# MLSecOps Practical Guide – open-source handbook for securing AI systems

> Source: <https://github.com/MHaghighian/MLSecOps>
> Published: 2026-08-14 02:33:32+00:00

Open-source MLSecOps handbook for AI security, LLM/RAG, and secure MLOps.

**MLSecOps Practical Reference Guide** is an open-source handbook for **AI security**, **machine learning security**, and **secure MLOps** across the full ML lifecycle — from data and training through deployment, runtime monitoring, SOC, and governance.

It covers **LLM security**, **RAG security**, **agentic AI**, **MCP**, **AI supply chain security**, and **DevSecOps** patterns for production AI systems. Use it as a practitioner reference — not a product manual or an official OWASP, NIST, or ISO standard.

Read online (recommended) |
|

**Source repository**[github.com/MHaghighian/MLSecOps](https://github.com/MHaghighian/MLSecOps)** Maintainer site**[mhsec.me](https://mhsec.me)** Latest release**[v1.1.3](https://github.com/MHaghighian/MLSecOps/releases/tag/v1.1.3)** Cite (DOI)**[10.5281/zenodo.21206781](https://doi.org/10.5281/zenodo.21206781)Security engineers, ML/MLOps teams, architects, and risk owners who need a **practical MLSecOps** reference aligned with OWASP AI Exchange, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, OpenSSF Secure MLOps, and CSA MAESTRO — with operational controls, evidence, and rollout guidance.

This guide **synthesizes** OWASP, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, OpenSSF Secure MLOps, and CSA MAESTRO. Its operational additions are:

**Ten lifecycle control points**— one thread from change initiation through monitoring** Explicit release decisions**— separate evidence-producing steps from blocking gates (control points 4, 7, 8) and integrity at 9— auditable output bundle per release`Evidence Pack`

— architecture cards, decision matrix, templates, playbooks[Implementation Reference](/MHaghighian/MLSecOps/blob/main/chapters-en/17-appendix-e-implementation-reference.md)

Learn more: [Chapter 1 — What this guide adds](/MHaghighian/MLSecOps/blob/main/chapters-en/01-intro.md#what-this-guide-adds-beyond-owasp-openssf-and-nist).

| Area | Chapters / focus |
|---|---|
MLSecOps & threat modeling |
Scope, risk, autonomous AI threats |
Data security & privacy |
Training data, PII, augmentation confidentiality |
AI / ML supply chain |
Model artifacts, provenance, signing |
Secure ML pipeline |
Ten control points, CI/CD gates, Evidence Pack |
LLM security & RAG |
Gateway, guardrails, prompt injection, retrieval ACL |
Agentic AI & MCP |
Tool policy, Intent Gate, scoped execution |
Runtime & SOC |
Monitoring, detection, incident response |
Governance & compliance |
Evidence, maturity roadmap, Kubernetes patterns |

Traditional DevSecOps does not fully address model artifacts, training data, LLMs, RAG, agents, or runtime AI risks.

**MLSecOps** extends existing security practices with lifecycle-specific controls, evidence generation, and AI-focused governance — without replacing your CI/CD or MLOps platform.

- Ten-point
**lifecycle control model** and release decision points methodology per release`Evidence Pack`

— architecture cards, templates, playbooks[Implementation Reference](/MHaghighian/MLSecOps/blob/main/chapters-en/17-appendix-e-implementation-reference.md)**Threat / control / tool mapping**([Ch.12](/MHaghighian/MLSecOps/blob/main/chapters-en/12-threat-control-tools-map.md))** LLM, RAG, Agent, and MCP**security ([Ch.7](/MHaghighian/MLSecOps/blob/main/chapters-en/07-llm-rag-security.md)·[Ch.8](/MHaghighian/MLSecOps/blob/main/chapters-en/08-agentic-ai-security.md))**AI supply chain** and model artifact security ([Ch.5](/MHaghighian/MLSecOps/blob/main/chapters-en/05-model-artifact-supply-chain.md))**Kubernetes** reference patterns ([Ch.16](/MHaghighian/MLSecOps/blob/main/chapters-en/16-kubernetes-deployment-reference.md))- SOC integration, governance, case studies, and maturity roadmap

Read online |
|

**Markdown**[Table of Contents](/MHaghighian/MLSecOps/blob/main/chapters-en/TABLE-OF-CONTENTS.md)·[Chapter 1](/MHaghighian/MLSecOps/blob/main/chapters-en/01-intro.md)**Role-based paths**[GETTING-STARTED.md](/MHaghighian/MLSecOps/blob/main/GETTING-STARTED.md)** Contribute**[CONTRIBUTING.md](/MHaghighian/MLSecOps/blob/main/CONTRIBUTING.md)·[Issues](https://github.com/MHaghighian/MLSecOps/issues)·[Discussions](https://github.com/MHaghighian/MLSecOps/discussions)| Role | Start here |
|---|---|
| Executive / risk |
|

[Ch.2](/MHaghighian/MLSecOps/blob/main/chapters-en/02-scope-risk-threat-model.md)→[Ch.6](/MHaghighian/MLSecOps/blob/main/chapters-en/06-pipeline.md)→[Ch.12](/MHaghighian/MLSecOps/blob/main/chapters-en/12-threat-control-tools-map.md)[Ch.6](/MHaghighian/MLSecOps/blob/main/chapters-en/06-pipeline.md)→[Ch.5](/MHaghighian/MLSecOps/blob/main/chapters-en/05-model-artifact-supply-chain.md)[Ch.7](/MHaghighian/MLSecOps/blob/main/chapters-en/07-llm-rag-security.md)→[Ch.8](/MHaghighian/MLSecOps/blob/main/chapters-en/08-agentic-ai-security.md)[Appendix E](/MHaghighian/MLSecOps/blob/main/chapters-en/17-appendix-e-implementation-reference.md)→[Ch.6](/MHaghighian/MLSecOps/blob/main/chapters-en/06-pipeline.md)Project status, roadmap, and governance: [GOVERNANCE.md](/MHaghighian/MLSecOps/blob/main/GOVERNANCE.md) · [CHANGELOG.md](/MHaghighian/MLSecOps/blob/main/CHANGELOG.md).

