AID-M-005: AI Secure Configuration Baselines & Release Gates
Define, version, review, and validate secure configuration baselines for AI infrastructure, containers, development environments, MLOps pipelines, agent runtimes, and AI service settings. Convert approved templates and applicable vendor or industry requirements into signed policy-as-code, measurable posture criteria, and build or release gates.
Scope boundary
Owns design-time secure configuration baseline authoring and build or validation-time conformance criteria for AI infrastructure, containers, development environments, pipelines, runtimes, and services. Runtime posture observation belongs to Detect, while deployment and runtime enforcement belong to Harden.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.001 AI Supply Chain Compromise: AI Software
- AML.T0010.004 AI Supply Chain Compromise: Container Registry
- AML.T0011 User Execution
- AML.T0011.001 User Execution: Malicious Package
- AML.T0055 Unsecured Credentials
- AML.T0081 Modify AI Agent Configuration
- AML.T0083 Credentials from AI Agent Configuration
MAESTRO
- Compromised Container Images (L4)
- Orchestration Attacks (L4)
- Infrastructure-as-Code (IaC) Manipulation (L4)
OWASP LLM Top 10 2026
- N/A
OWASP ML Top 10 2023
- ML05:2023 Model Theft
- ML06:2023 AI Supply Chain Attacks
OWASP Top 10 for Agentic Applications 2026
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
NIST Adversarial Machine Learning 2025
- NISTAML.039 Compromising connected resources
- NISTAML.051 Model Poisoning (Supply Chain)
Cisco Integrated AI Security and Safety Framework
- AITech-14.1 Unauthorized Access
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- MST: Model Source Tampering
- MXF: Model Exfiltration
- MDT: Model Deployment Tampering
- IIC: Insecure Integrated Component
Databricks AI Security Framework 3.0
- Governance 4.1: Lack of traceability and transparency of model assets
- Algorithms 5.4: Malicious libraries
- Model 7.3: ML Supply chain vulnerabilities
- Model 7.4: Source code control attack
- Operations 11.1: Lack of MLOps - repeatable enforced standards
- Platform 12.1: Lack of vulnerability management
- Platform 12.5: Poor security in the software development lifecycle
- Agents - Tools MCP Server 13.20: Insecure Server Configuration