AI Data Management Controls
Data controls cover collection, classification, minimization, consent, quality, access, retention, deletion, leakage prevention, and retrieval governance.
How to study for ISACA AAISM
Treat each item as a management decision: identify the AI asset and stakeholder, assess risk, select governance or control action, then document evidence and accountability.
Core concepts
Concept 1
AI data controls should protect training, tuning, retrieval, prompt, output, log, and feedback data across the lifecycle.
Exam cue: Use minimization before sending sensitive data to a model or provider.
Concept 2
Data minimization limits AI use to data needed for the approved purpose and risk profile.
Exam cue: Use access controls and filters so retrieval honors user authorization.
Concept 3
Data quality controls improve accuracy, completeness, relevance, timeliness, labeling, and suitability for intended AI use.
Exam cue: Use quality controls when poor data creates security, safety, or compliance risk.
Risk pitfalls and guardrails
Allowing retrieval to expose content a user could not otherwise access.
Guardrail: Avoid treating AI security as only a technical scan, accepting risk without authority, or leaving prompts and data outside governance.
Retaining prompts and outputs longer than policy permits.
Guardrail: Avoid treating AI security as only a technical scan, accepting risk without authority, or leaving prompts and data outside governance.
Ignoring feedback data even though it may contain sensitive information.
Guardrail: Avoid treating AI security as only a technical scan, accepting risk without authority, or leaving prompts and data outside governance.
Memory anchors
Data Minimization
Data minimization limits collection, processing, and retention to what is needed for the approved AI purpose.
Retrieval Filter
A retrieval filter prevents AI systems from returning content outside user, tenant, policy, or context limits.
Data Quality
Data quality measures accuracy, completeness, relevance, timeliness, consistency, and fitness for AI use.
Feedback Data
Feedback data includes user ratings, corrections, comments, examples, and review notes used to improve AI systems.
Prompt Log
A prompt log records user inputs and context and may need privacy, retention, and access controls.
Output Retention
Output retention defines how long generated responses are stored and how they are protected or deleted.
Consent
Consent is permission for specific data processing where required by law, policy, or ethical commitment.
Leakage Prevention
Leakage prevention reduces unauthorized exposure through prompts, retrieval, outputs, logs, or integrations.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A support assistant sends entire customer profiles to a model though it needs only product and issue details. Which control is MOST appropriate?
Which evidence BEST demonstrates that controls over data minimization operated throughout the review period?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”