Huge congratulations Nancy, you earned it

@Anthony Knapkin Correct Answer: B. Establish AI governance with bias assessment and accountability for automated decisions Explanation (CISSP logic):ISC2's Domain 1 AI guidance explicitly calls for governance over AI ethics, mitigation of algorithmic bias, and ensuring automated decision-making aligns with legal, regulatory, and privacy requirements. The root issue is governance, not tooling. Before you can fix bias technically, you need the framework that defines acceptable outcomes, assigns accountability for the model's decisions, and ties them to regulatory obligations. Breakdown:A. Explainability is a valuable input to governance, but interpreting outputs without an accountability framework leaves no one owning the decision.B. ✅ Correct. Establishes the governance, assessment, and accountability structure that all technical fixes must serve.C. Retraining is an implementation step that's premature until governance defines what "fair" means and who signs off.D. A human reviewer addresses one error path but not the systemic bias or the accountability gap for automated approvals. Think like a manager:You can't engineer fairness you haven't defined. Governance sets the standard; tooling enforces it.

@Michael Samson-Metzger@Ed Morawski agreed

@Jerry Mensah what do you mean Jerry?

@David Uchieng Correct Answer: B. Require a software bill of materials covering the model and its provenance Explanation (CISSP logic): ISC2's Domain 8 AI guidance addresses the ML software supply chain and the risk of model hijacking or poisoned components entering the SDLC. A model with unknown training provenance is an unverified supply-chain artifact. The SBOM (and emerging AI-BOM/model cards) establishes provenance and transparency, which is the governance prerequisite for due diligence before you ever run untrusted code or weights. Breakdown: A. Sandboxing is a sound runtime control, but it's an operational step that comes after you've assessed what you're integrating. B. ✅ Correct. Establishes provenance and supply-chain transparency, satisfying due diligence before integration. C. Malware scanning catches embedded payloads but misses poisoned training data and logic-level backdoors in the weights. D. Permission scoping limits blast radius but doesn't answer the foundational question: do we trust this model's origin? Think like a manager: Unknown provenance is unmanaged risk. Demand the bill of materials before you build it into your product.