Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile
This document augments the secure software development practices and tasks defined in the Secure Software Development Framework (SSDF) version 1.1 by adding recommendations, considerations, notes, and informative references specific to generative AI and dual-use foundation model development. Developed to support Executive Order 14110, the profile provides guidance for AI model producers, AI system producers, and AI system acquirers. It covers risks across the software and AI model development life cycle, such as data poisoning, training data provenance, model weight protection, and continuous monitoring.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
This document is for AI model producers, AI system producers, and AI system acquirers seeking guidance on integrating secure software development practices into AI model and system creation.
What the document contains
The document addresses cybersecurity practices and tasks required for AI model development, including data sourcing, model design, training, fine-tuning, evaluation, and integration into broader software. It details enhancements across the four core SSDF groups: Prepare the Organization, Protect Software, Produce Well-Secured Software, and Respond to Vulnerabilities.
The document does not address general operational deployment of AI systems, broader data governance life cycles outside of cybersecurity development, or non-cybersecurity risks such as intellectual property rights and general social bias.
- The document serves as a companion resource to NIST SP 800-218 (SSDF version 1.1) to incorporate secure development practices for generative AI and dual-use foundation models.
- It targets three primary audiences: AI model producers, AI system producers, and AI system acquirers.
- The profile addresses unique AI security risks such as training data poisoning, model weight tampering, and prompt-based vulnerabilities.
- Organizations are expected to adopt a risk-based approach to customize and apply these practices rather than treating the document as a rigid checklist.
- Provenance and integrity tracking must be applied to training, testing, fine-tuning, and aligning datasets as well as model weights and configuration parameters.
· 1. Introduction · 2. Using the SSDF Community Profile · 3. SSDF Community Profile for AI Model Development · References · Appendix A. Glossary
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
3/5Clear responsibility for AI outcomes
Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC.
Table 1
screening score · 2026-10-23
Fairness
2/5Non-discrimination and equitable treatment
Analyze data for signs of data poisoning, bias, homogeneity, and tampering before using it for AI model training
Table 1
screening score · 2026-10-23
Human Dignity
0/5Respect for the inherent worth of persons
N/A
screening score · 2026-10-23
Human Oversight
2/5Humans remain in control of consequential decisions
Consider requiring review and approval from a human-in-the-loop for software security checks beyond risk-based thresholds.
Table 1
screening score · 2026-10-23
Privacy
1/5Protection of personal data and private life
There are many other types of risks to AI systems (e.g., data privacy, intellectual property, and bias) that organizations should manage
Section 2
screening score · 2026-10-23
Transparency
3/5Openness about how AI systems work and are used
Collect, safeguard, maintain, and share provenance data for all components of each software release
Table 1
screening score · 2026-10-23
Enforcement
0/5Consequences and compliance mechanisms with real force
N/A
screening score · 2026-10-23