Security, Privacy and Trust
This topic evaluates AI security, privacy, confidentiality, integrity, availability, trust, data protection, access controls, and assurance expectations.
How to study for ISACA AAIA
Treat each item as an audit decision: understand AI risk, identify criteria, test evidence, assess control effectiveness, then report impact and follow-up.
Core concepts
Concept 1
AI security protects models, data, prompts, tools, APIs, infrastructure, outputs, logs, and integration points.
Exam cue: Include prompts, outputs, embeddings, and logs in privacy and security scope.
Concept 2
Privacy controls address lawful basis, data minimization, consent, retention, sensitive data, subject rights, and data leakage.
Exam cue: Test access controls across source data, retrieval, tools, and model endpoints.
Concept 3
Trust depends on accuracy, reliability, transparency, resilience, safety, security, and evidence-based oversight.
Exam cue: Tie trust claims to evidence, monitoring, and incident response.
Risk pitfalls and guardrails
Securing the model endpoint but ignoring prompt and output data.
Guardrail: Avoid treating AI audit as only a technical scan, accepting management assertions without evidence, or omitting prompts, data, vendors, and monitoring.
Treating privacy as solved because source data was already approved.
Guardrail: Avoid treating AI audit as only a technical scan, accepting management assertions without evidence, or omitting prompts, data, vendors, and monitoring.
Using trust language without measurable controls or audit evidence.
Guardrail: Avoid treating AI audit as only a technical scan, accepting management assertions without evidence, or omitting prompts, data, vendors, and monitoring.
Memory anchors
AI Security Scope
AI security scope includes models, data, prompts, APIs, tools, infrastructure, logs, outputs, and dependencies.
Data Minimization
Data minimization limits AI processing to data needed for the approved purpose.
Sensitive Data
Sensitive data requires stricter controls because exposure could harm people, compliance, or trust.
Access Control
Access control restricts who can use AI assets, source data, tools, and generated outputs.
Trust Signal
A trust signal is evidence that AI behavior is accurate, reliable, safe, monitored, and accountable.
Output Leakage
Output leakage occurs when an AI system reveals confidential, restricted, or personal information.
Privacy Impact
Privacy impact evaluates how AI processing affects personal data, rights, notices, and obligations.
Availability Control
Availability control keeps AI-supported services resilient enough for business needs.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
An AI assistant's model endpoint is secured, but prompts and outputs are stored in an open analytics workspace. What is the PRIMARY concern?
Which control BEST enforces data minimization for an AI claims assistant?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”