Select Two (Multi-Select) Questions

Requirements to publish all internal vulnerabilities publicly.

Why it fails: Publishing internal vulnerabilities publicly exposes exploitable weaknesses to attackers and breaches coordinated disclosure norms, undermining the containment and notification phases of an AI incident response plan. It is tempting as a transparency gesture, but controlled internal reporting and regulator notification are the correct choice.

Automated deletion of all logs.

Why it fails: Deleting all logs destroys the forensic evidence an AI incident response plan depends on for root-cause analysis, timeline reconstruction and regulatory reporting, directly contradicting containment and recovery objectives. It is tempting as a blunt "erase the breach" measure, but log retention and integrity, not deletion, are the correct choice.

Disabling logging to reduce cloud spend

Why it fails: Disabling logging removes the audit trail that detection depends on, so no incident can be identified or investigated. It is tempting as a cost-reduction measure for high-volume cloud telemetry, and would suit a non-security scenario such as trimming debug output in a lab, but it directly defeats monitoring.

Using standard database backup schedules

Why it fails: Database backup schedules restore data after loss; they capture no runtime telemetry such as model API calls, prompt anomalies or inference drift, so incidents go undetected. Backup scheduling is correct for resilience and recovery planning, not for continuous AI security monitoring.

Hardcoding API credentials in application code

Why it fails: Hardcoded credentials create an exposure vector rather than a detection mechanism, and rotate poorly, so they cannot surface AI incidents. Secrets belong in a managed vault; hardcoding would only be contemplated in throwaway local testing, never as a monitoring control.

Ignoring all software updates.

Why it fails: Ignoring software updates leaves known vulnerabilities unpatched across the AI lifecycle, directly increasing risk. It is tempting because freezing changes can feel like stability, and deferring updates is defensible during a validated model's controlled production window, but blanket ignoring is never a risk control.

Bypassing security reviews for speed.

Why it fails: Bypassing security reviews removes the control that catches unsafe model behaviour, data handling flaws and compliance gaps before deployment. It is tempting because it accelerates delivery, and a lightweight review may be justified for low-risk internal prototypes, but bypassing reviews entirely is not risk management.

Hardening the physical security of the server room

Why it fails: Physical server-room hardening protects hardware housing, not the training supply chain's data, code and model artefacts, which are compromised through repositories, pipelines and third-party datasets. It is tempting because physical controls are foundational for on-premises infrastructure, and would be correct where training hardware sits in an unsecured facility.

Increasing the number of neurons in the model

Why it fails: Neuron count is a model capacity hyperparameter affecting accuracy and compute cost, not a security control over training data, code or weights. It is tempting because larger models are associated with capability, and tuning architecture is correct when the goal is predictive performance rather than supply-chain integrity.

Access to all employees' private emails.

Why it fails: Blanket access to employees' private emails breaches privacy and data-protection principles, which governance exists to constrain. It is tempting because monitoring can surface misuse, yet lawful, proportionate oversight of work systems — not unrestricted private inbox access — is what governance frameworks actually require.

A mandate to use the most expensive GPUs available.

Why it fails: Hardware cost is a procurement decision, not a governance element; AI governance requires accountability structures, risk management and policy oversight. It is tempting because compute capacity genuinely affects AI capability, so expensive GPUs can appear linked to control, though they address performance rather than governance.

Increased latency for API requests

Why it fails: Latency reflects runtime serving performance, whereas poisoning corrupts training data or weights, so symptoms surface as degraded accuracy, skewed predictions or anomalous loss curves during training. Latency monitoring belongs to operational availability and capacity troubleshooting.

Increase in storage costs for the model weights

Why it fails: Storage cost tracks volume and retention, not weight integrity; poisoning alters learned parameters, showing as accuracy drift, unexpected outputs or anomalous validation metrics. Storage growth would be a legitimate capacity-planning concern, unrelated to training-phase tampering.

Membership inference

Why it fails: Membership inference determines whether a specific record was in the training set, which is a privacy attack. It does not test robustness against adversarial examples that cause misclassification. Therefore, it is not a technique for assessing resilience to evasion attacks in an IDS.

Model inversion

Why it fails: Model inversion attempts to reconstruct training data from model outputs, which is a privacy attack, not a robustness test. It does not evaluate how well the model resists adversarial perturbations. Thus, it is not relevant for assessing resilience against attacks that aim to cause misclassification.

