Security of the AI Workspace
Key Takeaways
The CC outline page says candidates identify the risk of data leakage when employees interact with public AI services.
The same page asks for data handling (classification, masking, sanitization) and encryption from symmetric to quantum resistant.
Protect the AI workspace the same way as other data stores, under the data handling rules.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 5, checked 2026-10-22.
The Risk
The CC outline page describes the Security of the AI Workspace. It asks candidates to identify the risk of data leakage when employees interact with public AI services. Sensitive information pasted into a public service may leave the organization's control.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 5, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
The Controls
The same guidance asks candidates to apply data handling (classification, masking, and sanitization) and encryption, from symmetric to quantum resistant cryptography, to protect the organization. In a scenario, first classify the data, then decide whether it may be shared with the service at all, and mask it if the task allows.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.1: Data handling (e.g., classification, labeling, masking, and sanitization)
- 5.1: Encryption (e.g., symmetric, asymmetric, hashing, quantum resistant cryptography)
Common Traps
A common trap is using the wrong handling step. Classify and label first; sanitization removes data for disposal or reuse, while masking hides values that remain in use.
An employee wants to paste a customer contract into a public AI service. What does the CC outline page's Domain 5 AI guidance ask a candidate to identify and apply?
Identify the data leakage risk and apply data handling rules
Paste the contract because the service is fast and easy to use
Share the contract with the whole company so everyone sees it
Delete the contract without a record so it cannot be traced
Treat any public AI service as an external destination in the data handling decision. Classify the data before anyone pastes it into the service, and apply the controls the classification requires.
Sections you finish are checked off in the contents.