CLUSIF has published an AI-specific Information Security Policy (PSSI) model: the text structures end-to-end security from design to maintenance, aligns practices with the EU AI Act (bans & accuracy/robustness/cyber requirements), and leans on international standards (NIST AI RMF, MITRE ATLAS). Three structuring pillars:
Cybersecurity of AI system development (supply chain, inventory & protection of models/data/prompts, documentation, technical debt);
Organization-contextualized AI risk management (govern / map / measure / manage);
A focus on generative AI (specific threats, code generation, SaaS usage rules by data classification and EU vs non-EU hosting).
Key takeaways:
Treat models, datasets, prompts, and logs as sensitive assets (traceability, backups, shared hashes/signatures).
Secure exposure: APIs/CI-CD, environment separation, update control, incident procedures & offline backups.
For GenAI: guardrails on code generation (forbid crypto/IAM/sensitive modules), clear SaaS usage rules(C0→C3, EU vs non-EU).
Our view to move from PDF to action: secure access, make running systems observable, and control what leaves.
Secure the interfaces (AI APIs).
Inference endpoints are the first attack surface. We lock them like a front door: mTLS mutually authenticates client and server via certificates to prevent call spoofing; rate limiting and per-project quotas contain abuse and brute force; a circuit breaker trips on error spikes or redirect loops. At ingress, an anti-prompt-injection filter normalizes and cleans requests (size, characters/URLs, forbidden instructions) to prevent model subversion.Make the system readable and repairable.
Without visibility, there’s no fast remediation. An ML-SBOM—your inventory of AI components—lists models, versions, libraries, and reference datasets so you know what to fix, where, and with which dependencies. Model cards and data cards act as identity sheets (purpose, metrics, limits, known bias, provenance), making decisions explainable, auditable, and speeding up fixes.Trace generated content.
As AI produces text, images, or audio, traceability becomes strategic. Watermarking and provenance (e.g., via C2PA) help identify generated artifacts, avoid confusion with legitimate content, and substantiate the creation chain where compliance or mis/dis-information controls require it.Measure what matters.
A program only improves if it’s measured. Start with a few headline metrics: data/response drift to spot deviation, red-team coverage for AI (jailbreak, exfiltration) to validate robustness, and MTTD/MTTR for AI to track detection and remediation speed. A regular cadence turns metrics into action and documents progress.
Finally, act in 30 days with five practical steps
Map your AI: who uses what, with which data, where logs live.
Protect API access: enable mTLS, rate limiting, quotas, and the circuit breaker.
Make it traceable: publish model/data cards and a minimal ML-SBOM.
Filter inputs: enforce anti-prompt-injection controls (normalization, blocklists, size limits).
Measure: track three metrics (drift, AI MTTD/MTTR, API error rate) and schedule a targeted AI red-team test.
In short
Move from PDF to practice. The CLUSIF model lays the foundations; you set it in motion: lock down your APIs like closing the workshop at night, make every component traceable at a glance, document models and data in clear cards, sign what the AI produces, then take the pulse of drift week after week. The result is a setup legible to leadership, workable for teams, and truly resilient against attacks.
Sources: CLUSIF.
