AAISM AI technologies and controls
AI Technologies and Controls is worth 38% of AAISM — around 34 of the 90 questions and the largest single domain. ISACA describes it as optimising AI security through security technologies, techniques and controls tailored to AI systems.
This is the domain CISM and CISSP holders underestimate. The credential is called security management, so candidates expect governance and risk to dominate. They do not. The technical domain is the biggest, and it is the one furthest from existing experience.
It remains a management exam — you are not configuring anything — but you must know which control addresses which weakness, and why.
AI security architecture and design
Where controls sit around a model:
- Trust boundaries. The most important idea in the domain. In a traditional application, input is data. In an instruction-following system, input can be instruction. Any design that lets untrusted content reach a privileged model without separation is flawed by construction.
- Isolation. Separating training environments from production, and separating models that handle different data sensitivities.
- Control points. A gateway in front of model traffic, where policy, filtering, throttling and logging are applied consistently rather than per application.
- Least privilege for the model itself. A model with tool access is a principal. What can it reach, and what happens if it is manipulated into using that reach?
The AI lifecycle: selection, training, validation
ISACA names these three explicitly, and each carries a security decision:
Selection. Build, buy or use an API — each has a different risk profile. Open weights you can inspect and host; a hosted API you cannot inspect but do not have to protect yourself.
Training. Data provenance and integrity, environment separation, and who can initiate a training run. Unauthorised fine-tuning is a real change to production behaviour.
Validation. Testing before release, and what you test for: accuracy, robustness against adversarial input, fairness across groups, and whether outputs leak. Validation evidence is also what you show a regulator later.
Data management controls
- Provenance — a defensible record of where data came from
- Integrity — detecting modification of training data
- Minimisation — not training on what you do not need, the cheapest privacy control available
- Segregation — keeping datasets of different sensitivity apart
- Retention and disposal — including the awkward truth that removing data from a dataset does not remove its influence from a trained model
Privacy, ethical, trust and safety controls
Expressed as things you implement and can evidence, not as principles you endorse:
| Concern | The control |
|---|---|
| Training data resurfacing in output | Minimisation plus output filtering |
| Unfair outcomes between groups | Bias testing before and after deployment |
| People not understanding a decision | Explanation and an appeal route |
| Harmful generated content | Content filters and guardrails |
| Unaccountable automated decisions | Human oversight with authority to override |
Security controls and monitoring
What to monitor for an AI system is different from what you monitor for an application:
- Prompts and outputs, within privacy constraints — the only place abuse is visible
- Groundedness and accuracy over time, to detect drift
- Query patterns, since systematic high-volume querying suggests extraction
- Safety events — what the filters blocked, and what got through
- Tool and action logs for agents, because those are the consequential events
Infrastructure monitoring will not tell you a model is being abused. That gap is a recurring exam theme.
Sample questions
Question 1. An application passes user-submitted text to a model that holds permissions to call internal systems. Which architectural weakness does this MOST directly represent?
- A. Insufficient compute allocated to the model
- B. A trust boundary failure: untrusted input reaches a privileged system without separation
- C. A missing data retention policy
- D. Weak encryption of the model weights at rest
Show answer
Answer: B
Untrusted input reaching a privileged instruction-following system with no separation between data and instructions is a trust boundary failure, and it is the design flaw behind prompt injection with consequences. Insufficient compute, a missing retention policy and weak encryption are real concerns but none describes the architectural fault here.
Question 2. Monitoring shows a single client sending large volumes of systematically varied queries to a public model endpoint over several weeks. Which threat does this MOST likely indicate?
- A. Model extraction
- B. Data poisoning
- C. Denial of service
- D. Model drift
Show answer
Answer: A
Systematic high-volume querying designed to map a model’s behaviour is the signature of model extraction, and query pattern monitoring is how it is detected. Data poisoning acts on training data, a denial of service would degrade availability, and drift is a gradual change in performance rather than an attacker behaviour.
Question 3. An enterprise wants a single place to enforce filtering, rate limiting and logging across every application that calls its models. Which design approach BEST meets this?
- A. Implement filtering and logging separately in each application
- B. Encrypt the model weights at rest in every environment
- C. Route all model traffic through a gateway that applies policy, filtering and logging centrally
- D. Increase the capacity of the model deployment
Show answer
Answer: C
A gateway in front of model traffic applies policy consistently regardless of which application is calling, which is what enforcing controls in one place requires. Implementing controls in each application guarantees inconsistency, encrypting weights protects an artefact rather than traffic, and increasing capacity is unrelated to enforcement.
What to practise
For one AI system you know, write four short lists: where its trust boundaries are, what was validated before release, which data controls apply to its training set, and what is monitored. Any list you cannot complete is where this domain will find you — and because it is 38% of the paper, that is the most valuable hour of preparation available.