AAISM Question 9

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  Data minimization is a core privacy and security principle that mandates restricting data collection and processing to only what is strictly necessary for the specific objective (in this case, training the model). The organization directly addresses the CISO's concerns by reducing the overall attack surface and minimizing the risk of downstream data leakage through model outputs.

• Chose A3

  While the answer below and the question both say Data Classification, I don't believe data classification does much to address the fact that there is still PII/PHI, etc.. Data minimization strips a lot of that out and only keeps what is important. Sure Data classification happens before data minimization... but it doesn't change the fact that data minimization is the one that actually removes the data.

• 2

  Agreed! It says that it needs to "address CIOs concerns" (key word being 'address' - to do something about it) and scrubbing the data of all sensitive/private information (i.e. data minimization) is the thing to do here.