Day 1: Mapping Controls and Monitoring Evidence

Control Objectives and Assertions

• Validation checks for control objectives
• Policy limits limiting unauthorized use
• Independent review for high-impact cases
• Ownership of approved AI outputs

Data Sources and Control Signals

• Ownership expectations for data sources
• Decision authority and approval thresholds
• Control testing prior to operational approval
• Evidence retention for later oversight

Exception Definitions and Thresholds

• Control boundaries around exception definitions
• Governance roles across the lifecycle
• Human oversight at critical decisions
• Escalation routes for failed controls

Day 2: Detecting and Analyzing Control Exceptions

AI-Assisted Exception Detection

• Application limits around AI-assisted exception detection
• Exceptions handled with documented rationale
• Audit evidence informing full traceability
• Review cadence for governance controls

Pattern and Root-Cause Analysis

• Practical tests for root-cause analysis
• Adversarial tests before production release
• Detection gaps exposed by testing
• Containment steps before wider spread

False Positive Reduction

• Application limits around false positive reduction
• Access anomalies needing prompt investigation
• Recovery actions after security events
• Threat signals requiring rapid triage

Day 3: Escalating and Closing Control Issues

Risk-Based Exception Prioritization

• Validation checks for risk-based exception prioritization
• Evidence preserved for incident oversight
• Malicious patterns across security telemetry
• Privilege changes needing closer review

Investigation and Remediation Workflow

• Validation checks for remediation workflow
• Identity risks tied to context
• Escalation thresholds for critical threats
• Attack paths across trust boundaries

Control Monitoring Scorecard

• Practical tests for control monitoring scorecard
• Uncertainty limits around analytical conclusions
• Query logic checked against requirements
• Missing values requiring deliberate treatment

• Peer review challenging assumptions around data sources
• Practical lab developing root-cause analysis for operational use
• Decision simulation testing risk-based exception prioritization in context
• Hands-on workshop applying control monitoring scorecard to realistic tasks