AI Security Governance and Assurance

Introduction

Chapter 1: Why AI Security Governance and Assurance Is Different

1. Why AI Security Is Different
2. The Stakes: Real-World Incidents and Failures
3. From Cybersecurity to AI Security: Evolution of the Discipline
4. What This Book Covers and How to Use It
5. The Integrated Approach: Governance, Risk and Assurance

Chapter 2: Foundations of AI Security and Risk

1. Core Terminology and Concepts
2. Understanding AI Risk: Categories and Characteristics
3. AI-Specific Failure Modes
4. The Security-AI-Privacy Triangle
5. Trust, Safety and Reliability: Beyond Traditional Security
6. Accountability and Responsibility in AI Systems

Chapter 3: The AI Threat Landscape and Attack Surfaces

1. Prompt Injection and Indirect Prompt Injection
2. Data Poisoning and Model Poisoning
3. Adversarial Examples and Evasion Attacks
4. Model Extraction, Inversion and Membership Inference
5. Insecure AI Supply Chains and Model Dependencies
6. Excessive Agency and Tool Abuse in Agentic AI
7. Unauthorized Access, API Abuse and Training Data Risks
8. AI-Generated Misinformation and Emergent Threats

Chapter 4: AI Security Governance Frameworks and Standards

1. NIST AI Risk Management Framework (AI RMF)
2. NIST Cybersecurity Framework (CSF) and AI Security
3. ISO/IEC 42001: AI Management System
4. ISO/IEC 27001 and AI Security Controls
5. ISO/IEC 23894 and ISO/IEC 38507
6. OWASP LLM Top 10 and Generative AI Security
7. SOC 2 and AI Services
8. EU AI Act and Regulatory Landscape
9. Framework Selection and Integration Strategy

Chapter 5: AI Security Architecture

1. AI Security Architecture Principles
2. Governance and Organizational Architecture
3. Data Security Architecture for AI
4. Model and ML Infrastructure Security
5. Application and API Security for AI Systems
6. Identity, Access and Secrets Management
7. Network Security, Isolation and Sandboxing
8. CI/CD, MLOps and LLMOps Security
9. Runtime Protection and Observability
10. Third-Party and Cloud AI Services

Chapter 6: Securing the AI Lifecycle

1. Strategy and Requirements Phase Security
2. Data Acquisition and Preparation Security
3. Model Development and Training Security
4. Testing, Validation and Pre-Deployment Assurance
5. Deployment and Integration Security
6. Operational Monitoring and Maintenance
7. Model Drift, Retraining and Change Management
8. Retirement, Disposal and Decommissioning

Chapter 7: AI Governance Programs and Organizational Models

1. Establishing an AI Governance Program
2. AI Security Program Design and Structure
3. Roles, Responsibilities and Accountability
4. AI Governance Committees and Decision Bodies
5. Policies, Standards and Operating Procedures
6. AI Classification Schemes and Risk Tiers
7. Risk Ownership and Acceptance Processes
8. Organizational Models: Centralized, Federated and Hybrid

Chapter 8: AI Risk Management and Control Frameworks

1. Model Risk Management: Principles and Practice
2. AI Control Frameworks and Control Objectives
3. AI and Model Inventories
4. Risk Registers and Risk Assessment Methods
5. Security Baselines and Control Matrices
6. Assurance Criteria and Evaluation Standards
7. Managing Risk Appetite and Risk Tolerance
8. Exception Management and Risk Acceptance

Chapter 9: AI Assurance, Testing and Validation

1. Principles of AI Assurance
2. AI Red-Team Programs and Methodology
3. Penetration Testing for AI Systems
4. Adversarial Testing and Robustness Evaluation
5. Model Evaluation and Validation Frameworks
6. Independent Review and Audit Programs
7. Bias, Fairness and Safety Testing
8. Assurance Evidence and Documentation

Chapter 10: AI Security Operations and Continuous Monitoring

1. AI Security Operations Centers and Capabilities
2. Runtime Monitoring and Anomaly Detection
3. Prompt and Response Logging
4. Alerting, Detection and Incident Response
5. AI Incident Classification and Playbooks
6. Business Continuity and Resilience for AI Systems
7. Third-Party AI Service Monitoring

Chapter 11: Integrating AI Security with Enterprise Functions

1. Integration with Enterprise Cybersecurity
2. Integration with Privacy and Data Governance
3. Integration with GRC and Risk Management
4. Integration with Internal Audit and External Assurance
5. Integration with Legal and Regulatory Functions
6. Integration with Procurement and Vendor Management
7. Integration with Software Development and DevSecOps
8. Integration with Business Continuity and IT Operations

Chapter 12: Advanced Topics - Agentic AI, Cloud AI and Emerging Risks

1. Security Challenges of Agentic and Autonomous AI
2. Cloud AI Services: Security and Shared Responsibility
3. Foundation Model Security and Governance
4. RAG Architecture Security
5. Multimodal AI Security Considerations
6. Frontier AI and Advanced Model Risks
7. Open Source AI Security
8. Emerging Threats and Future Directions

Chapter 13: Measuring Maturity, Compliance and Continuous Improvement

1. AI Security Maturity Models
2. KPIs, KRIs and Performance Metrics
3. Demonstrating Regulatory Compliance
4. Audit Programs and Evidence Requirements
5. Traceability and Documentation
6. Lessons Learned and Continuous Improvement
7. Board Reporting and Executive Communication
8. Building an AI Security Culture

Chapter 14: Conclusion - The Future of AI Security Governance

1. Key Takeaways: Principles That Endure
2. The Evolving Threat Landscape
3. Technology Trends and Their Security Implications
4. The Role of Standards and Regulation
5. A Call for Integrated, Proactive AI Security
6. Where to Go from Here

References