ISACA Advanced in AI Security Management (AAISM) (AAISM) (AAISM) — Questions 301–333

Attack surface denotes the set of points where an attacker can interact with the system, including APIs, inputs, plugins and data pipelines. This definition frames where adversarial probing of the AI architecture can occur, guiding control placement and threat modelling.

Zero data retention commitments, verified through independent audit reports and a binding data processing addendum, directly address the risk that confidential content is stored and reused. This is the only option that targets the specific retention-and-resurfacing concern with enforceable, verifiable controls rather than technical or procedural mitigations aimed at different risks.

Periodic security assessments verify that vendor AI systems maintain robust security posture over time. Penetration testing uncovers vulnerabilities, while reviewing incident response plans ensures the vendor can handle AI-specific breaches. This ongoing scrutiny is critical for managing third-party risk and aligning with the organization's governance standards, as it provides assurance beyond initial onboarding.

Model Denial of Wallet attacks exploit excessive inference consumption, so token volume is the signal. Aggregating usage.total_tokens per caller reveals abnormal or sustained spikes that inflate cost, letting the SIEM alert on consumption anomalies rather than on request counts alone.

Finalising the Model Card at deployment records intended use, known limitations and security parameters, giving governance an auditable artefact before the model serves traffic. This satisfies the stem's requirement for an essential governance activity within the deployment phase.

API key authentication restricts which callers may invoke an AI system's endpoints, verifying identity before access is granted. It is a genuine access control mechanism because it gates entry to the service rather than protecting data in transit or monitoring behaviour, satisfying the requirement for an example of AI system access controls.

Poisoned data in third-party datasets is an AI supply chain risk because it compromises training inputs sourced externally, before the model reaches your control. This satisfies the stem's supply chain constraint: the threat originates from an upstream vendor's data, not from your own model, deployment or inference environment.

Fine-tuning on validated clinical data improves accuracy, and a retrieval-augmented generation (RAG) guardrail that restricts responses to a trusted knowledge base prevents the model from hallucinating or generating unsupported advice. This directly mitigates the risk of harmful or misleading output by grounding responses in verified medical information. It is the most appropriate pre-deployment control.

Mandating security and red-teaming testing for high-risk models ensures adversarial validation before deployment, addressing model-specific threats such as prompt injection and data leakage. This satisfies the requirement for an essential AI security policy component covering risk-tiered assurance.

Defensive distillation trains a student model on softened probability outputs, flattening gradients that evasion attacks exploit. This reduces sensitivity to small input perturbations, hardening the model. The trade-off is that the smoothed decision boundary can lower accuracy on clean, unperturbed inputs, which must be measured before deployment.

Superior, more efficient alternatives directly drive model obsolescence by rendering the deployed model uncompetitive on accuracy, latency or cost. This satisfies the stem's focus on obsolescence risk: newer architectures or training approaches can outperform the existing model, forcing replacement before its planned lifecycle ends.

An AI incident response plan defines the procedures for detecting, reporting, escalating, and remediating AI-related incidents, including offensive language generation. It assigns roles, sets communication protocols, and outlines containment and recovery steps. This artifact ensures consistency and accountability when incidents occur, directly addressing the governance team's need for a standardized approach.

Threat modelling systematically identifies how an AI system could be attacked or misused, exposing adversarial, data-poisoning and model-theft scenarios. It is a core AI risk assessment step because it surfaces threats before controls are selected and residual risk is accepted.

Attackers lacking gradient or architecture access can still query the API repeatedly, observing input-output pairs to train a surrogate model that approximates the target. That substitute then generates transferable adversarial examples, so black-box opacity does not prevent evasion.

A backdoor attack implants a hidden trigger during training so the model behaves normally on standard inputs but produces attacker-chosen outputs whenever that specific trigger appears. This differs from indiscriminate accuracy degradation, which is the goal of availability-focused poisoning.

Model-extraction attacks manifest as unusual query volumes, low-entropy inputs, or systematic sampling near the decision boundary. Analyzing inference logs for distributional drift and boundary-probing behavior detects these patterns without altering the model or its responses. Because the requirement is detection only, a monitoring and alerting control on existing logs is the appropriate, non-invasive choice and aligns with ISACA's emphasis on continuous monitoring.

