Legacy procurement fragments standards, evidence, and accountability across bureaus, so each team may approve different models, access patterns, and logging approaches. That creates inconsistent controls and makes enterprise auditing difficult. The result is not just duplication, but an uneven security baseline that can hide weak access decisions and missing monitoring until after deployment.
Why This Matters for Security Teams
Public-sector procurement was built to compare products, price, and baseline compliance. AI changes the risk model because the real security question is not just what the system is, but what it can do after deployment: which data it can reach, which tools it can call, and how its behavior changes with prompts and connectors. When each bureau buys and governs AI differently, the result is a patchwork of access rules, logging depth, and evidence quality that is hard to defend under audit.
This is why legacy procurement often creates hidden security debt. One office may require model documentation, another may accept a vendor assurance package, and a third may rely on contract language that never maps cleanly to technical controls. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls helps anchor control selection, but procurement still determines whether those controls exist in practice. The NHIMG Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because AI systems depend on service identities, secrets, and lifecycle governance that are often split across acquisition, IT, and mission teams. In practice, many security teams discover the mismatch only after an AI pilot has already been approved, connected, and given access to sensitive data.
How It Works in Practice
Legacy procurement makes AI harder to secure because it treats assurance as a document review instead of a runtime control problem. For public-sector AI, the central issue is that the buyer is often approving a product family while the security team needs to govern a living workload with changing prompts, model versions, API connectors, and delegated access. That means the contract may say “secure logging,” but the deployed environment may still lack consistent telemetry, traceability, or revocation paths.
Security teams need procurement language that forces evidence before go-live and enforces continuous control after go-live. Current practice usually includes:
- clear ownership for the model, the data sources, and the non-human identities used to call them;
- minimum logging and retention requirements tied to a named control baseline;
- secrets handling rules for API keys, tokens, and service credentials;
- requirements for vendor disclosure of model updates, connector changes, and subprocessor changes;
- testing rights for prompt injection resistance, access scope, and rollback procedures.
That aligns with the NIST control approach in NIST SP 800-53 Rev 5 Security and Privacy Controls, but AI procurement also needs identity lifecycle discipline. The NHIMG article DeepSeek breach is a reminder that exposed data, public credentials, and poorly bounded access can turn an AI system into an incident multiplier. Procurement should therefore require evidence of workload identity, short-lived secrets, and revocation workflows, not just a security questionnaire. These controls tend to break down when multiple agencies share a common vendor platform but maintain separate approval chains, because no single team owns the full access path from contract to runtime.
Common Variations and Edge Cases
Tighter procurement often increases cycle time, which forces agencies to balance speed of adoption against assurance depth. That tradeoff is real, especially when mission teams want to pilot AI quickly while security teams need repeatable evidence and consistent logging. The best practice is evolving, but there is no universal standard for this yet, so agencies usually need a minimum shared baseline even if they allow local variation on top of it.
Some environments can centralize procurement and security review, which reduces inconsistency. Others, especially federated departments, cannot. In those cases, the answer is not to block all local buying, but to standardize the security artifacts that every bureau must produce: identity model, secret handling, logging format, data-flow map, and incident response obligations. Where contractors operate systems on behalf of government, the procurement package should also require clear evidence of how non-human identities are provisioned, monitored, and removed.
Public-sector teams should also be careful not to confuse “vendor attestation” with “operational assurance.” A signed document does not prove that the deployed AI is using least privilege or that its connectors cannot be abused. The most resilient programs treat procurement as the first control gate and continuous monitoring as the second. Without that split, agencies can meet acquisition requirements while still inheriting fragmented AI risk across the enterprise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Legacy procurement often leaves NHI ownership, scope, and lifecycle unclear. |
| OWASP Agentic AI Top 10 | A2 | AI procurement must account for autonomous behavior and tool use after deployment. |
| CSA MAESTRO | C2 | MAESTRO addresses governance gaps across agent lifecycle and operational controls. |
| NIST AI RMF | AI RMF frames the need for measurable govern-map-measure-manage assurance. | |
| NIST CSF 2.0 | GV.OV-01 | Procurement should support enterprise oversight and consistent risk management. |
Require named ownership, scoped access, and offboarding evidence for every non-human identity in procurement.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
