⚡ Quick Summary
Published by National Cyber Security Centre, this guidance sets out 15 principles for securing machine-learning systems across their full life cycle: secure design, development, deployment, operation and end of life. It is intended for developers, engineers, decision makers and risk owners working on systems with an ML component. The document treats security as a core requirement throughout the life cycle, alongside established cyber security, risk-management and incident-response practice. It is designed around a generic ML workflow and says its approach is agnostic to data type, model algorithm and deployment environment.
Each principle sets out its goals, why it matters and possible implementation approaches. The guidance addresses ML-specific threats including evasion, poisoning and privacy attacks, as well as model extraction, model inversion, prompt injection, data drift and availability attacks. It recommends practices such as threat modelling using the confidentiality, integrity and availability triad; red-teaming mindsets; supply-chain verification; model and dataset version control; Model Cards, Data Cards and ML-BOMs; role-based access control; monitoring; and vulnerability disclosure. It explicitly says that the principles are neither a comprehensive assurance framework nor a checklist, and do not specifically cover reinforcement learning.
🧩 What’s Covered
The document follows the ML system life cycle in five parts, followed by a consolidated reference list.
- Secure design: Establishes security awareness, cross-disciplinary working and lifecycle security reviews. It defines evasion, poisoning and privacy attacks, then calls for high-level threat modelling using the CIA triad, consideration of wider-system failure effects, measured disclosure of model information, and security evaluation through red teaming and automated testing.
- Secure development: Addresses trusted data, models, labels, software and infrastructure. It recommends assessing suppliers and external dependencies, generating a Machine Learning Bill of Materials, restricting untrusted data, applying least privilege and logging, and considering data-protection obligations.
- Models and datasets: Sets out lifecycle management through version control, change review and rollback. It recommends separate, machine-readable metadata for models and datasets, using Model Cards and Data Cards, secure hashes or digital signatures, defined retention and destruction methods, and named asset owners.
- Model selection: Connects security to performance, capacity and interpretability. It advises comparing architecture types, assessing pre-trained models and MLaaS supply-chain risks, reviewing dataset quality, and considering pruning; it also illustrates the relationship between interpretability and predictive power.
- Secure deployment and operation: Covers limiting unnecessary output detail, role- or attribute-based access controls, secure defaults, anomaly criteria, retained audit logs and throttling. For continual learning, it calls for tracked, validated updates, MLOps monitoring, checkpoints, rollback, input filtering, out-of-distribution detection and privacy-preserving data techniques.
- End of life and references: Covers secure destruction or archiving of models, data and logs, plus reviewing and sharing lessons learned. The final section collates the external resources cited, including NCSC, CISA, NIST, MITRE ATLAS and technical-tool references.
💡 Why it matters?
The guidance helps organisations treat an ML model as a component of a wider system rather than as an isolated technical artefact. This supports teams in considering how compromises of confidentiality, integrity or availability can affect datasets, downstream processes and users, and in assigning controls across development and operations.
It is particularly practical for programmes using third-party data, pre-trained models, MLaaS or continual learning. The document links traceable asset management, logging, access controls and incident processes to the ability to identify compromised models or datasets, investigate suspicious querying, and roll back problematic updates.
❓ What’s Missing
The document deliberately does not provide a checklist or a comprehensive assurance framework for grading a system or workflow. It leaves control selection, monitoring criteria, security requirements and testing frequency to each organisation's use case, threat profile and risk appetite. The guidance says that not every principle will apply directly to every organisation, and it does not prescribe a single implementation architecture or fixed assurance threshold. Reinforcement learning is expressly outside its specific scope because of differences in how RL applications are developed; the document says additional security considerations are likely to be required. It also notes limitations in existing defences and that complete security against attackers cannot be guaranteed.
👥 Best For
Best suited to ML engineers, MLOps teams, security architects, data and model owners, and risk owners designing or operating ML-enabled systems. It is especially relevant when teams need to map security activities across a model's life cycle, assess third-party models or data, establish traceability, or manage continual-learning updates and model-facing interfaces.
📄 Source Details
Machine learning principles is a 46-page English guidance document published by the National Cyber Security Centre. No individual authors, publication date or version are stated in the document. The final page carries the notice “© Crown copyright 2024” and says that text content is licensed under the Open Government Licence v3.0. The complete PDF was available for review.
