[Yandex Cloud documentation](../../../index.md) > [Yandex Security Deck](../../index.md) > [Concepts](../index.md) > [Compliance UI](index.md) > Yandex Cloud security standard for AI systems

# Yandex Cloud security standard for AI systems

This standard establishes security requirements and recommendations for artificial intelligence systems deployed fully or partially in Yandex Cloud. It targets security architects, information security specialists, developers, ML and DevSecOps engineers, service owners, SOC analysts, and compliance officers.

These requirements contain automated security rules for AI systems in compliance with the Yandex Cloud AI security standard guidelines.

#|
|| Requirement ID | [Security standard](../../../security/standard-ai/all.md) requirement | Check ID in the [CSPM](../cspm.md) module ||
|| `AI-CORE5` | [System guidelines and policies must only be modified via a trusted path](../../../security/standard-ai/all.md#system-prompts-policies-changed-trusted-path) | [cspm.ai.tool-secrets](../../rules-reference/cspm.md#tool-secrets) ||
|| `AI-MCP1` | [Access to the MCP Gateway and the target service is separated](../../../security/standard-ai/all.md#mcp-gateway-target-service-access-separated)
|
[cspm.ai.public-mcp-tools](../../rules-reference/cspm.md#public-mcp-tools)
[cspm.ai.public-mcp](../../rules-reference/cspm.md#public-mcp)
||
|| `AI-TRAIN1` | [Development, training, and production environments are separated](../../../security/standard-ai/all.md#dev-training-prod-execution-separated) | [cspm.ai.datasphere-sa-privileges](../../rules-reference/cspm.md#datasphere-sa-privileges) ||
|| `AI-INFRA-ISOL3` | [Execution of code, commands, and dynamic queries is restricted](../../../security/standard-ai/all.md#code-commands-dynamic-queries-restricted) | [cspm.aws-token](../../rules-reference/cspm.md#aws-token) ||
|| `AI-IAM4` | [Yandex Cloud AI Studio call uses a documented authentication method](../../../security/standard-ai/all.md#ai-studio-call-uses-documented-auth)
|
[cspm.ai.api-key-scopes](../../rules-reference/cspm.md#api-key-scopes)
[cspm.ai.api-key-rotation](../../rules-reference/cspm.md#api-key-rotation)
||
|| `AI-IAM5` | [Effective permissions are reviewed on a schedule and following changes](../../../security/standard-ai/all.md#effective-rights-reviewed-on-schedule-and-change) | [cspm.ai.system-groups](../../rules-reference/cspm.md#system-groups) ||
|| `AI-IAM-COMPROMISE1` | [Session permissions are determined by trusted delegation](../../../security/standard-ai/all.md#session-authority-defined-by-trusted-delegation) | [cspm.ai.public-mcp-tools](../../rules-reference/cspm.md#public-mcp-tools) ||
|| `AI-IAM-LEASTPRIV1` | [Workload identities have the minimum required effective permissions](../../../security/standard-ai/all.md#workload-identities-minimal-effective-rights)
|
[cspm.ai.datasphere-sa-privileges](../../rules-reference/cspm.md#datasphere-sa-privileges)
[cspm.access.check-privileged-roles](../../rules-reference/cspm.md#check-privileged-roles)
[cspm.ai.public-mcp](../../rules-reference/cspm.md#public-mcp)
||
|| `AI-IAM-LEASTPRIV3` | [Each tool has a dedicated, minimal identity](../../../security/standard-ai/all.md#each-tool-has-separate-minimal-identity)
|
[cspm.ai.mcp-sa-duplicate](../../rules-reference/cspm.md#mcp-sa-duplicate)
[cspm.ai.mcp-sa-privileges](../../rules-reference/cspm.md#mcp-sa-privileges)
||
|| `AI-SECRET1` | [A secret has an owner and a managed lifecycle](../../../security/standard-ai/all.md#secret-has-owner-managed-lifecycle)
|
[cspm.ai.tool-secrets](../../rules-reference/cspm.md#tool-secrets)
[cspm.ai.api-key-rotation](../../rules-reference/cspm.md#api-key-rotation)
[cspm.crypto.secrets-serverless](../../rules-reference/cspm.md#secrets-serverless)
[cspm.iam.sa-key-rotation](../../rules-reference/cspm.md#sa-key-rotation)
||
|| `AI-CRYPT1` | [Encryption is selected based on the features of a specific service](../../../security/standard-ai/all.md#encryption-chosen-by-service-capabilities)
|
[cspm.appsec.api-gateway-https](../../rules-reference/cspm.md#api-gateway-https)
[cspm.crypto.managed-vm-kms](../../rules-reference/cspm.md#managed-vm-kms)
[cspm.data.object-storage-encryption](../../rules-reference/cspm.md#object-storage-encryption)
||
|| `AI-NET2` | [Intercomponent connections are limited by the actual topology](../../../security/standard-ai/all.md#intercomponent-connections-limited-by-topology)
|
[cspm.access.public-access](../../rules-reference/cspm.md#public-access)
[cspm.k8s.network-firewall-scope](../../rules-reference/cspm.md#k8s-network-firewall-scope)
[cspm.k8s.api-security](../../rules-reference/cspm.md#api-security)
[cspm.network.check-outgoing-internet-connection](../../rules-reference/cspm.md#check-outgoing-internet-connection)
[cspm.network.network-firewall](../../rules-reference/cspm.md#network-firewall)
||
|| `AI-NET5` | [Model and data storages have no unaccounted public access](../../../security/standard-ai/all.md#model-data-stores-no-unaccounted-public-access)
|
[cspm.access.public-access](../../rules-reference/cspm.md#public-access)
[cspm.network.ydb-public](../../rules-reference/cspm.md#ydb-public)
[cspm.access.bucket-access-policy](../../rules-reference/cspm.md#bucket-access-policy)
[cspm.access.bucket-public-access](../../rules-reference/cspm.md#bucket-public-access)
||
|| `AI-NET7` | [Public HTTP(S) perimeter has an explicit protection scheme](../../../security/standard-ai/all.md#public-http-perimeter-explicit-protection) | [cspm.ai.public-mcp](../../rules-reference/cspm.md#public-mcp) ||
|#