AI Security at GovRAMP: What We're Learning and Recommending

Artificial intelligence (AI) is becoming part of the cloud products government agencies already use. As these capabilities expand, agencies and service providers need a clear understanding of how AI works within their environments, how it handles data, and how it affects existing security practices.

AI does not always arrive as a standalone product. It may be introduced through a software update, embedded in an existing cloud service, or delivered through a third-party model operating behind the scenes. Even when the underlying product remains familiar, these capabilities can introduce new data flows, dependencies, and security considerations. 

To help address these questions, GovRAMP launched its AI Security Task Force to bring together perspectives from the public and private sectors. The Task Force is developing practical guidance for AI-enabled cloud products, building established security standards, including NIST SP 800-53 Rev. 5 and the NIST AI Risk Management Framework.

Through the Task Force, GovRAMP is examining how established security practices can be applied to AI-enabled cloud products and where additional considerations may be needed. This work focuses on understanding AI functionality, protecting data, clarifying responsibilities, and evaluating how changes in AI technology may affect security over time.

Build on Proven Security Foundations

AI introduces new security considerations, but many of the underlying security principles remain the same.

Government agencies and service providers still need to understand who can access information, how data is protected, what actions a system is permitted to perform, and how changes are identified and managed. These fundamentals remain important regardless of the technology supporting a cloud service.

For this reason, GovRAMP’s approach builds established security standards rather than treating AI as an entirely separate security discipline. NIST SP 800-53 Rev. 5 and the NIST AI Risk Management Framework provide a foundation for evaluating existing security practices and identifying where AI introduces additional considerations.

This approach allows organizations to develop security processes they already understand while examining the specific characteristics of AI-enabled functionality. The objective is not to start over with every new capability, but to determine what has changed and whether existing safeguards adequately address the resulting risks.

Transparency Is the Starting Point

Agencies need visibility into where AI is used and how it is implemented before they can assess the related security risks.

When evaluating a cloud product, agencies should establish where AI is used, what it does, and how it fits into the broader service. Key questions include:

• Is AI currently part of the product, and which features rely on it?
• Does the service provider develop its own model or rely on an external model or AI service?
• What decisions or actions does the AI capability support?
• Where is the model hosted and operated?
• What documentation is available to explain its functionality and associated risks?

These details can be difficult to identify when AI is introduced through routine product updates. A new capability may involve an additional third party, data flow, or system component that was not part of the original security review.

GovRAMP's AI Self-Reporting Addendum is intended to improve visibility into those areas. It asks service providers to describe their AI functionality, external models and services, data practices, administrative controls, model management, known risks, and supporting documentation.

The Addendum supports initial due diligence by helping agencies understand what is present within a service. It does not replace a broader procurement or security review, nor does disclosure alone establish whether a particular AI use is appropriate. Instead, it provides information agencies can use to evaluate the capability within their own operational requirements and risk tolerance.

Follow the Data

Understanding how AI is used is only the first step. Agencies also need to understand what information the technology processes and where that information goes.

Depending on the product and use case, an AI capability may transmit information to an external model, retain data as context, or use customer information to train or improve a system. These practices vary, making it important for agencies to ask specific questions rather than assume that all AI services handle data in the same way.

GovRAMP's Asking Your Providers About AI guide encourages agencies to examine data practices early in the evaluation process. Questions should address:

• What types of information does the AI capability process?
• Is customer data used for training or tuning?
• How long is information retained?
• What protections apply to data during processing and storage?
• Can customers opt out of certain data uses?
• What processes are available to delete information when required?

The AI Self-Reporting Addendum approaches these considerations from the service provider’s perspective. It asks providers to describe the data their AI functionality processes and identify safeguards such as encryption, access control, redaction, consent management, and deletion or expungement processes.

Together, these questions help agencies assess whether data handling practices align with their security requirements and the sensitivity of the information involved. They also help identify where additional safeguards, contractual clarity, or restrictions on use may be necessary.

Control & Shared Responsibility Matter

Transparency into AI functionality and data practices must be accompanied by an understanding of the controls available to the agency. Some AI features can be disabled, restricted to specific users, or managed through individual settings. Other products may offer limited flexibility over model versions, updates, or feature configuration. Agencies should understand these options before relying on a capability in a government environment.

The level of authority granted to AI also matters. A tool that summarizes information presents different considerations from one that can execute actions, modify configurations, or influence consequential decisions. Agencies should understand what permissions the capability has, what actions it can take, and where human review is required before significant actions occur.

Logging and user transparency are important parts of this evaluation. Administrators need to understand what activity they can monitor, while users should know when they are interacting with AI functionality and what limitations may apply.

These considerations are addressed in GovRAMP's Asking Your Providers About AI guide, which examines feature activation, model versioning, rollback capabilities, and administrative controls.

Responsibility for these safeguards may be distributed across several parties. An agency may manage user access and configuration, a cloud service provider may operate the surrounding environment, and a third-party model provider may manage another component involved in processing information.

Clear ownership helps prevent gaps in protection caused by assumptions about who is responsible for a particular control. Agencies and service providers should establish which party manages each relevant safeguard, what visibility each party has, and how responsibilities are addressed when information moves between systems.

AI Security Has to Evolve with the Technology

AI-enabled products will continue to change. Providers may introduce new features, update models, modify integrations, or expand how existing capabilities are used. Each change has the potential to affect the assumptions behind an earlier security decision.

For example, a feature initially used to summarize information may later be incorporated into a workflow that influences decisions or initiates actions. The underlying product may be unchanged, but the way the AI capability is used—and the risks associated with it—may be significantly different.

GovRAMP's provider guidance encourages agencies to raise AI-related questions early and revisit them throughout the relationship with a service provider. A security review during procurement is an important checkpoint, but it should not be the only time AI security is considered.

This does not mean every model update or new feature requires a complete reassessment. Instead, agencies need enough visibility into product changes to determine when additional review is warranted. Changes to data handling, permissions, functionality, external dependencies, or intended use may warrant closer examination.

Establishing clear communication with service providers can help agencies identify these changes and respond appropriately. Ongoing evaluation allows security decisions to reflect the environment as it exists today, rather than relying solely on the conditions documented during the initial review.

Looking Ahead

AI will continue to introduce new capabilities into the cloud products government agencies rely on. Managing the associated risks requires more than understanding the technology itself. Agencies and service providers need to know how AI is used, what information it processes, which controls are available, and who is responsible for protecting each part of the environment.

GovRAMP's work through the AI Security Task Force is focused on helping organizations address these questions using established security foundations and practical guidance. By improving transparency, clarifying responsibilities, and recognizing when changes warrant additional review, organizations can make more informed decisions about AI-enabled cloud services.

As the technology evolves, GovRAMP will continue working with public- and private-sector members to advance practical approaches to AI security. The objective is to help agencies and service providers ask better questions, evaluate risk with greater clarity, and maintain security practices that adapt to changing technology.

Learn more about the GovRAMP AI Security Task Force and explore its latest resources.