Abstract

This chapter explores policies, processes, and procedures to build a robust security program tailored for GenAI models and applications. It discusses key policy elements like goals, risk management, compliance, consequences, and priority areas focused on model integrity, data privacy, resilience to attacks, and regulatory adherence. The chapter also covers specialized processes for GenAI across risk management, development cycles, and access governance. Additionally, it provides details on security procedures for access control, operations, and data management in GenAI systems. Centralized, semi-centralized, and decentralized governance structures for GenAI security are also analyzed. Helpful framework resources including MITRE ATT&CK’s ATLAS Matrix, AI vulnerability databases, the Frontier Model Forum, Cloud Security Alliance initiatives, and OWASP’s Top 10 LLM Application risks are highlighted.