Module 19 Lesson 3: AI Security Policy
Rules of the road. Learn how to write a formal AI Security Policy that defines allowed usage, data handling, and responsibilities for your employees.
Module 19 Lesson 3: Developing an AI security policy
A "Policy" is the written law of your organization. If you don't have a policy, you can't punish an employee for "leaking secrets to ChatGPT" because they can say they didn't know the rules.
1. Defining "Allowed AI"
The first section of your policy must list Approved Platforms.
- Approved: Enterprise Azure OpenAI (where we have a DPA).
- Restricted: Personal ChatGPT accounts (no company data allowed).
- Banned: Random "AI extensions" from the Chrome Web Store.
2. Data Classification for AI
Not all data is allowed to touch an AI.
- Public Data: (Marketing drafts) -> Fine for any AI.
- Confidential Data: (Project plans) -> Only for Enterprise-approved AI.
- Restricted Data: (Customer Passwords / SSNs) -> NEVER allowed to be sent to any AI, even an internal one.
3. Human-in-the-Loop Requirement
The policy must state that Humans are responsible for AI outputs.
- "No AI-generated code or document shall be published without a human Reviewer signing off on its accuracy and security."
- This prevents "Automatic" mistakes from causing systemic failures.
4. Reporting AI Incidents
Make it easy for employees to report when the AI "goes off the rails."
- "If the AI provides biased, toxic, or suspicious output, the employee must pause the session and report the incident to the Security Team via [Email/Slack]."
Exercise: The Policy Writer
- Why should an "AI Security Policy" be separate from your general "IT Policy"? (Hint: Think about prompt injection).
- You catch an employee using a "Summarizer AI" on a top-secret patent. What is the "Corrective Action" defined in your policy?
- What is a "Data Processing Agreement" (DPA) and why must your company have one with every AI vendor?
- Research: What is the "MITRE ATLAS" framework and how can it help you define policy requirements?
Summary
A good security policy is Clear, Concise, and Enforced. It sets the "Guardrails" for human behavior, just as technical guardrails set the boundaries for the AI's behavior.
Next Lesson: Managing the vendors: Third-party risk management for AI vendors.