Exam AAISM Topic 2 Question 129 Discussion

AAISM directs organizations to manage third-party AI risks through contractual and technical controls that explicitly govern data use, retention, training/fine-tuning, isolation, and deletion. The most effective data- security action when consuming generative AI features is to require enforceable opt-out provisions that prohibit the provider from using the organization's data for training or secondary purposes and that mandate retention limits and secure deletion. Third-party audit reports (A) provide assurance but do not guarantee provider behavior for your specific data; awareness policies (B) are necessary but insufficient to control external processing; IP ownership guidelines (D) address legal rights, not data-security risk.
References: AI Security Management™ (AAISM) Body of Knowledge - Third-Party/Procurement Controls; Data Use & Retention Clauses; Training/Fine-tuning Opt-Out; Secure Deletion and Purpose Limitation.