AI Security Controls (CSA AICM) Fundamentals Training
A one-day fundamentals programme on CSA AICM. Learn how to use the Cloud Security Alliance AI Controls Matrix to organise safeguards for AI systems. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: Cloud, AI, security, compliance, procurement and technical risk teams. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
AICM and the AI Service Stack
Introduce the AI Controls Matrix and its relationship to CSA's Cloud Controls Matrix. Map the organisation, platform, model, data and application layers of a simple AI service.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Shared Responsibility
Identify responsibilities retained by the customer and those performed by providers. Use a hosted model service to distinguish a supplier capability from evidence that the customer's own configuration is secure.
11:30 AM to 12:30 PM
Data, Model and Supply Chain Controls
Explore data access, model handling, dependencies and supplier assurance. Select relevant control objectives and turn them into specific questions for service owners.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Operations and Governance Controls
Connect identity, change review, monitoring, resilience and incident response to AI operations. Assign ownership and evidence sources rather than treating a matrix as a completed assurance report.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Assessment and Evidence
Create a small applicability and evidence register. Record gaps, inherited controls and unresolved questions, and prioritise remediation based on the service's use and business impact.
4:00 PM to 5:00 PM
Practical Exercise: A Hosted AI Service
Map a fictional cloud assistant's responsibilities and select five relevant controls. Review illustrative supplier responses, identify evidence gaps and prepare follow-up questions.
Key Outcomes
- Explain AICM's role in AI assurance
- Map shared responsibilities across providers and users
- Select controls and evidence for a use case
- Draft supplier questions and remediation priorities
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
High relevance for Malaysian cloud and AI service providers and their customers. AICM v1.1 provides a control framework; responsibility still depends on who supplies, configures and operates each part of a service.
Practical Takeaways
An AI shared-responsibility matrix and control applicability-and-evidence worksheet.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
AI Agent Runtime Security (OWASP Agent Control Standard) Fundamentals Generative AI Security (OWASP LLM Top 10) Fundamentals Web Application Security (OWASP Top 10) Fundamentals AI Agent Security (OWASP Agentic Top 10) Fundamentals View all fundamentals programmes
Reference material: CSA: AI Controls Matrix v1.1.