AI Security in Security Principles
Key Takeaways
The CC outline page integrates AI into the CIA triad, AAA, and non-repudiation within Domain 1.
Data integrity matters for preventing model poisoning.
Privacy must be protected when handling AI training data.
AI tools use technical, administrative, and physical controls and follow the same policies and legal requirements as other software.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 1 paragraph, checked 2026-10-22.
What the Outline Adds for AI in Domain 1
The CC outline page explains how AI affects the core principles in Domain 1:
- Integrity: data integrity is vital for preventing model poisoning.
- Privacy: privacy must be protected when handling AI training data.
- AAA and non-repudiation: AI-generated actions and access should remain traceable and secure.
- Governance: AI tools need a blend of technical, administrative, and physical controls and are subject to the same organizational policies and legal requirements as traditional software.
- Ethics and due care: support leadership in exercising due care and due diligence when adopting AI, consistent with the ISC2 Code of Ethics, the organization's risk appetite, and its expectations for transparency and non-bias.
Source: ISC2 Certified in Cybersecurity outline page, AI guidance, Domain 1 paragraph, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Applying the Points
When an AI scenario appears, map it in order: first to the CIA triad (which goal is at risk?), then to AAA and non-repudiation (can the action be traced to a responsible party?), then to controls and policy (which control type and which policy apply?). This is the same reasoning used for any Domain 1 item, applied to an AI system.
Which statement reflects the CC outline page's AI guidance for Domain 1?
Data integrity matters for preventing model poisoning, and AI tools follow the same policies and legal requirements as other software
AI tools are exempt from organizational policy because they learn on their own and adjust their behavior without staff review
Privacy applies only to traditional databases and not to AI training data, so personal records used in model training need no handling rules
AI actions do not need traceability because models are deterministic, so the same request always gives the same answer and needs no record
Sections you finish are checked off in the contents.