Test the integrated workflow for security regressions: Which control is missing?
The missing evidence is integrated security regression testing, since component tests cannot reveal interaction-specific weaknesses.
The question
A research-administration platform integrates an AI document classifier with a new identity service. Existing monitoring, testing, oversight, risk treatment, and supplier controls are complete for each component separately. No one has tested whether the integrated workflow introduces authentication or authorization weaknesses. Which control is missing?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Request the identity vendor’s security certification.A vendor certification has defined scope and cannot establish security of this specific integrated workflow and configuration.
- Test the integrated workflow for security regressions. ✓Integrated security regression testing directly addresses weaknesses created by interactions between components that separate component tests could not reveal.
- Review the classifier’s standalone accuracy again.Standalone accuracy review concerns classification performance and does not test authentication or authorization interactions introduced by integration.
- Publish the integration architecture internally.Architecture documentation improves understanding, but does not provide evidence that the combined workflow resists security regressions.
The trap
When new integrations alter data or access flows, seek regression evidence for the combined system. How to remember it
The missing evidence is integrated security regression testing, since component tests cannot reveal interaction-specific weaknesses.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Development questions
- Require update impact assessment before production: Which control is most direct? →
- Log near misses with owners and corrective actions: Which missing control best addresses this gap? →
- Track subgroup outcomes over time: Which control most directly addresses the concern? →
- All 426 Understanding How to Govern AI Development questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Development ·
Every answer, right and wrong, comes with its own explanation.