AI Governance and Program Management

How the AI security program is governed and run: stakeholders, frameworks and regulation, AI security strategy and policies, AI asset and data life cycle management, program development and metrics, and business continuity and incident response for AI.

5 minutes 5 Questions

AI Governance and Program Management, within Advanced AI Security Management, refers to the structured framework an organization establishes to direct, control, and continuously improve how artificial intelligence systems are developed, deployed, secured, and monitored throughout their lifecycle. I…

Concepts covered
Data Protection Law and AI ProcessingBoard and Executive Reporting on AI SecurityDisaster Recovery for Models, Data and PipelinesRisk-Tiered AI Regulation and Prohibited UsesShadow AI Discovery and Policy EnforcementAI Security Program Roadmap, Resources and BudgetAI Incident Response Playbooks and EscalationSector and Contractual Requirements for AI SecurityAdding AI Requirements to Existing Security PoliciesTraining Data Provenance and Lineage RecordsInvestigating and Documenting AI Security IncidentsAI Asset Inventory and Model RegistryClassification of AI Systems and Their DataBusiness Continuity Planning for AI-Dependent ProcessesThird-Party Assurance Reporting for AI SecurityISO/IEC 42001 AI Management SystemsBuilding the AI Security ProgramUsing AI to Improve Security OperationsNIST AI Risk Management Framework for Security ManagersIP and Licensing of Models and DatasetsAI Data Life Cycle From Collection to DisposalDetecting and Triaging AI Security IncidentsAI Security Incident Definition and ClassificationOWASP Top 10 for LLM Applications and MITRE ATLASAI Acceptable Use Policies and Generative AI GuidelinesPolicy Exceptions and Risk Acceptance for AI UseRoles and Responsibilities in AI Security PoliciesAI Governance Charter, Committee and RACIAI Security Strategy Aligned to Business ObjectivesAI Asset Decommissioning and Model RetirementRetention and Secure Disposal of AI Data and ModelsManaging Embedded AI Features in Enterprise SoftwareSelecting and Implementing AI Security ToolsResponsible AI Principles and Ethical Use MandatesAI Security Metrics, KPIs and KRIsAI Security Stakeholders and Their ExpectationsData Ownership, Stewardship and Custodianship for AIPost-Incident Review and Lessons Learned for AI SystemsReporting AI Security Program PerformancePolicy Review Cycles for a Fast-Moving AI LandscapeAI Standards, Procedures and Guidelines HierarchyContainment, Eradication and Recovery for AI IncidentsRegulatory and Contractual Incident Reporting for AIAI Security Program Maturity AssessmentAI Security in the SDLC and MLOps PipelinesAI Security Awareness Training ProgramsAI-Specific Security Policy Development
Test mode:
Start practice test

AAISM - AI Governance and Program Management Example Questions

Test your knowledge of AI Governance and Program Management

Question 1

An enterprise licenses a third-party provider's foundation model weights and runs the model on its own infrastructure. During vendor review, the provider supplies a Type 2 trust services report with an unmodified opinion and no exceptions. The report covers the provider's hosted inference platform. What is the MOST important conclusion for the information security manager?

Correct Answer: The report covers the vendor's hosting, so controls over the self-run model must be assessed internally

The Type 2 report only gives assurance over the scope it examined, the provider's hosted inference platform. Because the enterprise runs the licensed weights on its own infrastructure, the controls that matter (access, integrity, deployment, monitoring) sit outside that scope and must be assessed internally.
Claiming the report supports reliance on the model misapplies assurance over hosting to a different deployment. A bridge letter only addresses the gap after the report period, not a scope mismatch. Mapping to user entity controls assumes the report carves out the weights, which it does not state. Complementary user entity controls also would not cover a self-hosted environment.
Key concept: third-party assurance report scope alignment with the actual deployment model.

Question 2

An information security manager reviews a third-party LLM provider's Type 2 report. The service auditor noted an exception: privileged access to the model weights repository was not reviewed quarterly during the period. In a section titled 'other information,' the provider states that the issue was remediated after the period ended. What should the manager do NEXT?

Correct Answer: Obtain evidence that the remediated review operates, as that section is unaudited

In a SOC 2 Type 2 report, the section titled other information is supplied by the service organization and is not covered by the auditor's opinion, so the manager must obtain independent evidence that the remediated access review actually operates.
Asking the auditor to reissue the opinion is wrong because the opinion covers only the stated period, and post-period fixes do not change what was tested. Recording the exception as accepted residual risk is wrong because only the business owner can accept risk, and the facts are not yet validated. Treating the exception as closed is wrong because management's unaudited assertion is not assurance.
Key concept: unaudited management responses in third-party assurance reports require independent validation.

Question 3

In a Type 2 trust services report on a third-party AI provider's service, what is the PRIMARY purpose of the management's written assertion section?

Correct Answer: Affirms the provider's claim that its system description is fair and its controls met the criteria

The management assertion is the service organization's own written claim that its system description is fairly presented, that its controls were suitably designed, and, in a Type 2 report, that those controls operated effectively against the trust services criteria throughout the period.
The auditor's independent conclusion belongs in the service auditor's opinion, not management's assertion. Controls the customer must operate are complementary user entity controls, which appear in the system description. Remediation plans for exceptions are optional management responses, not the assertion's purpose.
Key concept: separating management's assertion from the auditor's opinion in SOC 2 Type 2 reports.

More AI Governance and Program Management questions
937 questions (total)
Practice 100 questions
One session at a time, always new questions