United States of America: Opened consultation on the Secure Software Development Practices for Generative AI and Dual-Use Foundation Models (NIST SP 800-218A ipd)

On 29 April 2024, the US National Institute of Standards and Technology (NIST) opened a public consultation on the Secure Software Development Practices for Generative AI and Dual-Use Foundation Models (NIST SP 800-218A ipd) until 1 June 2024. The objective of this initiative is to enhance secure software development practices, which are specifically tailored for AI and dual-use foundation models. It builds upon the Secure Software Development Framework (SSDF) version 1.1 by incorporating specialised practices, tasks, and guidelines tailored for AI model development throughout the software lifecycle. This initiative is aligned with Executive Order 14110, which aims to ensure the safe and trustworthy development and utilisation of AI. The document serves as a resource for AI model producers, system producers, and acquirers, offering a structured approach to embedding security in the development phase. The document provides an in-depth analysis of the potential risks associated with AI systems, including the possibility of data manipulation and the complexity of managing model parameters and user interactions. The recommendations include the secure storage of code, stringent documentation of security requirements, and the establishment of roles and responsibilities that emphasise the importance of AI security.