AAISM lesson 1: AI security management

AI security management is the discipline of keeping AI systems trustworthy, controlled and accountable across their whole life, and of advising the business on how to adopt them without unacceptable risk. It differs from classic IT security because the behaviour of an AI system comes from data and learned weights rather than from code that can be read, so the attack surface, the failure modes and the evidence all change. The AAISM exam has 90 questions split over three domains weighted 31%, 31% and 38%, and its outline is framed around advising stakeholders and managing a programme rather than hands-on engineering.

What changes when the system learns

A conventional application does what its code says, so reviewing and testing the code makes behaviour largely predictable. An AI system differs in four ways.

• Behaviour is statistical. The same input can produce different outputs, and “correct” is a matter of degree. Controls need measurable thresholds.
• Data is part of the attack surface. Training, fine-tuning and retrieval data shape what the system does. Tampering with data changes behaviour without touching code.
• The inputs are instructions. In language models, text supplied by users or pulled from documents can steer the system. Data and command blur together.
• Risk moves on its own. As the world drifts away from the training data, performance and fairness can degrade.

None of this replaces the fundamentals: confidentiality, integrity, availability, access control, logging and incident response all still apply. The manager extends an existing programme to cover new asset types and failure modes. The topic page on AI governance and risk covers the framework vocabulary in more depth.

The shape of the outline

The figure shows the outline, and the course follows its order. Domain 1, AI Governance and Program Management (31%), covers stakeholders and frameworks (1A), strategy and policy (1B), asset and data life cycle (1C), the security programme (1D) and continuity and incident response (1E). Domain 2, AI Risk Management (31%), covers risk assessment and treatment (2A), threats and vulnerabilities (2B) and vendors and supply chain (2C). Domain 3, AI Technologies and Controls (38%), covers architecture (3A), the AI life cycle (3B), data controls (3C), privacy, ethics, trust and safety (3D) and security controls and monitoring (3E).

ISACA also lists 22 supporting tasks, such as conducting impact assessments or defining security metrics, that are not tied to one domain. The domains build on each other: governance decides what is allowed, risk management decides what is acceptable, and controls make both real.

Stakeholders, frameworks and regulation

Subtopic 1A starts with people. AI adoption pulls in the business sponsor, legal and privacy, risk and compliance, data owners, engineers and the accountable executives. A manager who treats AI as a purely technical matter misses most of them.

The frameworks fall into three kinds, and it pays to be able to tell them apart.

The OECD AI Principles add a high-level statement of values, including transparency, robustness and safety, and accountability. The three kinds are complementary: regulation says what must be achieved, a framework suggests how to analyse the risk, and a management system keeps it going. Which regulations apply depends on where the organisation operates and what the system does, so the first move is to ask legal. See also responsible AI principles.

A worked example

A 400-person insurer’s claims department plans a vendor-hosted language model to summarise claim files. A good manager does not start with a penetration test. The first questions are structural: who owns the decision, which data the summaries touch, whether any regulator treats claims handling as sensitive, and whether staff already paste claims into a public tool. The answers feed an inventory entry, an impact assessment, a vendor review and a policy check. Only then do technical controls become the right topic.

Easy to confuse

• AI security versus responsible AI. Security protects the system and its data from misuse and compromise. Responsible AI concerns fairness, transparency and harm to people. They overlap in the controls but have different owners and tests.
• Framework versus standard versus law. Only the last is mandatory, and only the middle one is normally certified.

Key points

• AI behaviour comes from data and weights, so data integrity, input handling and drift become security concerns.
• AAISM has 90 questions over three domains: 31% governance, 31% risk, 38% technologies and controls.
• A framework guides, a standard is certifiable, and a regulation binds.
• Establish what exists and what applies before choosing controls.

Check yourself

This lesson opens Domain 1 (31%) of the course; the governance and programme management recap summarises the whole domain for revision.