Open-source MLSecOps handbook for AI security, LLM/RAG, and secure MLOps.
MLSecOps Practical Reference Guide is an open-source handbook for AI security, machine learning security, and secure MLOps across the full ML lifecycle — from data and training through deployment, runtime monitoring, SOC, and governance.
It covers LLM security, RAG security, agentic AI, MCP, AI supply chain security, and DevSecOps patterns for production AI systems. Use it as a practitioner reference — not a product manual or an official OWASP, NIST, or ISO standard.
Read online (recommended) | |
Source repositorygithub.com/MHaghighian/MLSecOps** Maintainer site**mhsec.me** Latest release**v1.1.3** Cite (DOI)**10.5281/zenodo.21206781Security engineers, ML/MLOps teams, architects, and risk owners who need a practical MLSecOps reference aligned with OWASP AI Exchange, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, OpenSSF Secure MLOps, and CSA MAESTRO — with operational controls, evidence, and rollout guidance.
This guide synthesizes OWASP, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, OpenSSF Secure MLOps, and CSA MAESTRO. Its operational additions are:
Ten lifecycle control points— one thread from change initiation through monitoring** Explicit release decisions**— separate evidence-producing steps from blocking gates (control points 4, 7, 8) and integrity at 9— auditable output bundle per releaseEvidence Pack
— architecture cards, decision matrix, templates, playbooksImplementation Reference
Learn more: Chapter 1 — What this guide adds.
| Area | Chapters / focus |
|---|---|
| MLSecOps & threat modeling | |
| Scope, risk, autonomous AI threats | |
| Data security & privacy | |
| Training data, PII, augmentation confidentiality | |
| AI / ML supply chain | |
| Model artifacts, provenance, signing | |
| Secure ML pipeline | |
| Ten control points, CI/CD gates, Evidence Pack | |
| LLM security & RAG | |
| Gateway, guardrails, prompt injection, retrieval ACL | |
| Agentic AI & MCP | |
| Tool policy, Intent Gate, scoped execution | |
| Runtime & SOC | |
| Monitoring, detection, incident response | |
| Governance & compliance | |
| Evidence, maturity roadmap, Kubernetes patterns |
Traditional DevSecOps does not fully address model artifacts, training data, LLMs, RAG, agents, or runtime AI risks.
MLSecOps extends existing security practices with lifecycle-specific controls, evidence generation, and AI-focused governance — without replacing your CI/CD or MLOps platform.
- Ten-point
lifecycle control model and release decision points methodology per release
Evidence Pack
— architecture cards, templates, playbooksImplementation ReferenceThreat / control / tool mapping(Ch.12)** LLM, RAG, Agent, and MCP**security (Ch.7·Ch.8)AI supply chain and model artifact security (Ch.5)Kubernetes reference patterns (Ch.16)- SOC integration, governance, case studies, and maturity roadmap
Read online | |
MarkdownTable of Contents·Chapter 1Role-based pathsGETTING-STARTED.md** Contribute**CONTRIBUTING.md·Issues·Discussions| Role | Start here | |---|---| | Executive / risk | |
Ch.2→Ch.6→Ch.12Ch.6→Ch.5Ch.7→Ch.8Appendix E→Ch.6Project status, roadmap, and governance: GOVERNANCE.md · CHANGELOG.md.
Executive lifecycle (detail in Chapter 6):
Coverage: classic ML · LLM · RAG · managed AI APIs · agents · MCP · Shadow AI · supply chain · runtime · SOC · governance · Kubernetes patterns.
Latest release: v1.1.3 · Zenodo DOI
| Format | Link |
|---|---|
| Documentation site | |
Markdownchapters-en/
in this repositorySource (ZIP)v1.1.3 archiveAll releases: GitHub Releases. Pre-built PDF/DOCX are not published with releases; build Word locally if you need a printable copy (below).
Generate the printable Word edition from the markdown sources:
pip install -r scripts/requirements-docx.txt
python scripts/build-docx.py --render-mermaid
Output: dist/MLSecOps-Practical-Reference-Guide-v{version}.docx
(version read from CITATION.cff). Export PDF from Word (or Pandoc) if needed.
| Option | Purpose |
|---|---|
--render-mermaid |
|
Render missing diagram PNGs from assets/diagrams/source/*.mmd (uses system Chrome or Edge) |
|
--reference path/to/file.docx |
|
| Override the Word style template | |
--output path/to/file.docx |
|
| Custom output path | |
--skip-validate |
|
| Skip post-build content checks |
The build uses Pandoc with the project Word template (scripts/templates/reference.docx
, or auto-download from the v1.0.0 Release DOCX on first run). Template details: scripts/templates/README.md. Maintainer checklist: RELEASING.md.
| Question | Answer |
|---|---|
| What is MLSecOps? | |
| Security practices for the ML/AI lifecycle — extending DevSecOps with model, data, LLM, RAG, agent, and runtime controls. | |
| Is this an official OWASP or NIST document? | |
| No. It references those frameworks but is an independent open-source guide (CC BY-SA 4.0). | |
| Where should I start reading? | |
How do I cite this work?Zenodo DOIorCITATION.cff.
MLSecOps/
├── chapters-en/ # Guide chapters (English)
├── assets/diagrams/ # Diagram PNGs and Mermaid source (.mmd)
├── scripts/ # DOCX build (build-docx.py, mermaid_to_png.py)
├── dist/ # Local DOCX output (gitignored)
├── GETTING-STARTED.md # Role-based reading paths
├── CITATION.cff # Citation metadata (DOI)
├── CHANGELOG.md
└── .github/workflows/ # Pages deploy, releases
We welcome review from practitioners.
Bug or typo:Open an issue** Suggestion / discussion:GitHub Discussions Pull request:**seeCONTRIBUTING.md
If you review the guide and agree to be listed, we can add your name under Community reviewers (with your permission only).
Share this project: linking from LinkedIn, blog posts, OWASP community threads, Dev.to, or internal security wikis helps others discover the guide and improves search visibility for MLSecOps
and MLSecOps Practical Reference Guide
.
See CITATION.cff for machine-readable metadata.
Haghighian, M. (2026). MLSecOps Practical Reference Guide (v1.1.3).
Zenodo. https://doi.org/10.5281/zenodo.21206781
- OWASP AI Exchange ( https://owaspai.org/) - OWASP LLM Top 10 (2025)
- OWASP ML Top 10 (draft)
- OWASP Agentic / MCP
- MITRE ATLAS
- NIST AI RMF
- ISO/IEC 42001 · ISO/IEC 23894
- EU AI Act
- OpenSSF MLSecOps Whitepaper
- CSA MAESTRO
- CSA AARM — AARM Alignment(agentic runtime; complementary mapping)
|
LICENSESECURITY.mdCODE_OF_CONDUCT.mdQuestions: Issues · Discussions.