Role-Based Access Control assigns permissions by job function, so only authorised identities can pull, modify or publish models in the registry. This enforces least privilege on the registry's API and storage, satisfying the requirement to restrict access to sensitive model artefacts and their metadata.

DLP tools inspect outbound content and block or quarantine transfers containing sensitive data, directly interrupting the exfiltration path. Applied to AI pipelines, they enforce policy on prompts, responses and exports, satisfying the data leakage control requirement by preventing unauthorised disclosure rather than merely detecting it afterwards.

Tiered access restricts who may query the API, while rate limiting caps query volume per identity, starving the automated harvesting that model scraping depends on. Together they directly constrain the extraction channel, satisfying the stem's demand for prevention rather than detection.

SHAP values provide locally accurate, additive feature attributions grounded in cooperative game theory, which satisfies the requirement for consistent instance-level explanations. Each prediction can be decomposed into feature contributions that sum to the model output, making adverse decisions explainable to applicants and regulators. It works for many model types, including tree ensembles and neural networks.

Validating model updates against a clean, golden dataset detects poisoned weights or backdoors before deployment, because tampered models diverge from expected outputs on trusted, untainted inputs. This satisfies the pipeline's need to verify integrity prior to releasing a trained model.

Model integrity risk concerns unauthorised tampering with trained parameters, where attackers alter weights to change predictions or embed backdoors. This differs from data poisoning, which corrupts training inputs, and from availability risks affecting model uptime.

Differential privacy provides a formal guarantee that the inclusion or exclusion of a single individual's data does not significantly affect the model's outputs. By adding calibrated noise during training, it prevents memorization of individual records. This is a key technique for privacy-preserving machine learning and aligns with ISACA's guidance on protecting sensitive data in AI systems.

A sharp rise in false positives after a population shift is the classic signal that a pre-defined drift response should activate. Reassessing segment-level performance locates where the model degrades, threshold adjustment or retraining restores accuracy, and heightened human review protects claimants in the interim. This treats the finding as a managed risk event with defined steps rather than a surprise.

Iterative adversarial prompting directly exercises the model's instruction-following boundary, satisfying the stem's requirement to test prompt injection specifically. Unlike static checklists or code review, repeated attempts probe how the model handles conflicting instructions and embedded malicious content, revealing exploitable weaknesses in its input handling.

Automated alerting on anomalous request patterns detects abuse such as credential stuffing against model endpoints or unusual inference volumes. It satisfies the monitoring strategy by converting raw telemetry into timely, actionable signals, letting analysts respond before anomalies escalate into incidents.

Shadow AI describes staff adopting unsanctioned generative or analytical AI services for work, bypassing IT review. Data leaves governed boundaries without DLP, logging or vendor assessment, creating confidentiality, compliance and IP exposure that security teams cannot monitor.

Inference latency is a core model performance metric, capturing how quickly the deployed model returns predictions. Monitoring it detects degradation from model drift, resource contention or scaling issues, directly satisfying the stem's requirement to track model performance alongside security indicators.

The core failure is a risk with no owner, no threshold, and no response plan, which violates basic risk treatment principles. Assigning an accountable owner, defining quantified drift thresholds with alerting triggers, and documenting a response process converts an unmanaged risk into a governed, measurable control loop that can be audited and improved.

Ongoing monitoring continuously tracks live model performance and risk metrics after deployment, detecting drift, degradation or emerging threats. This satisfies the stem's requirement for a recurring operational activity rather than one-off validation, which belongs to earlier lifecycle stages.

Model inversion exploits prediction outputs to infer sensitive training data, letting an attacker reconstruct representative samples or attributes. This differs from membership inference, which only determines whether a record was used, satisfying the requirement to describe inversion as a confidentiality risk.

AI Risk Appetite defines the amount and type of risk an organisation is prepared to accept in pursuit of its AI objectives, directly satisfying the stem's requirement for a definition. It sets tolerance boundaries governing AI development and deployment decisions, distinct from risk capacity or actual exposure, and must align with broader enterprise risk appetite.

Red teaming exercises adversarial techniques against AI systems to surface exploitable weaknesses, prompt-injection paths and unsafe failure modes before real attackers find them. This satisfies the governance objective of proactive risk identification, feeding findings into controls and oversight rather than reacting after an incident.