Security and assurance requirements for AI systems should FIRST be embedded in the:

• A. Model training phase
• B. Model testing phase
• C. Model deployment phase
• D. Model design phase

After an organization deploys an AI-based system, a regulator warns of increased risk related to AI re-identification attacks on anonymized data sets. Which of the following should the information security manager do FIRST?

• A. Establish strong access controls for services using anonymized data
• B. Assume anonymization is permanent and continue regular business operations.
• C. Immediately delete anonymized datasets and suspend AI services
• D. Implement a monitoring program including privacy audits and adversarial testing

After an organization deploys an AI-based system, a regulator warns of increased risk related to AI re-identification attacks on anonymized datasets. Which of the following should the information security manager do FIRST?

• A. Implement a continuous monitoring program for re-identification risk, including privacy audits and adversarial testing.
• B. Assume anonymization is permanent and maintain business as usual.
• C. Immediately delete all anonymized datasets and suspend AI services.
• D. Require staff to sign nondisclosure agreements (NDAs) and implement strong access controls for services using anonymized data.

An organization wants to ensure a new AI security program is in alignment with the existing information security program. Which of the following is the BEST course of action?

• A. Draft an initial program that defines AI-specific objectives, governance roles, and reporting responsibilities.
• B. Develop awareness materials for employees and issue AI acceptable use guidelines across the enterprise.
• C. Establish key risk indicators (KRIs) and dashboards to measure AI security performance and present results to management.
• D. Integrate AI security tasks into existing IT operations processes and apply additional technical controls.