Yandex Cloud
Search
Discuss with expertTry it for free
  • Customer Stories
  • Documentation
  • Blog
  • All Services
    • Cloud Interconnect
    • Cloud Backup
    • Cloud Registry
    • Yandex AI Studio
    • Compute Cloud
    • Object Storage
    • Managed Service for Kubernetes®
    • Yandex BareMetal
    • Smart Web Security
    • Security Deck
    • Managed Service for PostgreSQL
    • Managed Service for ClickHouse®
    • Monium
    • Cloud CDN
    • Network Load Balancer
    • Virtual Private Cloud
    • Cloud DNS
    • Application Load Balancer
    • Yandex Cloud Video
    • Stackland
    • Yandex Cloud Router
    • Yandex Managed Service for Trino
    • Managed Service for MySQL®
    • Managed Service for Valkey™
    • Managed Service for Apache Spark™
    • Yandex StoreDoc
    • Managed Service for OpenSearch
    • Managed Service for Apache Kafka®
    • Data Transfer
    • Yandex MPP Analytics Engine for PostgreSQL
    • Yandex Managed Service for Apache Airflow®
    • Data Processing
    • Yandex MetaData Hub
    • Managed Service for YDB
    • Managed Service for Sharded PostgreSQL
    • Managed Service for YTsaurus
    • Yandex WebSQL
    • DataLens
    • Yandex Search API
    • SpeechSense
    • SpeechKit
    • DataSphere
    • Vision OCR
    • Translate
    • Yandex Identity Hub
    • Key Management Service
    • Certificate Manager
    • Yandex Lockbox
    • Audit Trails
    • SmartCaptcha
    • Yandex SIEM
    • SourceCraft Code Assistant
    • Container Registry
    • Managed Service for GitLab
    • Managed Service for Prometheus®
    • Cloud Functions
    • API Gateway
    • Yandex Cloud Postbox
    • Message Queue
    • IoT Core
    • Data Streams
    • Serverless Containers
    • Cloud Notification Service
    • Identity and Access Management
    • Yandex Cloud Console
    • Resource Manager
    • Yandex Cloud Billing
    • Yandex Cloud Quota Manager
    • Cloud Apps
  • System Status
  • Marketplace
    • Featured
    • Infrastructure & Network
    • Data Platform
    • AI for business
    • Security
    • DevOps tools
    • Serverless
    • Monitoring & Resources
  • All Solutions
    • By industry
    • By use case
    • Economics and Pricing
    • Security
    • Technical Support
    • Start testing with double trial credits
    • Cloud credits to scale your IT product
    • Gateway to Russia
    • Cloud for Startups
    • Center for Technologies and Society
    • Yandex Cloud Partner program
    • Price calculator
    • Pricing plans
  • Customer Stories
  • Documentation
  • Blog
© 2026 Direct Cursus Technology L.L.C.
Yandex Security Deck
    • Overview
    • Security Deck workspaces
    • Alerts in Security Deck
      • Overview
      • Yandex Cloud basic security rules
      • Cloud infrastructure security standard Yandex Cloud
      • Ransomware attack prevention standard
      • CIS Benchmark™ requirements for Kubernetes
      • Personal data protection standard for Yandex Cloud users
      • PCI DSS standard in Yandex Cloud
      • Requirements of the GOST R 57580 standard
      • Auditing processes and applications
      • Yandex Cloud security standard for AI systems
    • Data Security Posture Management (DSPM)
    • Kubernetes® Security Posture Management (KSPM)
    • Cloud Infrastructure Entitlement Management (CIEM)
    • Cloud Security Posture Management (CSPM)
    • Custom rules
    • Threat Detector (TD)
    • Vulnerability Management (VM)
    • Access Transparency
    • AI assistant
    • Quotas and limits
  • Pricing policy
  • Audit Trails events
  • Release notes
  1. Concepts
  2. Compliance UI
  3. Yandex Cloud security standard for AI systems

Yandex Cloud security standard for AI systems

Written by
Yandex Cloud
Updated at November 2, 2026
View in Markdown

This standard establishes security requirements and recommendations for artificial intelligence systems deployed fully or partially in Yandex Cloud. It targets security architects, information security specialists, developers, ML and DevSecOps engineers, service owners, SOC analysts, and compliance officers.

These requirements contain automated security rules for AI systems in compliance with the Yandex Cloud AI security standard guidelines.

Requirement ID

Security standard requirement

Check ID in the CSPM module

AI-CORE5

System guidelines and policies must only be modified via a trusted path

cspm.ai.tool-secrets

AI-MCP1

Access to the MCP Gateway and the target service is separated

cspm.ai.public-mcp-tools
cspm.ai.public-mcp

AI-TRAIN1

Development, training, and production environments are separated

cspm.ai.datasphere-sa-privileges

AI-INFRA-ISOL3

Execution of code, commands, and dynamic queries is restricted

cspm.aws-token

AI-IAM4

Yandex Cloud AI Studio call uses a documented authentication method

cspm.ai.api-key-scopes
cspm.ai.api-key-rotation

AI-IAM5

Effective permissions are reviewed on a schedule and following changes

cspm.ai.system-groups

AI-IAM-COMPROMISE1

Session permissions are determined by trusted delegation

cspm.ai.public-mcp-tools

AI-IAM-LEASTPRIV1

Workload identities have the minimum required effective permissions

cspm.ai.datasphere-sa-privileges
cspm.access.check-privileged-roles
cspm.ai.public-mcp

AI-IAM-LEASTPRIV3

Each tool has a dedicated, minimal identity

cspm.ai.mcp-sa-duplicate
cspm.ai.mcp-sa-privileges

AI-SECRET1

A secret has an owner and a managed lifecycle

cspm.ai.tool-secrets
cspm.ai.api-key-rotation
cspm.crypto.secrets-serverless
cspm.iam.sa-key-rotation

AI-CRYPT1

Encryption is selected based on the features of a specific service

cspm.appsec.api-gateway-https
cspm.crypto.managed-vm-kms
cspm.data.object-storage-encryption

AI-NET2

Intercomponent connections are limited by the actual topology

cspm.access.public-access
cspm.k8s.network-firewall-scope
cspm.k8s.api-security
cspm.network.check-outgoing-internet-connection
cspm.network.network-firewall

AI-NET5

Model and data storages have no unaccounted public access

cspm.access.public-access
cspm.network.ydb-public
cspm.access.bucket-access-policy
cspm.access.bucket-public-access

AI-NET7

Public HTTP(S) perimeter has an explicit protection scheme

cspm.ai.public-mcp

Was the article helpful?

Previous
Auditing processes and applications
Next
Data Security Posture Management (DSPM)
© 2026 Direct Cursus Technology L.L.C.