Privacy and AI Governance
Key Takeaways
Privacy is a named concept in subdomain 1.1; governance of data and of AI tools is covered under subdomain 1.3.
The CC outline page says privacy must be protected when handling AI training data.
AI tools follow the same organizational policies and legal requirements as other software.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 1.1 and 1.3, and the CC outline page, checked 2026-10-22.
Privacy as a Governance Question
Subdomain 1.1 names privacy, and subdomain 1.3 names the policies, standards, and procedures that govern how an organization handles information. Privacy asks whether personal information is collected, used, shared, and kept appropriately. A governance answer decides who approves the handling and records that approval.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 1.1 and 1.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
AI Tools Under Governance
The CC outline page states that AI tools are subject to the same organizational policies and legal requirements as traditional software. It also says privacy must be protected when handling AI training data, and that data integrity matters for preventing model poisoning. A proposal to use an AI tool with sensitive records should therefore go through the same policy approval as any other system, with the privacy and integrity questions answered first.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 1, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.1: Confidentiality
- 1.1: Integrity
- 1.1: Availability
- 1.1: Authentication, Authorization, Accounting (AAA)
- 1.1: Non-repudiation
- 1.1: Privacy
- 1.3: Regulations and laws
- 1.3: Frameworks and guidelines
- 1.3: Policies, standards (e.g., ISO, Center for Internet Security), procedures
Common Traps
A common trap is naming the wrong objective. If the scenario is about who acted, the objective is accountability, not availability. Name the objective the scenario states before choosing among controls.
According to the CC outline page, what governs an AI tool that handles sensitive records?
The same organizational policies and legal requirements as other software
No policy applies, because the tool learns on its own and sets its own rules
Only the vendor's terms apply, not the organization's own policy at all
Only the tool's marketing claims apply, since they describe how it works
Which concerns does the outline page raise for AI training data? Select all that apply.
Select all that apply
Privacy must be protected
Data integrity helps prevent model poisoning
The tool may be used without any approval
Traceability of AI-generated actions
Sections you finish are checked off in the contents.