AI Security ยท SEC-03
Security of the AI supply chain
The security of models, data, code and services obtained from others is assessed before use and managed for as long as they are in use.
Why it matters
Most organisations will use models, datasets and components they did not create, and a weakness in any of them becomes a weakness in the service. Knowing where each component came from and holding suppliers to security expectations is the only way to manage a risk the organisation does not directly control.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Models, data and components are taken from suppliers or public sources without a security check. |
| 2 Developing | Some security checks happen, usually for large procurements, but freely available models and components are not covered. |
| 3 Defined | External models, data and components are security assessed before use and reassessed over time, with security responsibilities split, documented and checked for each service from others. |
| 4 Managed | Supplier security and reassessment results are measured and reported, and overdue reassessments or unmitigated vulnerabilities are escalated. |
| 5 Optimising | Supply chain assurance is improved from incidents and supplier performance, and the organisation shares findings with peers and suppliers. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- SEC-03.1 A defined process assesses the security of every external model, data set and component before use.
- SEC-03.2 The source of each external model, data set and component is recorded.
- SEC-03.3 Security expectations are set for suppliers.
- SEC-03.4 For each AI service obtained from others, the split of security responsibilities with the provider is documented and reviewed on significant change and at set intervals.
- SEC-03.5 The organisation's share of those security responsibilities is implemented and checked.
- SEC-03.6 Organisations that receive AI from this organisation are told which security responsibilities they hold. PRV
- SEC-03.7 External models and components are reassessed at set intervals and when vulnerabilities are disclosed.
- SEC-03.8 Disclosed vulnerabilities in external models and components are tracked to mitigation.
Assessment questions
- How do you check the security of a model, dataset or component before it is used?
- Does that check apply to freely downloaded models and to AI inside bought products?
- What happens when a supplier changes a model or a weakness is found in a component?
- Responsibility split for each AI service obtained from others, with checks of the organisation's share and review dates
- The supply chain security assessment process and a sample of completed assessments
- A record of external AI components in use, with source and version
- Security clauses or schedules in AI supplier contracts
How to reach Level 3
- Define a process to assess the security of every external model, dataset and component before use, including freely downloaded ones, and record its source.
- Set security expectations for suppliers, feeding the contract terms in OPM-04.
- For each AI service from others, document the split of security responsibilities, implement and check the organisation's share, and review the split at set intervals and on significant change.
- Where the organisation provides AI to others, tell them which security responsibilities they hold.
- Reassess external models and components at set intervals and when vulnerabilities are disclosed, tracking each to mitigation.
Common pitfalls
- Checking purchased products but not open models downloaded by developers.
- Assuming the provider handles all security for a hosted service.
Starter artefacts
- External component assessment record
- Shared responsibility matrix per service
- Vulnerability tracking log
Cross-references
| AI Cyber Security Code of Practice | 2.4 direct; 2.7 direct; 3.3 partial; 5.1 partial; 5.2 partial; 6.6 partial; 7.1 direct; 7.2 partial; 8.2 partial |
|---|---|
| JSP 936 Part 1 | para 79 partial; para 113 partial; para 155 partial; para 161 partial; para 197 partial; para 201 partial; para 202 partial |
| MITRE AI Maturity Model | P5.3 partial |
| NIST AI 600-1 | R9 partial; R12 direct |
| NIST AI RMF 1.0 | GOVERN 6.1 partial; MAP 4.1 partial; MAP 4.2 partial; MANAGE 3.1 partial; MANAGE 3.2 partial |
| UK Data and AI Ethics Framework | Accountability 4 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.