An AI acceptable use policy (AUP) sets the organizational expectations and boundaries for how AI systems may be used by employees and third parties. AAISM guidance places emphasis on ethical and legal compliance standards as core elements of an AUP to govern responsible behavior, prevent misuse, and align with regulatory and organizational principles. While data requirements, collection/storage processes, and monitoring may be covered in adjacent standards and procedures (e.g., data management policies, SOPs, and operational runbooks), the AUP's essential function is to codify permissible use anchored to ethics, legality, and organizational values.
References: AI Security Management (AAISM) Body of Knowledge - AI Governance Policies and Codes of Conduct; Responsible Use Principles. AAISM Study Guide - Policy Hierarchy and Control Mapping; Acceptable Use and Staff Obligations.

AAISM vendor governance guidance identifies regular audits of vendor processes as the most effective method of ensuring compliance with ethical and security standards. Independent audits provide verifiable assurance that vendors are meeting agreed-upon requirements. Self- attestation, internal monitoring, or documentation sharing provide some transparency but do not guarantee compliance. The best practice, particularly for high-risk AI deployments, is independent and recurring audits of vendor processes.

The AAISM standard explicitly states that traditional penetration tests alone are insufficient for AI systems.
Effective AI security testing requires:
* AI-specific threat modeling (e.g., data poisoning, prompt injection, model theft)
* Adversarial attack simulations (white-box, black-box, gradient-based attacks)
* Evaluation of robustness and manipulation resistance
Option B captures these requirements precisely.
Options A, C, and D do not address AI-specific attack vectors.
References: AAISM Study Guide - AI Security Testing and Adversarial Evaluation.

Detective controls provide visibility into unauthorized AI usage, while employee training promotes awareness and responsible behavior. Together, they address both detection and prevention, making them the most effective approach to minimizing risks associated with shadow AI.