CCSP Domain 1 - AI/ML Foundations, Risks, and Governance MindMap

Introduction

Hey, I’m Rob Witcher from Destination Certification, and I’m here to help you pass the CCSP exam. In this video, we’ll be doing a review of the AI/ML Foundations, Risks, and Governance
 in Domain 1. It will help you in your studies, by showing you how each of these topics interrelate.

This is the sixth of five videos for Domain 1. I have included links to the other MindMap videos in the description below. These MindMaps are just a fraction of our complete CCSP MasterClass.

AI/ML Foundations, Risks, and Governance

AI systems need validated data, ongoing monitoring, and ethical/legal guardrails

And that is that an AI system is only as good as the data feeding it, only as safe as the monitoring watching it, and only as trustworthy as the ethical and legal boundaries surrounding it. Skip any one of those three, and you've got a problem waiting to happen.3

AI and ML Fundamentals

Before we can manage risk, we need to take a very quick look at a few of the basic terms. This is the fundamental terminology and concepts you need to know. 

Artificial Intelligence

Starting with AI. AI is technology that mimics human intelligence to perform tasks like reasoning, learning, and decision-making. Artificial Intelligence is the broad umbrella term. Everything else here sits underneath it.

Machine Learning

Machine Learning is a subset of AI where systems learn patterns from data rather than being explicitly programmed. 

Deep Learning

Deep Learning is a further subset that uses layered neural networks to model complex patterns, powering things like image and speech recognition. 

AI Use Cases

The use cases for AI are broad and range from fraud detection and chatbots to medical diagnosis and, importantly for us, cybersecurity threat detection.

Cloud Threat Detection

Now that we understand the basics, let’s get to the interesting stuff. Cloud threat detection uses AI to sift through massive volumes of activity, spotting suspicious behavior that no human team could catch in real time. Think of it as a tireless watchdog that never blinks, learning what normal looks like so it can flag the abnormal instantly. 

Detection

Detection is the process of identifying potential threats by analyzing signals and patterns across your environment. 

Inputs and monitoring

Threat Intelligence Feeds

One critical input is threat intelligence feeds. They supply up-to-date data on known threats, indicators, and attacker tactics from external sources. This is becoming increasingly important to pay attention to because the attackers certainly are. There are documented cases of AI malware being designed to monitor Vulnerability Intelligence feeds and immediately begin generating exploit code based on newly identified vulnerabilites. So we as defenders need to be developing capabilities to fortify our defenses just as quickly. 

Real-Time Monitoring

Techniques and metrics

Behavioral Baselines

Anomaly Detection

Anomaly detection flags activity that strays from the baseline, surfacing the unusual behavior that may indicate an attack. 

Response and resilience

Detecting a threat is important, but then you need an appropriate and timely response, and you need to learn from attacks to build resilience and bounce back stronger. 

AI systems can be immensely beneficial for automated response. AI systems are far more capable than traditional systems and are able to quickly and automatically take action on identified issues. Potentially very sophisticated response depending on the nature of the issue detected. This is also where you have to be very careful with the level of autonomy that you give your AI enabled system to automatically response to perceived threats. All current AI systems have significant error rates - they make mistakes. Often. So you have to be very thoughtful about what decisions and actions you allow an AI system to make on its own and what level of human oversight and approval of actions is required. If you just let an AI system loose to automatically respond to any perceived threat in an environment you’re guaranteed to have a bad time. 

Data Sources

Next up, data sources. Data sources are the lifeblood of any AI system, and where that data comes from, how clean it is, and whether it can be trusted directly determine how reliable your model will be. Let's follow the data from its origin all the way to a validated model. 

Data Origin and Integrity

Data origin and integrity ensure you know where your data came from and that it hasn't been tampered with.

Data Provenance

Data provenance is the documented history of where data originated and how it moved and changed over time as it moved through systems and processes. 

Training Data Integrity

Training data integrity means the data used to teach your model is accurate, complete, and free from corruption. You have validated this.

Threats

Even your data can face some threats, and there is one major data threat you need to know about.

Data Poisoning

Data poisoning. This is when attackers inject malicious or misleading data into training sets to corrupt a model's behavior. For example, an attacker could posion that data used to train a threat detection system, such that when the system is put in production it completely ignores an intrusion by the attackers. The model could be subtly trained to ignore a specific attack and not report it when it happens - the attacker is essentially creating a blindspot for themselves that they can later exploit. 

Data Preparation and Quality

Presuming you trust where your data came from, and the integrity of it, the next step is data preparation and quality: cleaning, organizing, and refining raw data so the model can actually learn from it.

Feature Engineering

A big part of that is what’s called: feature engineering, the art of selecting and transforming raw data into meaningful inputs that boost model performance. Put another way, feature engineering is the process of selecting, transforming, or creating useful input data so an AI model can learn patterns more effectively.

Model Assurance

Once a model is trained, model assurance is how we confirm it actually performs as intended, reliably and safely. 

Model Validation

The key technique here is model validation, testing the model against fresh data to verify it generalizes well and isn't just memorizing examples it was trained on. 

Ethical Concerns in AI

Coming back up to a foundational concept: Ethical Concerns in AI. This is where things get genuinely tricky. AI can do amazing things, but it can also cause real harm, often without anyone meaning it to. Ethical concerns force us to ask hard questions about privacy or misuse, and who's ultimately accountable when a machine makes a harmful decision. 

Privacy preservation

Privacy is such a major topic here that we will discuss it in a separate MindMap in Domain 2.