Data poisoning

Why it fails: Data poisoning involves manipulating the training data to corrupt the model. While it is an adversarial attack, it occurs during training, not during inference. The scenario asks for testing robustness of a deployed model, so poisoning is not appropriate. It does not evaluate the model's ability to withstand input perturbations at test time.

The office lease agreement.

Why it fails: An AI audit trail evidences data lineage, model versions, training inputs, validation results and decision logs; a property lease has no bearing on model behaviour or accountability. Lease documents belong in facilities or financial audits, where this option would be the right artefact to cite.

A copy of the employee handbook.

Why it fails: An AI audit trail needs model cards, dataset provenance, hyperparameters and inference logs; the employee handbook covers conduct and HR policy, not algorithmic traceability. Handbooks are relevant to HR compliance reviews, which is the scenario where this document would be the correct choice.

Store the de-identified training corpus in the same object bucket used for model artifacts to simplify lineage tracking.

Why it fails: Co-locating the training corpus with model artifacts expands the blast radius of any credential compromise on that bucket, exposing the raw notes alongside the weights. It does not reduce memorization in the model at all, and it worsens the confidentiality posture by concentrating sensitive data where production pipelines already have broad access.

Increase the model's parameter count so that training examples are distributed across more weights.

Why it fails: Larger models generally memorize more, not less, because they have greater capacity to store rare training sequences. Scaling parameters does not reduce the influence of any single patient note and can make verbatim extraction easier, so this choice works against the stated objective of limiting memorization leakage.

Disable output logging on the summarization service so that generated text cannot be harvested.

Why it fails: Suppressing output logs removes the audit trail needed to investigate leakage and to detect extraction attempts, while doing nothing to stop memorized content from being returned to a caller in real time. The risk is that the model emits patient text, not that the log stores it, so this control reduces oversight without reducing the underlying risk.

An annual attestation from each subsidiary's CIO that all AI systems comply with the central AI policy.

Why it fails: Annual attestation provides a point-in-time assertion but no registration, risk assessment, or continuous monitoring of individual AI systems. It also relies on self-reporting without standardized data, so the central office cannot compare or aggregate risk. Consistency requires ongoing mechanisms, not a yearly signature.

A central mandate requiring every subsidiary AI project to be approved by the central AI governance office before any development begins.

Why it fails: Central pre-approval of every project ensures consistency but creates a severe bottleneck and does not scale across many subsidiaries and regions. It also centralizes decisions that require local regulatory and business context. The scenario asks for consistent registration, assessment, and monitoring, which a federated model with central standards achieves more effectively than universal central pre-approval.

A requirement that all subsidiary AI systems use the same foundation model provider as the parent company.

Why it fails: Standardizing on one foundation model provider addresses model sourcing, not governance consistency in registration, risk assessment, or monitoring. It may also conflict with regional data residency or vendor availability requirements. The scenario asks how to ensure consistent governance processes across subsidiaries, which provider standardization does not deliver.

Performing daily operational monitoring of model drift and data pipeline health for every deployed model.

Why it fails: Daily operational monitoring belongs to engineering, data science, or security operations teams, not the governance committee. The committee should define monitoring requirements and review aggregated results, but performing hands-on monitoring would overwhelm it and blur accountability. ISACA governance expects operational teams to execute monitoring while the committee oversees whether it is effective and escalations occur.

Negotiating pricing and service-level agreements with third-party AI model providers.

Why it fails: Contract negotiation is a procurement and legal activity. While the committee may set requirements for vendor risk clauses, directly negotiating pricing and SLAs is outside governance scope and would duplicate existing functions. ISACA governance expects the committee to define security and compliance requirements, then rely on procurement and legal to execute contracts consistent with those requirements.

Writing and maintaining the production code for all AI models used in manufacturing operations.

Why it fails: Writing production code is an engineering function, not a governance responsibility. Committees that take on implementation work lose independence and become a bottleneck. ISACA governance separates oversight from execution so the committee can objectively evaluate risk, challenge assumptions, and hold delivery teams accountable without being compromised by ownership of the code itself.

A requirement that all AI projects use the same programming language and cloud provider.

Why it fails: Standardizing technology stack can simplify management, but it is not necessary for accountability and may be impractical across a multinational corporation with diverse needs. Accountability comes from governance and oversight, not from technical uniformity. Mandating a single language or provider could hinder innovation and does not address responsibility for AI outcomes.

