AI Data Governance: Acquisition, Storage, Retention and Destruction

This episode of the ISACA Advanced in AI Security Management (AAISM) exam prep series shows how to extend traditional data governance to keep up with AI. Because AI lives or dies by its data, the governance program has to follow that data from the moment it enters the organization through to the moment it is destroyed — touching every stage of the AI life cycle with controls that match the heightened risk AI introduces.

Frequently Asked Questions

What is the guiding principle of AI data governance?

AI data governance should build on the organization’s existing data governance, not replace it, since security enhancements work best when layered on practices already in place. Because AI depends so heavily on data, security teams must now think about data management in ways they never had to before, across the entire life cycle.

What questions should you ask during AI data acquisition?

Ask about the data’s true origin. If it is not personal data, what are the responsibilities and confidentiality terms around it? If it is personal data, is the right consent in place, does that consent actually match how you intend to use it, and is it still current? A crucial insight is that almost all data traces back to people somehow, so the human fingerprint is everywhere.

What are the three key controls for AI data organization and preparation?

The three controls are dataflow mapping, which documents every data element and where it physically lives down to the hardware; access control review, applying least privilege so only the right people reach training data and the model; and data integrity monitoring, watching the cleansing and standardization steps closely.

What special considerations apply to AI data utilization and storage?

Considerations include monitoring privacy-by-design more frequently with automated decision-making, treating any newly generated data with the same acquisition rigor, applying dynamic information-flow controls that adapt to the threat environment, and classifying AI-generated output just like any other data. Throughout, pay particular attention to encryption in every state, applied consistently.

What should you watch for before destroying AI data?

Destruction should follow the retention schedule and the organization’s documented processes, but with one caution: if an AI process produced unexpected results, consider whether an incident investigation is needed before destroying anything, since that data may be evidence. With deep learning, data creation and deletion are not always transparent at every stage, which makes continuous higher-than-usual monitoring essential.

Reference: This article is based on concepts discussed in AI Data Governance: Acquisition, Storage, Retention & Destruction.