AI Posture Check Take the Check
AI security dimension

Data.

Classification, controls, logging, vendor data terms, subject rights.

Take the AI Posture Check All six dimensions
The six dimensions
Governance Data Prompt Model Runtime Vendor
Questions
2 in the adaptive tree
Frameworks
ISO 42001, LLM02
Moves
The Program axis of the Posture Quadrant
Why it matters

Why data matters

Every AI system depends on data. AI security therefore depends on data security, but with new wrinkles: prompts are now a sensitive-data egress channel, RAG corpora become query-able attack surfaces, and vendor contracts must explicitly exclude your data from model training. The Data dimension covers classification, prompt-level controls, prompt and output logging, vendor data terms, and subject-rights handling. It maps directly to OWASP LLM02 (Sensitive Information Disclosure), LLM08 (Vector and Embedding Weaknesses), and the Manage and Map functions of NIST AI RMF. Low weight on data means AI is rolling out faster than data hygiene can keep up. Full weight on data means classification, DLP, and vendor diligence have been operationalized.

In the check

What the check asks about data

The check asks up to five questions in total, chosen by your earlier answers, so a path may meet one of these or none. Each carries a weight from 0 to 3 and cites its source.

QuestionCitationAnswers
Do you have a data classification policy you could extend to AI inputs?With no AI yet, the first move is deciding what data may ever reach a model. ISO 42001 Annex A.7
  • +0No classification policy
  • +1A policy exists but does not mention AI
  • +2A policy exists and names AI inputs
Do you know what data people are putting into AI tools?Before you write a policy, find out what data is already going into these tools. OWASP LLM02, ISO 42001 Annex A.7
  • +0No idea
  • +1Roughly, from what teams tell us
  • +3Yes, classified and controlled at the point of input
Sources

Frameworks cited on this dimension

Every question above cites its source. These are the frameworks behind data.

ISO 42001 in Practice

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. It.

Read the guide

Sensitive Information Disclosure (LLM02)

An LLM reveals sensitive data through output. The data may come from training data, fine-tuning data, the system prompt, retrieved context (.

Read the guide
Other dimensions

The other five dimensions

Score yourself

See where data lands on your chart.

Five questions, about three minutes, and your dot lands on the Posture Quadrant. Your stage and the move that takes you forward arrive by email or in a live conversation with a CWS engineer.

Take the AI Posture Check Talk to a CWS engineer