The ongoing rapid pace models are evolving and the accelerating diffusion of such models across societies necessitates for practitioners to take a deeper look at the end to end process. To this end, here is a broader frame of reference for securing AI.
This life-cycle view brings together key resources to assist in addressing security concerns. The visual is based on work commissioned by the UK government and since adopted by European Telecommunications Standards Institute (ETSI), a European Standards Organization (ESO) under ETSI TS 104 223 [pdf].
The life-cycle view consists of five (5) phases serving as a foundation. These phases are linked to thirteen (13) principles facilitating focus on key aspects. These in turn are mapped to twenty-four (24) guidance sources to assist building deeper insights in order to direct tangible actions to achieve respective risk-reward balance.
P1 Raise awareness of AI security threats and risks
P2 Design the AI system for security as well as functionality and performance
P3 Evaluate the threats and manage the risks to the AI system
P4 Enable human responsibility for AI systems
P5 Identify, track and protect the assets
P6 Secure the infrastructure
P7 Secure the supply chain
P8 Document data, models and prompts
P9 Conduct appropriate testing and evaluation
P10 Communication and processes associated with End-users and Affected Entities
P11 Maintain regular security updates, patches and mitigations
P12 Monitor the system's behaviour
P13 Ensure proper data and model disposal
G1 ISO/IEC 27001:2022
G2 CISA Software Bill of Materials (SBOM)
G3 NIST AI Risk Management Framework - Second Draft [pdf]
G4 NIST AI 100-1 AI Risk Management Framework 1.0
G5 Australian Signals Directorate An introduction to Artificial Intelligence
G6 World Economic Forum: Presidio AI Framework: Towards Safe GenAI Models [pdf]
G7 OWASP AI Exchange
G8 MITRE ATLAS Mitigations
G9 Google Secure AI Approach Framework [pdf]
G10 ELSA European Lighthouse on Secure and Safe AI
G11 Cisco The Cisco Responsible AI Framework [pdf]
G12 Amazon AWS Cloud Adoption Framework for AI, ML, and GenAI
G13 NIST AI 100-2 E2023 Adversarial Machine Learning Taxonomy
G14 ENISA Multilayer Framework for Good Cybersecurity Practices for AI
G15 UK NCSC Guidelines for secure AI system development [pdf]
G16 German Federal Office for InfoSec AI Security Concerns in a Nutshell [pdf]
G17 Japan Foreign Affairs Office - G7 Hiroshima Summit - Code of Conduct for Orgs [pdf]
G18 US Department of Health and Human Services Trustworthy AI (TAI) Playbook [pdf]
G19 OpenAI Preparedness Framework
G20 UK ICO Guidance on the AI Auditing Framework [pdf]
G21 Nvidia NeMo-Guardrails
G22 Entity's Internal Communications Policy
G23 Entity's Internal Data Governance Policy
G24 Entity's Internal Systems Decommissioning Process
Source links validated at publication [May 2025]