# SP-027 Secure LLM Usage

Status: active. Release 26.02. Modified 2026-02-22. Licence: CC BY-SA 4.0.

Scope: Security architecture for integrating large language models (LLMs) into enterprise environments. Covers prompt injection and jailbreaking defences, output validation, provider security, privacy inference attacks on fine-tuned models, model extraction, and LLM interaction audit.
Use when: Organisation uses LLMs via API or embedded enterprise products (Microsoft 365 Copilot, GitHub Copilot, Gemini for Workspace) for business-sensitive tasks including data processing, analysis, or decision support. LLMs are integrated into enterprise applications as a component.
Not when: Organisation has no AI integration plans and no employee exposure to LLM tools in any operational capacity.

## Controls (26, NIST SP 800-53 ids)
- Critical (11): AC-03, AC-04, AU-02, AU-03, CA-07, RA-08, SA-09, SC-04, SC-07, SI-10, SR-02
- Important (15): AT-02, AT-03, AU-06, CA-02, IA-05, IR-04, PS-07, PT-02, PT-03, SA-04, SA-08, SA-11, SC-12, SI-03, SI-04

## What each critical control mitigates (11)
- AC-03 Access Enforcement: T-AI-001, T-AI-013
- AC-04 Information Flow Enforcement: T-AI-002, T-AI-003
- AU-02 Event Logging: T-AI-003, T-AI-014
- AU-03 Content of Audit Records: T-AI-004
- CA-07 Continuous Monitoring: T-AI-011
- RA-08 Privacy Impact Assessments: T-AI-015
- SA-09 External System Services: T-AI-012, T-AI-014
- SC-04 Information in Shared System Resources: T-AI-004
- SC-07 Boundary Protection: T-AI-001, T-AI-002, T-AI-003
- SI-10 Information Input Validation: T-AI-001, T-AI-002, T-AI-011, T-AI-013
- SR-02 Supply Chain Risk Management Plan: T-AI-014

## Threats and the controls that mitigate them (10)
- T-AI-001 Direct Prompt Injection: SI-10, SC-07, AC-03
- T-AI-002 Indirect Prompt Injection (via tool outputs, fetched content): SI-10, SI-03, SC-07, AC-04
- T-AI-003 Data Exfiltration via Context Window: AC-04, SC-07, PT-02, AU-02
- T-AI-004 Credential Exposure in Conversation Context: IA-05, SC-12, SC-04, AU-03
- T-AI-010 AI-Amplified Social Engineering: AT-02, AT-03, SI-04, IR-04
- T-AI-011 Hallucination Leading to Security Misconfiguration: SI-10, CA-02, SA-11, CA-07
- T-AI-012 Provider-Side Data Retention and Logging: SA-09, PT-02, PT-03, PS-07
- T-AI-013 Jailbreaking / Safety Feature Bypass: SI-10, SA-11, AC-03
- T-AI-014 Model Extraction via Systematic API Querying: SR-02, SA-09, AU-02
- T-AI-015 Membership Inference Attack on Fine-Tuned Model: PT-02, RA-08, PT-03

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-027/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-027/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 26 KB: /api/v1/patterns/SP-027
- Page for people: /patterns/sp-027/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-047 Secure Agentic AI Frameworks; SP-045 AI Governance and Responsible AI; SP-013 Data Security Pattern; SP-025 Advanced Monitoring and Detection

This card, the API and the page are generated from one file. Checking one against another adds no evidence.