Skip to main content
Implement security measures for AI system deployment environments including encryption, access controls and authorization
Keywords
Model EnvironmentEncryptionAccess Controls
Application
Mandatory
Frequency
Every 12 months
Type
Preventative
Capabilities
Universal
Crosswalks

Control activities

Typical evidence

Should include?

Enforcing caller authentication across API endpoints and agentic interfaces. For example, applying scoped API tokens or signed requests for model API access; enforcing OAuth 2.0 or OIDC token validation with appropriate scoping for MCP server connections; implementing mutual authentication for agent-to-agent interfaces.

B008.1 Config: API and agentic interface authentication

Configuration or code showing caller authentication controls - may include scoped API token or signed request configuration for model API endpoints, OAuth token scoping or OIDC validation middleware for MCP server connections, or mutual authentication configuration for agent-to-agent interfaces (e.g. A2A protocol authentication config).

Typical location
Engineering Code
Capabilities
Universal

Securing data in transit across model API endpoints and agentic interfaces. For example, enforcing TLS for all model API endpoint traffic, MCP server connections, and agent-to-agent communication channels; implementing credential rotation policies for long-lived service connections.

B008.2 Config: API and agentic interface transport security

Configuration or code showing transport security controls - may include TLS/HTTPS certificate configuration for model API endpoints, MCP server traffic, or agent-to-agent connections, or credential rotation policy documentation for service-level MCP or A2A connections.

Typical location
Engineering Code
Capabilities
Universal
May include?

Verifying model integrity before and during deployment. For example, using cryptographic checksums or signed artifacts to detect tampering, scanning model files for malicious payloads.

B008.5 Config: Model integrity verification

Deployment pipeline or code implementing model integrity checks - may include cryptographic checksum verification, model artifact signature validation, hash comparison before deployment, model scanning configuration detecting malicious payloads (e.g. Pickle, ONNX) using tools like Cisco’s pickle-fuzzer, Trail of Bit’s Fickling, or deployment logs recording model version hashes.

Typical location
Engineering Code
Capabilities
Universal

Enforcing data integrity across agentic interfaces. For example, implementing cryptographic message signing for agent-to-agent communication; applying schema validation and input sanitization to MCP tool call inputs and outputs.

B008.3 Config: Agentic interface data integrity

Configuration or code showing data integrity controls for agentic interfaces - may include cryptographic message signing configuration for agent-to-agent interfaces (e.g. signed agent cards), or schema validation configuration applied to MCP tool call inputs and outputs.

Typical location
Engineering Code
Capabilities
Universal

Securing model hosting environments. For example, using up-to-date and minimal container images, scanning for known vulnerabilities in dependencies and base images, and applying infrastructure-level isolation techniques based on risk level (e.g. container namespaces, VM separation, or dedicated GPU access).

B008.4 Config: Model hosting security

Container configuration or infrastructure setup for model hosting - may include Dockerfile with minimal base images and up-to-date dependencies, vulnerability scanning results from Trivy or Snyk for container images, or infrastructure configuration showing isolation techniques (container namespaces, VM separation, network policies, dedicated GPU allocation).

Typical location
Engineering Code
Capabilities
Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.