally developed model, the sheet converts general AI security concern into concrete engineering and governance tasks: obtaining a supplier threat model, storing weights in a restricted zone or hardware security module, validating API inputs against prompt injection, and keeping rollback and immutable backup paths. Each measure carries a CISA and NIST Cybersecurity Performance Goal reference, so controls can be mapped onto an existing control set. Framing secure by design and Zero Trust as procurement levers helps organisations that buy models and cannot inspect or retrain them, and naming attack classes such as data poisoning, model inversion and weight exfiltration gives assessments something to test.

## ❓ What’s Missing

The guidance is written for organisations that deploy and operate AI systems they did not develop and explicitly does not apply to organisations that only use systems deployed by others. Design and development are deferred to the *Guidelines for secure AI system development*, so training-time and data-collection controls are largely absent. There is no mapping to regulatory or legal obligations, no maturity model, scoring or audit checklist, and no quantitative thresholds or test procedures. Several recommendations are conditional, using phrases such as 'as feasible' or 'if and when available', leaving scope and evidence to local judgement, and the authors note that best practices will change as the AI field and techniques evolve.

## 👥 Best For

Security architects and AI platform teams deploying externally developed models on premises or in private cloud; cyber risk and compliance staff who need recognised control references behind AI deployment decisions; and security operations and incident response teams building detection for model tampering, weight exfiltration, data poisoning and prompt injection in high-threat, high-value environments.

## 📄 Source Details

Full title: *Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems*, a joint cybersecurity information sheet marked TLP:CLEAR, reference U/OO/143395-24 | PP-24-1538, dated April 2024, Ver. 1.0, 11 pages, in English. It was authored by the U.S. National Security Agency's Artificial Intelligence Security Center, CISA, the FBI, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, the New Zealand NCSC and the UK NCSC; no individual authors are named and no URL for the document itself is printed. The extraction covered all 11 pages.