AI Security Baseline

How to use this document

• What it is for. This is a base standard with the minimum security controls for AI systems: governance, identity and access, data and prompts, prompt injection, agents, model supply chain, secure development, testing, logging, incidents and models hosted on the organization's own infrastructure. It supplements, and does not replace, the general information security policy.
• Who should own it. Information security, with the IT, architecture and data science teams applying the controls under the direction of each system owner. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide which deployment profiles you have (P1 to P5) and at which level you adopt the standard (Basic, Standard or Reinforced); then use "Module selection" to keep only the sections and rows that apply to you. Also decide which tools you will use for each control (secrets manager, centralized logging, filters), how long logs are kept (LOG-04) and who approves exceptions (Section 6).
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [AI COMMITTEE], [REVIEW FREQUENCY] and [COMPLETE]. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. Breach and incident notification deadlines, product cybersecurity rules and legal restrictions on models based on their origin vary: identify them in "Related regulatory references" and connect them to INC-03 and to each model's provenance sheet.
• Review. Ask IT, architecture and data science to confirm that the controls fit their platforms, and the data protection officer (or the country's equivalent role) and legal to validate the controls on personal data, retention and notification.
• Approval and publication. Have it approved by the AI lead or [AI COMMITTEE], record the approval in "Version history" and publish it for the teams that design, integrate or operate AI systems.

Module selection

Profile or level	What to keep
All	Sections 1 to 4, 6 to 8 and, within Section 5, the rows whose profile is "All" or one of yours
P1 Uses AI inside software it buys	Rows tagged P1; Sections 5.4 and 5.7 only if you also have P2 to P5
P2 Integrates models through APIs or RAG	Rows tagged P2
P3 Hosts models, including open-weight models	Rows tagged P3 and Section 5.12
P4 Trains or fine-tunes models	Rows tagged P4
P5 Uses agents that act in systems	Rows tagged P5 and Section 5.5
Basic level	Rows with no level marker
Standard level	Unmarked rows and [STANDARD LEVEL] rows
Reinforced level	All rows, including [REINFORCED LEVEL] rows

Delete the sections and rows that do not apply to your organization.

AI Security Baseline

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Standard owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Deployment profiles adopted	[COMPLETE: P1, P2, P3, P4, P5]
Level adopted	[COMPLETE: Basic, Standard or Reinforced]
Contact for questions and exceptions	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 This standard sets the minimum security controls that [ORGANIZATION NAME] applies to AI systems to protect the confidentiality, integrity and availability of models, weights, data, prompts, integrations and outputs.

1.2 It addresses AI-specific risks, such as prompt injection, data poisoning, model extraction, information leakage through outputs, excessive agent autonomy, model supply chain compromise and hidden behaviors in third-party models, in addition to traditional security risks.

2. Scope

2.1 It applies to:

a) AI features enabled in contracted applications and AI assistants for staff, to the extent the organization can configure them (P1);
b) integrations with third-party AI models or APIs, including retrieval-augmented generation (RAG) applications and their knowledge bases and vector stores (P2);
c) models hosted on owned or rented infrastructure, including open-weight models of any origin, and their inference servers (P3);
d) models trained or fine-tuned by the organization and their training infrastructure (P4);
e) AI agents that use tools or take actions in other systems (P5);
f) staff, contractors and vendors who design, integrate or operate these systems.

2.2 The rules for staff use of AI tools are in the "Responsible AI Use Policy (Including Generative AI)"; this standard applies to their technical configuration.