Executive lifecycle (detail in [Chapter 6](/MHaghighian/MLSecOps/blob/main/chapters-en/06-pipeline.md)):

**Coverage:** classic ML · LLM · RAG · managed AI APIs · agents · MCP · Shadow AI · supply chain · runtime · SOC · governance · Kubernetes patterns.

**Latest release:** **v1.1.3** · [Zenodo DOI](https://doi.org/10.5281/zenodo.21206781)

| Format | Link |
|---|---|
Documentation site |
|

**Markdown**`chapters-en/`

in this repository**Source (ZIP)**[v1.1.3 archive](https://github.com/MHaghighian/MLSecOps/archive/refs/tags/v1.1.3.zip)All releases: [GitHub Releases](https://github.com/MHaghighian/MLSecOps/releases). Pre-built PDF/DOCX are **not** published with releases; build Word locally if you need a printable copy (below).

Generate the printable Word edition from the markdown sources:

```
pip install -r scripts/requirements-docx.txt
python scripts/build-docx.py --render-mermaid
```

**Output:** `dist/MLSecOps-Practical-Reference-Guide-v{version}.docx`

(version read from [CITATION.cff](/MHaghighian/MLSecOps/blob/main/CITATION.cff)). Export PDF from Word (or Pandoc) if needed.

| Option | Purpose |
|---|---|
`--render-mermaid` |
Render missing diagram PNGs from `assets/diagrams/source/*.mmd` (uses system Chrome or Edge) |
`--reference path/to/file.docx` |
Override the Word style template |
`--output path/to/file.docx` |
Custom output path |
`--skip-validate` |
Skip post-build content checks |

The build uses **Pandoc** with the project Word template (`scripts/templates/reference.docx`

, or auto-download from the [v1.0.0 Release DOCX](https://github.com/MHaghighian/MLSecOps/releases/download/v1.0.0/MLSecOps-Practical-Reference-Guide-v1.0.0.docx) on first run). Template details: [scripts/templates/README.md](/MHaghighian/MLSecOps/blob/main/scripts/templates/README.md). Maintainer checklist: [RELEASING.md](/MHaghighian/MLSecOps/blob/main/RELEASING.md).

| Question | Answer |
|---|---|
What is MLSecOps? |
Security practices for the ML/AI lifecycle — extending DevSecOps with model, data, LLM, RAG, agent, and runtime controls. |
Is this an official OWASP or NIST document? |
No. It references those frameworks but is an independent open-source guide (CC BY-SA 4.0). |
Where should I start reading? |
|

**How do I cite this work?**[Zenodo DOI](https://doi.org/10.5281/zenodo.21206781)or[CITATION.cff](/MHaghighian/MLSecOps/blob/main/CITATION.cff).

```
MLSecOps/
├── chapters-en/          # Guide chapters (English)
├── assets/diagrams/      # Diagram PNGs and Mermaid source (.mmd)
├── scripts/              # DOCX build (build-docx.py, mermaid_to_png.py)
├── dist/                 # Local DOCX output (gitignored)
├── GETTING-STARTED.md    # Role-based reading paths
├── CITATION.cff          # Citation metadata (DOI)
├── CHANGELOG.md
└── .github/workflows/    # Pages deploy, releases
```

We welcome review from practitioners.

**Bug or typo:**[Open an issue](https://github.com/MHaghighian/MLSecOps/issues)** Suggestion / discussion:**[GitHub Discussions](https://github.com/MHaghighian/MLSecOps/discussions)** Pull request:**see[CONTRIBUTING.md](/MHaghighian/MLSecOps/blob/main/CONTRIBUTING.md)

If you review the guide and agree to be listed, we can add your name under **Community reviewers** (with your permission only).

**Share this project:** linking from LinkedIn, blog posts, OWASP community threads, Dev.to, or internal security wikis helps others discover the guide and improves search visibility for `MLSecOps`

and `MLSecOps Practical Reference Guide`

.

See [CITATION.cff](/MHaghighian/MLSecOps/blob/main/CITATION.cff) for machine-readable metadata.

```
Haghighian, M. (2026). MLSecOps Practical Reference Guide (v1.1.3).
Zenodo. https://doi.org/10.5281/zenodo.21206781
```

- OWASP AI Exchange (
[https://owaspai.org/](https://owaspai.org/)) - OWASP LLM Top 10 (2025)
- OWASP ML Top 10 (draft)
- OWASP Agentic / MCP
- MITRE ATLAS
- NIST AI RMF
- ISO/IEC 42001 · ISO/IEC 23894
- EU AI Act
- OpenSSF MLSecOps Whitepaper
- CSA MAESTRO
- CSA AARM —
[AARM Alignment](/MHaghighian/MLSecOps/blob/main/references/AARM-ALIGNMENT.md)(agentic runtime; complementary mapping)

|

[LICENSE](/MHaghighian/MLSecOps/blob/main/LICENSE)[SECURITY.md](/MHaghighian/MLSecOps/blob/main/SECURITY.md)[CODE_OF_CONDUCT.md](/MHaghighian/MLSecOps/blob/main/CODE_OF_CONDUCT.md)Questions: [Issues](https://github.com/MHaghighian/MLSecOps/issues) · [Discussions](https://github.com/MHaghighian/MLSecOps/discussions).