A New Framework For AI Data Center Security: NIST SP 800-239

The National Institute of Standards and Technology (NIST) has released an initial public draft of analysis and recommendations for addressing AI Data Center Security Analysis: A High-Performance Computing (HPC) Driven Approach (Draft). The Draft of Special Publication (SP) 800-239 implements the Trump Administration AI Action Plan’s call for new technical standards for high-security AI data centers. The Draft examines the security landscape of AI data centers and provides a “threat and security gap analysis for purpose-built AI infrastructure used in model training, interference, applications, and related AI services.” It proposes basic security recommendations and solutions informed by other NIST work.

Although the Draft is framed as voluntary for the private sector, the intent of the publication is to “lay the groundwork for creating security guidelines specific to the computing environment.”

For more than a decade, we have seen NIST security publications become part of regulatory expectations and standards, so NIST’s work here may have broad consequences at a time when AI policy is shifting rapidly. The Administration is taking steps to address national security in the information and communications technology supply chain, agencies are banning certain foreign-made equipment used in data centers (e.g., the Federal Communications Commission adding items to the Covered List), states and localities are imposing moratoriums on the construction of new data centers, and members of Congress have proposed restrictions and oversight.

NIST has invited comments on the Draft through September 25, 2026, presenting an opportunity for the private sector to shape reasonable security expectations for AI data centers that may end up reflected in federal procurement requirements and broader commercial practices.

Key Takeaways

• The Draft provides preliminary guidance on AI data center security and baselines for AI workloads that when finalized may be incorporated into procurement or contractual requirements, as we have seen with other NIST publications (i.e., NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, which is required to be implemented by contractors under the Federal Acquisition Regulations and FedRAMP, and NIST SP 800-161, Cybersecurity Supply Chain Risk Management, required under specific procurements).
• The Draft frames AI data center security in a multi-tenant environment as a shared responsibility of data center operators, tenants/users, and model owners. However, the discussion of security measures places greater emphasis on the obligations of operators.
• The Draft identifies a range of security practices and mitigations that should be implemented to secure access, management, computation, and data storage and connectivity for AI workloads.
• As federal policymakers increasingly focus on AI security, SP 800-239 will help shape future expectations for securing AI data centers and related computing environments.
• Companies should consider engaging with NIST during the comment period to ensure the publication provides adequate flexibility with respect to responsibilities and technical and operational obligations. NIST is generally receptive to thoughtful contributions from stakeholders.

What the Draft Does

Draft SP 800-239 provides a reference architecture for AI data centers that explains key functions and components, as well as a threat and security gap analysis highlighting the key differences between an AI data center and a High-Performance Computing system. The publication focuses on the “security of the computing environment in AI data centers, specifically addressing access, management, computation, and data storage for AI workloads,” for AI training and inference. NIST highlights how the massive scale of AI workloads introduces new vectors for compromise that traditional enterprise IT frameworks may not fully address.

Security Threats and Challenges

The Draft analyzes the principal security threats and challenges that will impact the design of AI data center security guidelines. NIST examines the complexities of building resilient infrastructure, which “is no longer just about hardware durability but also about developing sophisticated software orchestration and checkpointing mechanisms that can bypass faulty hardware without compromising the security or integrity of the workload.”

Regulatory Compliance Challenges. The Draft explains that the governance of data sets used for AI model training and inference present challenges for AI data center operators, as the workloads frequently use massive amounts of sensitive data that may be subject to U.S., state, and global regulations such as the government security protocols for Controlled Unclassified Information (CUI), patient confidentiality requirements under the Health Insurance Portability and Accountability Act (HIPAA), and privacy controls under the California Consumer Privacy Act and General Data Protection Regulation. NIST advises that “data centers must implement multi-layered security architectures that include end-to-end encryption, strict identity and access management, input and output token monitoring, and sometimes physical air-gapping to ensure that training sets remain untainted and legally compliant.”

Data Quality, Provenance, and Security Challenges. The Draft identifies the impact of data quality on the speed of training and the quality of the trained AI model. NIST explains that “collecting high-quality data, tracking its provenance and usage history, and preserving it … are major investments in the AI development life cycle.” The Draft identifies that meeting these requirements is a “challenge” for AI data centers.

