Chapter 3 of 3 · ISACA AAISM
AI Technologies and Controls
AI security architecture, the AI life cycle, data controls, privacy, ethics, trust and safety, and AI controls and monitoring.
- 7topics
- 36 minfast track
- 1diagrams and exhibits
- 38%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1AI Security Architecture and Design PrinciplesDesigning security architecture for AI: system components, trust boundaries, untrusted model output, least privilege, segregation…Diagram6 min
- 2AI in Enterprise Architecture, RAG and AgentsAdvising on AI within enterprise architecture: deployment options, shared security services, reference patterns, and securing RAG…5 min
- 3Securing the AI Life CycleSecurity across the AI life cycle: model selection, secure training and fine-tuning, independent validation, release gates…5 min
- 4Data Management Controls for AITreating risk in data used by AI: provenance and lineage, quality and labelling, poisoning defences, minimization, sensitive data…5 min
- 5Privacy, Ethics, Trust and Safety ControlsPrivacy-enhancing techniques, fairness and bias, explainability, transparency, risk-based human oversight and trust and safety…5 min
- 6Designing and Reviewing AI Security ControlsSelecting AI security controls to treat risk to an acceptable level: input, model, output, access and data controls, defence in…5 min
- 7AI Security Monitoring, Metrics and ToolsMonitoring AI in production: what to log, detection use cases, drift and integrity monitoring, security metrics and thresholds…5 min
About this chapter
What this chapter covers
AI Technologies and Controls is 38% of the ISACA AAISM exam, the largest domain. It covers the security technologies, techniques and controls tailored to AI systems, seen from the manager who must design, approve and review them rather than configure them by hand.
The domain covers AI security architecture and design (3A), the AI life cycle from model selection through training and validation (3B), data management controls (3C), privacy, ethical, trust and safety controls (3D), and security controls and monitoring (3E).
The exam has 90 multiple choice questions, and candidates must already hold CISM or CISSP. Questions are vendor-neutral and management-focused: you choose the BEST control for a risk, what is MOST important in a design, or what the manager should do FIRST when monitoring shows a problem. Knowing why a control fits an AI risk matters more than knowing any product.
How the topics fit together
Architecture sets where AI sits and where trust ends. The life cycle builds security in from model selection to retirement, data controls protect what models learn from and retrieve, privacy and safety controls protect people, and monitoring proves the controls keep working.
When two answers both reduce AI risk, prefer the one that limits impact by design, such as least privilege for an agent or a trust boundary around model output, over one that relies on the model behaving well.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.