Confidential

Securing Large Language Model 

Development and Deployment 

Navigating the Complexities of LLM Secure Development Practices to Align with the NIST

Secure Development Framework 
 

Confidential

Prepare the Organization

Threat Modeling & Risk Management for LLMs 

LLMs need an updated threat model 

○ Threat Actors 

○ Asset Protection 

○ Dual Use Foundation Model Risks 

○ Frontier Model Risks 

Develop risk mitigation, technical controls, testing, and training for 

every identified group and projects in the LLM lifecycle. Educate 

the organization. 2
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Confidential

Protect the Software 

LLM Assets 

Lorem ipsum dolor sit amet, 3 

4 

1 

2 

Model Weights 

Model weights are the result of LLM 

training and steep computational 

investments. 

Algorithms 

Training requires code that instructs 

infrastructure how to do it. Training Data 

consectetur adipiscing elit.

Foundation models increasingly leverage 

licensed data or have some form of

proprietary treatment. 

Compute Duis sit amet odio vel purus 

bibendum luctus. Morbi Compute is expensive and limited in the 

supply chain. Organizations can’t just iaculis dapibus tristique. In invest in more. hac habitasse platea 

dictumst. Mauris convallis 

quam at. Morbi iaculis 

dapibus tristique. 

3
 

 

Confidential

Prepare the Organization

Threat Model & Risk Considerations 

1. Data Privacy and Confidentiality 

2. Model Integrity and Security 

3. Adversarial Attacks 

4. Misuse of the Model 

5. Regulatory Compliance 

6. Dependency on External Data Sources 

7. Scalability and Performance Security 

8. Insider Threats 

9. Intellectual Property Protection 

10.Disinformation and Information Integrity 

4
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Confidential

Lorem 1 Lorem 2 Lorem 3

o m

Protect the Software 

LLM Development Secure Practices 

Data Security Model Training Model Integrity Model Testing 

● Secure data sourcing Lorem ipsum dolor sit amet, ● Secure environments L re ipsum dolor sit amet, Lorem ipsum dolor sit amet, ● Integrity of parameters ● Evaluations 

● Secure data handling consectetur adipiscing elit.

● Anonymization and Duis sit amet odio vel purus

privacy concerns bibendum luctus. Morbi

iaculis dapibus tristique. In 

hac habitasse platea 

dictumst. Mauris convallis 

quam at. Morbi iaculis 

dapibus tristique. 

● Strong access consectetur adipiscing elit. ● Unauthorized consectetur adipiscing elit. ● Monitored misuse 

controls Duis sit amet odio vel purus Duis sit amet odio vel purus modification prevention ● Red teaming

● Mitigation of bibendum luctus. Morbi bibendum luctus. Morbi 

documented risks iaculis dapibus tristique. In iaculis dapibus tristique. In 

and threats hac habitasse platea hac habitasse platea 

dictumst. Mauris convallis dictumst. Mauris convallis 

quam at. Morbi iaculis quam at. Morbi iaculis 

dapibus tristique. dapibus tristique. 

5
 

 

 

Confidential

Protect the Software 

LLM Dual Use & Frontier Models Safety and Testing 

1. Robust Safety Models 

2. Identifying Unknown Risks 

3. Collaboration with External Parties 

4. Documented Secure Processes for 

known and unknown Risks 

5. Tested Secure Processes 

6
 

 

Confidential

Produce Well-Secured Software 

Unique LLM Deployment Security Practices 

1. Industry Leading Cloud Security 

a. Defense in Depth 

b. Monitoring / Alerting / Incident Management 

c. Vulnerability Management & Response 

d. Security aligned with Risks 

2. LLM Specific Practices 

a. Increased Security Controls around LLM Assets 

b. Content Detection & Moderation 

c. Model Behavior Monitoring 

d. Procedures for ensuring Safety 

7
 

 

Confidential

Respond to Vulnerabilities

Continued Threat Modeling & Risk Management for LLMs 

LLMs present unique risks and will require continued threat modeling and 

evolving risk management. This process doesn’t end at deployment of 

the models. 

8