Prompt-Based Exploitation Threats. NIST identifies several methods of prompt-based exploitation – model distillation attacks, AI model ontology discovery attacks, AI black-box attacks, and prompt injection attacks – that must be protected against by both the models and the infrastructure. NIST explains that model distillation attacks, where an attacker uses queries and responses to create a dataset that can be used to train a smaller model, are usually carried out on a large-scale automated basis. NIST states that AI data centers “must strive to detect and mitigate such attacks.”

Supply Chain Threats. NIST explains hardware, software, and AI dataset and model supply chain threats. For AI dataset and model supply chain attacks, threat actors poison, corrupt, or manipulate training data and pre-trained models used to build AI systems. This can result in unreliable models.

Multiple Data Center Training Threat. The Draft states that multi-data-center training allows multiple sites to cooperate on real-time model training, achieving efficient resource utilization. However, NIST observes that multiple data centers can introduce threats due to the reliance on public high-speed networking infrastructure. The Draft states that “attackers can target these connections, intercept traffic, or launch man-in-the-middle attacks.”

Other threats NIST identifies are multi-tenant threats, insider threats, silent data corruption threat, expanding and evolving attack surface threats, AI-powered threats, firmware integrity threats, and AI accelerator vulnerability.

Data Center Security Solutions

The second part of the publication discusses methods for strengthening the overall security posture of AI computing environments to address risks across the technology stack, including hardware, software, storage, networking, and management functions. The draft also identifies potential safeguards designed to protect AI workloads, training and inference environments, datasets, models, and supporting infrastructure from emerging threats associated with large-scale AI operations.

For access zone protection, NIST recommends addressing traditional security threats to API gateways in addition to the distinct security vulnerabilities of AI gateways. NIST calls the AI gateway “a critical security chokepoint … [that] should be rigorously monitored and secured.”

NIST identifies the governance of datasets used in AI data centers as a significant security challenge, emphasizing the need to maintain visibility into how data is collected, stored, accessed, and used throughout the AI lifecycle. The Draft notes that the scale and complexity of AI environments can make it difficult to track data provenance, enforce access controls, and prevent unauthorized use or modification of training and inference data.

Consistent with broad acceptance of Zero Trust as a baseline security strategy, NIST highlights the relevance of Zero Trust principles, including continuous verification, least-privilege access, and stronger controls around users, devices, workloads, and data. NIST also discusses hardware root of trust and confidential computing as security advancements that can enhance security and privacy while still allowing high data center performance.

The Draft recommends a “human-in-the-loop” approach for critical operations such as deployment of a model into production and, governance decisions, to help ensure appropriate oversight, accountability, and response to security events. Finally, NIST explains a security-by-design and verification-by-design approach will ensure security is embedded into the AI data center lifecycle.

NIST explains that the secure computing environment represents only one component of a complete AI data center and that other elements, including the site perimeter, building and physical infrastructure, operational technology for power and cooling, supply chain, and personnel, are outside the scope of this document and will be addressed through a related initiative.

Why This Matters

The release of Draft SP 800-239 and the underlying requirement for technical standards for AI data centers in the AI Action Plan signal that AI data center security is an increasingly important component of the larger AI security policy dialogue. The Draft highlights the need for AI-specific threat analysis and security controls. Organizations operating AI infrastructure should closely monitor the development of this guidance, particularly because the Draft may serve as a foundation for future requirements under federal government contracts and industry-adopted standards. Stakeholders, including data center operators that may be affected by the proposal, should consider filing comments and working with NIST to ensure that the final publication appropriately assigns responsibilities and balances security objectives with practical and scalable implementation. 

For almost 20 years, we have helped numerous organizations engage with NIST and submit thoughtful comments that inform final publications with real-world examples, data, operational input, and practical solutions. It is imperative that NIST receive quality input from an array of participants and stakeholders so that it can remain technology-neutral, consider all government activities in relevant areas, and avoid entanglement in policy debates.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.