ASD ISM 2072 Store AI models in A non-executable file format
What it says
AI models are stored in a non-executable file format that does not allow arbitrary code execution.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishArtificial intelligence (AI) models must be saved using a file format that cannot run arbitrary code by itself. The goal is that loading a model never lets it execute hidden instructions on your systems.
An AI model is the data file that powers a smart feature, such as a chatbot or an image classifier. Some common ways of saving these files can secretly carry program code inside them. When your system loads such a file, that hidden code can run automatically, which is called arbitrary code execution. This control requires that you store AI models in a file format that holds only the model's data and settings, never runnable program code. That way, when staff or systems open a model, the file cannot quietly run commands, install malware, steal data, or damage your systems. In plain terms: the model file should be inert data, not a program that springs into action the moment it is loaded.
Free. Save your status, tasks and notes.
Why it matters
If models are stored in formats that can run code, loading a model could trigger hidden commands that install malware, steal data, or damage systems.
How to implement
The IT or machine learning team selects a safe storage format that holds only model data and weights, such as the safetensors format, rather than formats that can embed and run code when loaded.
The system owner records which model file formats are approved and which are banned, then publishes this as a short standard that everyone building or buying AI features must follow.
Engineers add an automated check to the deployment pipeline that inspects every model file's format before it is loaded, and blocks any file that is in a runnable or unknown format.
The security lead configures systems and storage so they only accept the approved non-executable formats, rejecting model files that arrive in formats capable of running code.
When a model is downloaded from an external source or a public model hub, a named person converts it into the approved non-executable format and confirms it carries no embedded code before it is used in production.
Keep it running
Re-check the storage format every time a model is updated, retrained, or pulled from an external source, since a new file can reintroduce a code-bearing format.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Which file format do you use to store your AI models, and does that format allow code to run when the model is loaded?
Look at
the documented approved format and a stated reason it cannot execute code.
Good evidence
a data-only format such as safetensors is named, with executable-capable formats explicitly excluded.
- Check 2 of 5What an auditor asks for
Ask for
How do you verify a model is in the non-executable format before it is deployed or loaded?
Look at
a documented validation step covering format and contents.
Good evidence
an automated pre-deployment check that confirms format and blocks anything runnable.
- Check 3 of 5What an auditor asks for
Ask for
What stops a model in a code-bearing format from being loaded into production?
Look at
system or storage configuration that restricts accepted formats.
Good evidence
settings that only accept approved formats and reject others by default.
- Check 4 of 5What an auditor asks for
Ask for
How do you handle models obtained from external or public sources?
Look at
a conversion and inspection step before use.
Good evidence
external models are converted to the approved format and checked for embedded code before deployment.
- Check 5 of 5What an auditor asks for
Ask for
Can you show a sample of model files currently in use?
Look at
the actual file types and formats in production.
Good evidence
all sampled models are stored in the approved non-executable format with no code-bearing files present.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-2072 requires AI models to be stored in a non-executable file format that does not allow arbitrary code execution, so that loading a model cannot run embedded malicious code. This is a specific preventive measure against malicious code delivered through model files, which contributes directly to the protection against malware that Annex A 8.7 requires. Annex A 8.7 covers malware protection across all systems together with user awareness, while ISM-2072 addresses only the file format of AI models.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.