AI Control Library / CF-05: Data Governance & Privacy
Designation: Supplemental | Control types represented: Operational
Control requirement
Evaluate the cost, benefit and operational consequences of proposed AI encryption changes against required protection and business needs. Make tradeoffs explicit without treating mandatory safeguards as optional solely because they add expense.
Why this matters
Encryption decisions can affect latency, storage cost, recovery and staffing. A useful analysis compares feasible ways to meet requirements instead of framing security and usability as an unexplained binary choice.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
New or materially changed encryption architectures, key ownership arrangements, migrations and specialized protection services.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The service sponsor owns the decision with security, finance, architecture and data-owner input.
Implementation guidance
- Define the protection requirement and threat reduction, separating mandatory conditions from discretionary improvements.
- Compare feasible options for performance, cost, service compatibility, operations, recovery and residual exposure.
- Test significant assumptions using realistic workloads and failure scenarios, including key-service or connectivity loss.
- Record the selected option, funded responsibilities and review triggers, rejecting alternatives that cannot meet required conditions.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Inspect an option comparison | Costs and risks use consistent assumptions and relevant evidence. |
| Challenge a claimed performance penalty | Representative testing supports it. |
| Trace the final decision | Required safeguards and operational ownership remain funded and achievable. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Requirement and option analysis
- Cost and performance evidence
- Residual-risk and funding decisions
- Review assumptions and triggers
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate a funding or capability gap that prevents required protection to business and security authorities. Reduce scope or select an acceptable alternative rather than silently omitting the requirement.
Example in practice
Hypothetical example: A team compares managed and externally controlled keys. The decision considers recovery staffing and outage risk alongside fees, selecting the arrangement that meets the actual control objective.
Related controls
- CF05-S03: AI Encryption Change Management
- CF05-S05: AI Encryption Risk Management
- CF05-S06: Customer-Managed Encryption Keys for AI
Framework mappings
- CSA AICM (CEK-06)
- NIST AI RMF (MANAGE 4.2)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0