Exam AAISM Topic 2 Question 306 Discussion

Actual exam question for ISACA's AAISM exam
Question #: 306
Topic #: 2
Security and assurance requirements for AI systems should FIRST be embedded in the:

Suggested Answer: A Vote an answer

AAISM directs organizations to embed security, safety, and compliance controls at design time ("secure- by-design" and "shift-left"), ensuring requirements for robustness, privacy, and governance are defined as non-functional constraints on architecture, data sourcing, model choices, and evaluation criteria before any model is trained. Deferring these requirements to training, testing, or deployment increases residual risk and rework, and weakens traceability of control coverage.
References:* AI Security Management (AAISM) Body of Knowledge: Governance-Secure-by-Design; Policy-to-Control Traceability; Requirements Management* AAISM Study Guide: AI Program Lifecycle- Planning & Design Controls; Design-time Threat Modeling and Control Selection* AAISM Mapping to Standards: Design-phase Risk Identification and Requirements Engineering for AI

by Hugh at Oct 14, 2026, 01:17 AM

Limited Time Offer

15%

Off

Get Premium AAISM Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10