Getting Started¶
Quick entry points for the MLSecOps Practical Reference Guide.
Full section list: TABLE-OF-CONTENTS.md.
Start here before diving into chapters. This repository is a handbook of control intent, not a shipped CI/CD product and not a certified standard. Tables and tool names are examples you adapt to your platform.
Terms in 60 seconds¶
| Term | Means | Does not mean |
|---|---|---|
| Control point (CP) 1–10 | Where evidence or a decision happens in the lifecycle (Ch.6) | A mandatory Jenkins/GitHub Actions job |
| Release decisions | CP 4, 7, 8 — policy go/no-go | Signing / config snapshot |
| Integrity checkpoint | CP 9 — blocks store/deploy if signature/attest/verify (or managed config evidence) is missing | A fourth “policy release gate” of the same type as 4/7/8 |
| Maturity Level 1 / 2 / 3 | How strong the program is (Ch.14) | ISO/EU certification |
| Evidence Pack | Auditable bundle per release (Ch.11) | A product you download from this repo |
Baseline (metrics) |
Signed reference model/metric for regression | The “minimum security baseline” MUST set (different idea) |
Canonical decision card: Release decision model.
Which framework first?¶
| You need… | Read first |
|---|---|
| Threat/control taxonomy | OWASP AI Exchange |
| When to block release + what evidence to keep | This guide (Ch.6, Appendix E) |
| Org AI risk program / CSF language | NIST AI RMF; optional gap lens: NIST IR 8596 (iprd draft — not certification) |
| Tool examples (do not install everything) | Ch.12 — pick by maturity label |
Relationship detail: Chapter 1 — Relationship to OWASP AI Exchange.
Quick Start (5 Minutes)¶
- Read Why this guide matters (Chapter 1)
- Skim What this guide adds (Chapter 1)
- Skim Attack surface matrix (Chapter 2)
- Review Lifecycle control points + Release decision model (Chapter 6)
- Open Primary Mapping (Chapter 12)
New to AI Security?¶
Recommended reading order for a first pass:
- Chapter 1 — Introduction
- Chapter 2 — Scope and threat model
- Chapter 3 — Threat landscape
- Chapter 6 — Lifecycle control model
- Chapter 7 — LLM and RAG security
- Chapter 12 — Threat, control, and tool mapping
Then branch by role using the paths below (avoid jumping straight into the middle of Ch.7/12).
Reader paths by role (5 links each)¶
| Role | Path |
|---|---|
| Architect | Ch.2 attack surface → Ch.6 release decisions → Appendix E.1 cards → E.2 matrix → Ch.12 primary map |
| AppSec / AI Security | Ch.3 threats → Ch.6 CP7 acceptance → Ch.7 LLM/RAG → Ch.10 SOC → Ch.12 tools |
| ML / MLOps | Ch.6 control points → Ch.5 supply chain → Ch.4 data/privacy → Ch.9 anti-patterns → E.4 Evidence Pack |
| Platform / SRE | Ch.16 K8s → Ch.6 → Ch.10 → E.7.3 self-hosted → Ch.5 signing |
| GRC / Compliance | Ch.11 Evidence Pack → Ch.14 maturity → Ch.15 glossary → Cyber AI Profile map → Appendix D managed AI |
By goal¶
| Goal | Path |
|---|---|
| Executive overview | Ch. 1 → 2 → 14 |
| Threat understanding | Ch. 3 → 2 → 13 |
| Implement lifecycle controls | Ch. 6 → 12 → 15 checklists |
| LLM / RAG / Agent | Ch. 7 → 8 → 9 · AARM alignment |
| Managed AI API only | Ch. 2 managed AI → 7 → Appendix D |
| Shadow AI / governance | Ch. 2 → 11 → 13 Samsung case |
| MCP security | Ch. 7 MCP → 8 → 12 → 13 MCP lab |
| SOC / operations | Ch. 10 → 11 |
| Kubernetes | Ch. 16 |
| Production rollout | Appendix E → Ch. 6 → Ch. 12 |
Minimum security baselines (do not mix Levels)¶
From Release decision model:
- Level 1 (foundational): Documented decisions at CP 4 and 8; CP 7 runs every release and is recorded (not yet required to block); CP 9 integrity evidence is mandatory (signature or managed-API config snapshot).
- Level 2+ / production: CP 4, 7, and 8 are blocking on every release/CT cycle (unless a formal audited exception); CP 9 still blocks store/deploy when integrity evidence is missing.
- Evidence Pack per release (template + filled sample: Appendix E.4).
- Runtime telemetry to SOC with privacy-aware prompt/response handling (Chapters 10 and 4).
- Architecture card matching your stack (Appendix E.1).
Maturity detail: Chapter 14.
Pipelines: Sample Jenkins/control-plane labs (if any) live outside the published guide tree—use Chapters 6 and 12 for control intent, not as drop-in workflows.
Formats¶
| Format | Location |
|---|---|
| Markdown (source) | chapters-en/*.md in this repo |
| Documentation site | mhaghighian.github.io/MLSecOps |
| Maintainer site | mhsec.me |
| Word (optional) | Build locally: python scripts/build-docx.py --render-mermaid |
Give feedback¶
Help improve the guide: open an issue or start a discussion.