Isaca AAISM Exam Dumps

AAISM instructs that acceptable risk thresholds must be determined using business impact analysis. This aligns with the broader enterprise risk management principle of defining tolerances based on:

* potential harm

* regulatory exposure

* financial impact

* operational disruption

Monitoring (A) detects attacks but does not set thresholds. Blocking special characters (B) is unrealistic and overly restrictive. Static thresholds (D) ignore business context and practicality.

============================================

The AAISM governance framework emphasizes that the inherent limitations of generative AI---including hallucinations, bias, and unpredictability---are best mitigated by human oversight. Human-in-the-loop review ensures that outputs are validated before being used in sensitive or high-risk contexts. Regulatory adoption, system classification, and reverse engineering all play supporting roles but do not directly safeguard against the model's inherent unpredictability. Governance best practices highlight human oversight as the critical safeguard.

AAISM Exam Content Outline -- AI Governance and Program Management (Human Oversight and Accountability)

AI Security Management Study Guide -- Mitigating Generative AI Limitations

According to AAISM, hyperparameter tuning uses validation data, not training or test data. Validation datasets are specifically designed to evaluate different hyperparameter configurations without contaminating the training or testing sets.

Training data (C) teaches the model. Test data (D) is used only for final evaluation. Configuration data (B) is unrelated to performance optimization.

============================================

AAISM recommends aligning AI adoption with organizational risk appetite by limiting blast radius, protecting sensitive data, and staging adoption in lower-risk domains first. Building a private LLM for non-critical functions preserves data control, enables tighter governance (access control, logging, evaluation), and confines any model errors away from safety- or mission-critical operations. A public LLM for critical functions (A) is misaligned with a high-assurance posture; buying open-market datasets (B) raises provenance and licensing risk; third-party access (C) can be appropriate but still introduces vendor/visibility limits and data residency concerns that may not meet aerospace security needs.

The greatest immediate risk from unsanctioned use of public or open-source generative AI tools is data leakage---employees may paste confidential or regulated information into third-party systems, resulting in loss of confidentiality, regulatory exposure, and loss of intellectual property. AAISM emphasizes that when AI use occurs outside approved channels, the top control priority is preventing exfiltration of sensitive data via prompts, attachments, and context sharing. Monitoring and policy are necessary enablers, but leakage is the highest-impact failure mode in the short term; hallucinations primarily affect accuracy, not confidentiality.

===========