According to AAISM, hyperparameter tuning uses validation data, not training or test data. Validation datasets are specifically designed to evaluate different hyperparameter configurations without contaminating the training or testing sets.
Training data (C) teaches the model. Test data (D) is used only for final evaluation. Configuration data (B) is unrelated to performance optimization.
References: AAISM Study Guide - AI Model Evaluation; Role of Validation Data in Hyperparameter Tuning.

AAISM identifies fairness constraints (e.g., constrained optimization, debiasing objectives, conditional generation controls, and post-processing calibrations) as the most direct, measurable method to mitigate disparate outcomes in generative systems. While data augmentation can help with coverage, and adversarial training improves robustness, fairness constraints explicitly target distributional fairness and outcome equity in generated content, aligning with governance and compliance goals.
References: AI Security Management™ (AAISM) Body of Knowledge - Fairness & Bias Management in Generative AI; Metrics, Constraints, and Remediation. AAISM Study Guide - Fairness Objectives, Post-hoc Debiasing, and Evaluation Protocols.

AAISM's governance guidance emphasizes that adopting AI for competitive advantage must begin with a comprehensive strategic roadmap for integration. This roadmap aligns AI adoption with business objectives, sets priorities, defines milestones, and ensures coordination across functions. Risk management, training, and tool procurement are essential, but they are tactical steps that follow once the strategic direction is defined. Without a roadmap, adoption becomes fragmented and risks misalignment with business strategy. The most important consideration at the adoption stage is therefore creating a strategic integration roadmap.

AAISM identifies percentage of AI projects in compliance as the most relevant KRI for evaluating AI risk management effectiveness. This metric directly reflects adherence to governance, regulatory, and security requirements. The number of models deployed (A) or systems with AI components (B) indicate scale, not risk management quality. Training requests (D) show awareness levels but do not measure effectiveness of risk management. Compliance percentage provides a direct, measurable indication of how well risks are being governed and mitigated.
References:
AAISM Exam Content Outline - AI Risk Management (Risk Metrics and Compliance) AI Security Management Study Guide - Key Risk Indicators in AI Programs

AAISM defines an AI BCP as requiring validated failover and recovery testing of AI components, including:
* model hosting environments
* model-serving APIs
* feature stores
* inference pipelines
Only Option B tests actual continuity of AI functionality.
Monitoring (A) detects issues but does not ensure continuity. Access controls (C) relate to security, not continuity. Backup detail (D) is insufficient without recovery testing.
References: AAISM Study Guide - AI Resilience and Disaster Recovery Validation.