Misuse

Misuse. Misuse is using AI for harmful, deceptive, or unintended purposes that violate ethical or legal standards. Misuse can happen when someone deliberately uses AI to cause harm, but it can also happen when an AI tool is used carelessly outside its intended purpose. This is important because AI can generate realistic text, images, audio, code, and recommendations at scale, which means harmful actions can be carried out faster, more convincingly, and with less effort than before.

For example, AI could be misused to create convincing phishing emails that trick employees into revealing passwords or financial information. It could also be used to generate deepfake images, videos, or audio that impersonate a real person and damage their reputation. Another example is using AI-generated content to spread misinformation online, such as fake news articles, fake reviews, or misleading social media posts designed to manipulate public opinion.

The point being that we need to be careful about what we release to the public and contemplate how it could be misused. 

Dual-use risk

Closely related is dual-use risk, when technology built for good can also be weaponized for harm, like AI that detects threats but could just as easily craft them. 

Bias

And then we have bias - this is a big one. Bias is systematic unfairness in AI outputs, often inherited from skewed data or flawed assumptions. Here are some common forms worth knowing. 

Automation bias

First, automation bias, our tendency to over-trust automated systems, even when they're wrong.

Confirmation bias

Second, confirmation bias, favoring information that confirms what we already believe, even if it’s factually incorrect. Confirmation bais can creep into model design and interpretation. 

Historical bias

Third, historical bias, when past inequities are baked into the data and get reflected and reinforced by the model. For example, if a company has historically promoted more men than women into leadership roles, an AI system trained on that promotion data may learn that male candidates are more “leadership-ready.” Even if gender is not directly included as a feature, the model may pick up related signals, such as career gaps, job titles, or past management opportunities, and continue recommending men more often for promotion. This reinforces the original inequity rather than correcting it.
We have to be extremely vigilant for this sort of historical bias as it is everywhere.

Sampling bias

And fourth, sampling bias, when training data doesn't represent the real population, skewing the model's predictions

Decision-making

And that brings us to decision-making, which raises a key question: how much should we allow AI to decide on its own?

Automated decision-making

One option is to have automated decision-making, when AI makes choices without any human input. This option demands the greatest degree of scrutiny and forethought about things like fairness and accountability before you let the automated AI decision-maker loose in production.

Human oversight

We often want some degree of human oversight, keeping people in control of AI outcomes. And we have three levels of human oversight you need to know about.

HITL

First, HITL, or Human-in-the-Loop, where a person actively approves or makes each decision before any action is taken.

HOTL

Second, HOTL, or Human-on-the-Loop, where the AI acts autonomously while a person monitors and can step in when needed.

HOOTL

And third is Human-out-of-the-Loop, where the system runs fully on its own with no human intervention. That's the highest-risk model of the three.

Regulatory Requirements

Finally, let's talk about the rules of the road. Governments around the world are racing to regulate AI. Understanding the regulatory landscape, the frameworks, and the documentation you'll need isn't just about compliance, it's about building systems people can actually trust. So, lets cover the regulatory landscape you need to know about. 

EU AI Act

Leading the way is the EU AI Act, one of the world's first comprehensive AI laws. It works by sorting AI systems into risk tiers, with the rules getting stricter as the risk climbs, from minimal-risk uses with few requirements all the way up to a handful of uses that are banned outright. It’s a simple rule of thumb: the higher the AI risk, the more paperwork for the humans.

Other Regulation

But beyond the EU, other jurisdictions are crafting their own AI rules, and they vary quite a bit.

Brazil

Brazil is advancing its own AI legislation, emphasizing rights-based protections and risk classification.

Colorado

Colorado passed a landmark AI law focused on preventing algorithmic discrimination in consequential decisions.

Texas

Texas has enacted AI governance measures addressing responsible use, particularly within state agencies and high-risk applications.

China

And China has rolled out detailed regulations on algorithms and generative AI, with strong content and registration requirements.

AI-adjacent regulation

Then there's AI-adjacent regulation, the existing laws, like privacy and sector rules, that apply to AI even without naming it directly.

GDPR and AI alignment

A key one is GDPR, which places limits on automated decisions affecting individuals and has very strict consent requirements for data use.And since data is absolutely foundational to AI you have to be very cognisant of GDPR for any data you collect and use from EU citizens.

Sector-Specific Obligations

Then you have sector-specific obligations, the extra requirements in fields like healthcare or finance where AI carries heightened risk.

Frameworks

Beyond the laws, frameworks give organizations structured, voluntary guidance for managing AI risk responsibly.

NIST AI RMF

The key one to know is the NIST AI Risk Management Framework, a practical, voluntary roadmap for identifying and managing AI risks.

Governance and documentation

And finally, governance and documentation, which prove you've done your due diligence, capturing how AI risks were assessed and addressed. There are three you should recognize.

DPIA

First, a DPIA, or Data Protection Impact Assessment, which evaluates privacy risks before processing personal data in high-risk ways.

FRIA

Second, a FRIA, or Fundamental Rights Impact Assessment, which examines how an AI system might affect people's basic rights and freedoms.

Algorithmic Impact Assessment

And third, an Algorithmic Impact Assessment, which systematically reviews an algorithm's potential effects on individuals and society before deployment.

If you found this video helpful you can hit the thumbs up button and if you want to be notified when we release additional videos in this MindMap series, then please subscribe and hit the bell icon to get notifications.

I will provide links to the other MindMap videos in the description below.

Thanks very much for watching! And all the best in your studies!