An annual employee satisfaction survey that includes questions about AI tools.

Why it fails: An employee satisfaction survey measures sentiment and can inform improvements, but it does not create accountability or enforcement capability. It is a feedback mechanism, not a governance structure. While useful for adoption and culture, it does not ensure that AI risks are owned or that policies are followed across business units.

A monthly newsletter highlighting AI success stories from each business unit.

Why it fails: A newsletter can promote awareness and culture, but it does not establish accountability or enforcement mechanisms. It is a communication tool, not a governance control. While positive reinforcement has value, it cannot ensure that business units follow policies or that risks are managed, so it is not an essential component for enforcing accountability.

Increase the model's temperature setting to reduce deterministic recall of training data.

Why it fails: Temperature affects the randomness of token sampling, not the model's access to retrieved context or memory. Raising temperature does not prevent PII from being retrieved or repeated; it may even increase the likelihood of incoherent or unpredictable outputs. This is not a reliable privacy control and does not address the retrieval and memory risks.

Require human agents to sign an acceptable use policy prohibiting them from viewing PII.

Why it fails: An acceptable use policy is a procedural control that governs human behavior, but it does not prevent the AI assistant from generating or surfacing PII. Agents may need to view PII to resolve customer issues, making the policy impractical. The risk is technical in nature and requires technical controls rather than relying solely on user obligations.

Apply differential privacy during fine-tuning of the assistant on historical transcripts.

Why it fails: Differential privacy during fine-tuning reduces the chance that training data can be memorized and extracted. However, the scenario describes leakage through cross-session retrieval and memory, not through training data extraction. While valuable as a defense-in-depth measure, it does not address the runtime retrieval path that is the primary concern here.

Documenting the model architecture and hyperparameters in the model registry.

Why it fails: Documenting architecture and hyperparameters supports reproducibility and governance but is a static record, not a continuous risk monitoring activity. It provides no ongoing signal about whether the deployed triage model is drifting, underperforming, or producing unsafe recommendations in current clinical use.

Conducting a one-time fairness audit before the system goes live.

Why it fails: A one-time pre-deployment fairness audit establishes a baseline but does not provide continuous visibility. Fairness can degrade over time as patient demographics and clinical practices change, so a single audit cannot detect emerging disparities during live operation of the triage system.

Reviewing the model's original validation accuracy report from the pre-deployment assessment.

Why it fails: The original validation accuracy report is a static, point-in-time artifact from before deployment. While useful as a baseline, it does not provide continuous visibility into current risk conditions and cannot detect performance degradation, drift, or emerging failure modes in the live clinical environment.

Encrypt the model's parameters at rest and in transit.

Why it fails: Encryption protects the model from theft but does not prevent an attacker from querying the API and performing model inversion. Once the model is deployed and accessible, encryption of parameters does not stop inference-based attacks. It addresses a different threat (model exfiltration) rather than model inversion.

Use a model architecture with fewer parameters to reduce its memorization capacity.

Why it fails: While smaller models may memorize less, this is not a reliable or sufficient mitigation for model inversion. It may reduce accuracy and does not provide a guarantee. Attackers can still exploit even simple models. Proven techniques like differential privacy and output minimization are more effective and targeted.

Implement rate limiting on the API to restrict the number of queries per user per hour.

Why it fails: Rate limiting can slow down an attacker but does not prevent model inversion if the attacker is patient or uses multiple accounts. It is a useful secondary control but not sufficient on its own. Model inversion can often be achieved with a limited number of queries, so rate limiting alone does not adequately mitigate the risk.

Restrict clinician access to the model's inputs so that staff cannot second-guess the recommendation with incomplete information.

Why it fails: Hiding inputs undermines oversight by removing the basis on which a clinician could form an independent judgment. Clinicians already have access to patient data; concealing which features the model used prevents them from noticing that a relevant factor was omitted or misweighted. This design increases rather than decreases the risk of inappropriate reliance on the model.

Configure the model to auto-populate the triage decision and require the clinician to click a single confirmation button to accept it.

Why it fails: A one-click confirmation invites automation bias, where the clinician accepts whatever is displayed without independent evaluation. The activity becomes a formality rather than a control. This design would satisfy an audit checklist while failing the substantive purpose of oversight, which is to catch cases where the model's recommendation is wrong for the patient in front of the clinician.

Limit oversight to a monthly aggregate dashboard review by the quality committee after decisions have already been executed.

