What are the essential elements of an AI security program?

• A. Alignment with organizational objectives, cooperation with stakeholders, and effective metrics.
• B. Only IT security controls without governance.
• C. Sole reliance on external audits.
• D. Isolating AI programs from business units.

Answer: (A)

A solid AI security program starts with aligning security efforts to the organization's objectives, ensuring the security strategy supports business goals and risk appetite. It requires cooperation with stakeholders across the enterprise—data owners, developers, IT, privacy, legal, and leadership—to establish clear governance, roles, and decision rights. It also relies on effective metrics to measure risk, data and model quality, incident response, and program maturity, so leadership can prioritize resources and track improvement over time. Together, alignment, collaboration, and measurement create a security program that is not only technically sound but also accountable, transparent, and capable of adapting to evolving threats and business needs.

Focusing only on IT security controls without governance misses the connection between security activities and business outcomes. Relying solely on external audits leaves ongoing risk management and continuous improvement underdeveloped. Isolating AI programs from business units prevents the necessary governance and awareness required to identify and manage risk across the organization.