AI Security in Governance, Awareness, and Continuity
Key Takeaways
The CC outline page integrates AI concepts into all five domains; the Domain 2 points cover awareness, continuity, and metrics.
Back up the configurations and datasets that power AI services, not only traditional business data.
The outline names model drift, where declining AI performance could affect critical operations, as a potential BC and DR risk.
AI-specific Key Risk Indicators belong on the same dashboards and reports as other effectiveness measures.
Source: ISC2 CC Exam Outline page, 'How is AI Security Incorporated into the CC Domains?' (Domain 2), checked 2026-10-22.
What the Outline Adds for AI in Domain 2
The CC outline page explains that AI is integrated into all five domains. For Domain 2, it gives entry-level practitioners four points:
- AI complicates and enhances resilience. AI-driven tools can assist in the early identification and reporting of security incidents.
- Security awareness covers AI-enabled attacks. Candidates complete updated security training that recognizes how AI escalates social engineering and phishing.
- Continuity covers AI assets. Back up the specific configurations and datasets that power AI services. The outline names model drift as a potential BC and DR risk, where declining AI performance could affect critical operations.
- Metrics track AI risk. Candidates track AI-specific Key Risk Indicators through dashboards and reports to help keep intelligent systems available during and after a disruption.
Source: ISC2 Certified in Cybersecurity outline page, AI guidance, Domain 2 paragraph, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Applying the Points
A practical sequence for a Domain 2 item: identify which AI service the operation depends on, confirm that its configuration and data are included in backups and the continuity plan, define a KRI that would show its performance declining (for example, a drift indicator), and place that KRI on the same dashboard as the other measures.
This links the AI guidance to subdomain 2.2 (business continuity and disaster recovery) and subdomain 2.4 (metrics). The outline does not require knowledge of a specific AI product.
According to the CC outline page's AI guidance for Domain 2, which risk is named for AI systems?
Model drift, where declining AI performance could affect critical operations
Hardware warranty expiry on AI servers, which could affect vendor support coverage
Excess disk space in the AI cluster, which could affect unused storage capacity
Automatic changes to the vendor billing cycle, which could affect invoice dates
Sections you finish are checked off in the contents.