Why it fails: Retrospective aggregate review cannot prevent harm to the individual patient whose triage decision has already been made. It is a monitoring and governance activity, valuable in its own right, but it is not human oversight of the decision. The scenario calls for oversight that operates at the point of decision, so post-hoc committee review does not meet the requirement.

AI systems are exempt from data protection regulations because their outputs are statistical rather than factual.

Why it fails: This is a legal misconception with no basis in AI risk management. AI systems processing personal data remain fully subject to applicable privacy regulations regardless of how outputs are generated. Including this as a distinguishing characteristic would introduce a materially false premise into the taxonomy and could lead to unlawful control gaps, so it must be excluded.

AI models are subject to the same patch management and vulnerability disclosure cycles as conventional enterprise software.

Why it fails: This describes a similarity, not a distinguishing characteristic, and is largely inaccurate for models. Models are not patched in the traditional sense; issues are addressed through retraining, fine-tuning, prompt or guardrail changes, or version replacement. Conflating model updates with software patching leads to incorrect control design and misaligned SLAs, which is why this characteristic should not be included.

AI models always produce deterministic outputs, allowing identical risk treatment to traditional deterministic business logic.

Why it fails: This is factually incorrect and would undermine the taxonomy. Many AI systems, particularly those using sampling or stochastic training, produce non-deterministic outputs for identical inputs. Even deterministic inference can yield inconsistent behavior across model versions. Treating AI as equivalent to deterministic business logic ignores variability, drift, and version sensitivity, defeating the purpose of an AI-specific taxonomy.

Using only AI for all HR decisions.

Why it fails: Excluding humans from HR decisions removes the oversight the Human-in-the-Loop model requires, since a person must review or approve AI outputs affecting people. It is tempting because full automation suits high-volume, low-risk tasks, but HR decisions carry legal and ethical weight demanding human judgement.

Allowing humans to override without logging.

Why it fails: Unlogged overrides destroy the audit trail that human-in-the-loop governance depends on, leaving no evidence of who changed an automated decision. It tempts because override capability itself is expected, and would be correct only if every override were recorded with reviewer identity, rationale and timestamp.

Removing humans to save money.

Why it fails: Removing humans eliminates the review step entirely, so no oversight, escalation or accountability remains for automated decisions. It tempts because cost reduction is a legitimate driver, and would be correct for fully automated, low-risk processes where human review adds no governance value.

A vendor contract template requiring AI suppliers to disclose training data sources

Why it fails: Supplier disclosure requirements are valuable third-party risk controls, but they address only external AI components. They do not create internal consistency for AI systems built or operated in-house, nor do they establish principles, risk appetite, or decision rights, so they are not a core structural component of the governance framework itself.

A monthly newsletter summarizing emerging AI regulations for interested employees

Why it fails: Awareness communications help culture and knowledge but are not structural governance components. A newsletter does not establish mandatory controls, risk appetite, or decision rights, so it cannot ensure consistent AI development and operation across units. It supports the framework rather than forming part of it.

A data loss prevention tool configured to block outbound transfers of model weights

Why it fails: Blocking exfiltration of model weights is a security control that protects intellectual property and reduces leakage risk. Important as it is, it is a technical safeguard rather than a governance structure. It does not define principles, assign decision rights, or create consistent treatment of AI across business units.

Require vendors to use the same AI development tools and platforms as the organization to ensure compatibility.

Why it fails: Mandating identical tools is impractical and does not address governance integration. Vendors may have their own specialized tools, and compatibility is not a primary risk concern. This activity focuses on technical uniformity rather than risk management, transparency, or security, and thus does not help integrate third-party AI into the governance framework.

Delegate all AI risk management responsibilities to the vendor and rely on their internal governance processes.

Why it fails: Delegating risk management entirely to the vendor is inappropriate because the organization remains accountable for AI risks. Regulators and stakeholders expect the organization to exercise oversight, not outsource it. This approach fails to integrate third-party AI into the governance framework and leaves the organization exposed to unmanaged risks.

Limit vendor AI usage to non-critical business functions to reduce potential impact.

Why it fails: While limiting usage can reduce risk, it does not integrate third-party AI into the governance framework. It is a risk avoidance tactic rather than a governance activity. The goal is to manage vendor AI risks systematically, not to avoid them entirely, especially if the AI provides significant business value. This option does not address the need for oversight and transparency.