KRIs should focus on identifying and tracking risks that directly affect the system's security posture. For generative AI, this means monitoring vulnerabilities and control gaps specific to AI components, such as prompt injection, data leakage, or model abuse, which are critical to managing ongoing risk.

Data lineage records and monitors the end-to-end journey of data-sources, movements, transformations, storage locations, uses, and dependencies-providing traceability, auditability, and accountability across the AI lifecycle. "Origin" is a single point (provenance), "transformation" is one step within the flow, and
"processing" is a general activity rather than a governance record of the entire path.
References: AI Security Management™ (AAISM) Body of Knowledge: Data Governance-Provenance and Lineage; AAISM Study Guide: Lineage Documentation, Traceability, and Audit Evidence.

AAISM directs organizations to manage third-party AI risks through contractual and technical controls that explicitly govern data use, retention, training/fine-tuning, isolation, and deletion. The most effective data-security action when consuming generative AI features is to require enforceable opt-out provisions that prohibit the provider from using the organization's data for training or secondary purposes and that mandate retention limits and secure deletion.

The AAISM study material highlights blockchain as a control mechanism for managing deepfake risk because it provides immutable verification of digital media provenance. By anchoring original data signatures on a blockchain, organizations can verify authenticity and detect tampered or synthetic content. Data tagging helps organize but does not guarantee authenticity. MFA and adaptive authentication strengthen identity security but do not address content manipulation risks. Blockchain's immutability and traceability make it the recognized technology for mitigating deepfake challenges.
References:
AAISM Study Guide - AI Technologies and Controls (Emerging Controls for Content Authenticity) ISACA AI Governance Guidance - Blockchain for Data Integrity and Deepfake Mitigation

Monitoring agentic actions provides real-time visibility into what the AI agent is doing, enabling rapid detection of anomalous or unauthorized behavior during deployment. This continuous oversight is essential to promptly identify and respond to security issues as they occur.