Deploying AI systems securely
Voluntary guidance. This report is not legislation and does not bind a private law firm unless a contract or a lawful direction makes it mandatory. It is aimed at organisations that deploy an AI system themselves, not a firm that only uses a vendor’s shared chatbot.
Joint best practices for organisations that deploy and operate an AI system someone else designed, on premises or in a private cloud.
MaintainedLast reviewed
Key facts
- Issued by
- NSA, CISA, FBI, ASD’s ACSC, and partner cyber centres
- Sources listed
- 2
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
Deploying AI systems securely was published on cyber.gov.au on 16 April 2024. It was written by the US National Security Agency’s Artificial Intelligence Security Center, CISA, the FBI, ASD’s ACSC, and the Canadian, New Zealand and UK cyber centres. It expands the secure-deployment and secure-operation sections of the Guidelines for secure AI system development, and it incorporates considerations from Engaging with artificial intelligence.
The report’s stated goals are to improve the confidentiality, integrity and availability of AI systems, to see that known cybersecurity vulnerabilities in those systems are mitigated, and to provide ways to protect, detect and respond to malicious activity against the systems and related data and services.
Who it applies to
The report says it is for organisations deploying and operating AI systems that another entity designed and developed. It says the best practices are most applicable to deployment on premises or in a private cloud, especially in high-threat, high-value environments.
It then says the practices are not applicable for organisations who are not deploying AI systems themselves and are instead using AI systems deployed by others. A law firm that only uses a vendor’s multi-tenant chatbot is in that second group. The paper for that firm is Engaging with artificial intelligence, not this one. A firm that installs a vendor model inside its own tenant, or on its own servers, is closer to the audience of this report. The report also says not every practice will fit every environment, and that mitigations should be adapted to the use and the threat.
What it asks of a law firm using AI
- Secure the existing IT environment before deployment: governance, architecture and configuration. The report says the person accountable for the AI system’s cybersecurity should be the same person accountable for the organisation’s cybersecurity generally.
- Know the risk tolerance of the environment that will host the system, document threats and impacts, and require a threat model from the primary developer.
- Protect the boundary between the IT environment and the AI system. Protect proprietary data used for training or fine-tuning. For data from third parties, consider contractual stipulations.
- Harden the environment: sandbox models where appropriate, monitor the network, patch hardware and software, encrypt sensitive AI information at rest, use current TLS for data in transit, and use phishing-resistant multi-factor authentication.
- The report says AI security is changing quickly. Organisations will need to update systems as weaknesses are found, as well as applying ordinary IT practice.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | The report is about keeping a deployed system confidential, intact and available. It does not test whether the model’s legal output is right. Hallucinations are dealt with in Engaging with artificial intelligence. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | For a system the firm deploys itself, the report is a list of questions for the deployment team and the contract: threat model, boundary, data sources, encryption, authentication, and who is accountable. For a system the vendor deploys, do not cite this report as if it were the firm’s checklist. |
| Confidentiality Whether client and other confidential information can go into the tool. | Confidentiality, integrity and availability of the AI system are the report’s first goal. That is system security. It is not the solicitor’s duty, and it does not decide which documents may be uploaded. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Not set here. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | The report distinguishes on-premises, cloud and hybrid infrastructure, and it discusses protecting data sources and encrypting model weights, outputs and logs. It does not set an Australian hosting rule. |
Sources
Checked 2026-10-10. Issued by NSA, CISA, FBI, ASD’s ACSC, and partner cyber centres.