Do staff need AI-specific cyber security training?

Contrasting

The voluntary AI Cyber Security Code says organisations’ cyber training shall include role-tailored AI security content. For government services, treat Service Manual / Playbook security obligations as mandatory and use the CoP’s training and lifecycle practices to strengthen that baseline.

Warning Conflicting or tensioned advice across sources

AI Cyber Security CoP is voluntary (shall within that frame). Service Manual requires consulting security professionals for AI services.

How to navigate this: Meet mandatory government security practice; use the CoP for detailed AI-specific controls including training.

From the guidance

Primary (how) Code of Practice for the Cyber Security of AI

Organisations’ cyber security training programme shall include AI security content which shall be regularly reviewed and updated. AI security training shall be tailored to the specific roles and responsibilities of staff members.

Section: Principle 1: Raise awareness of AI security threats and risks

Read this in Code of Practice for the Cyber Security of AI (opens in new tab)

Contrasting Service Manual: Using artificial intelligence (AI) in services

Position: Must consult a security professional for AI services.

You must consult a security professional to make sure that: users’ data is protected; your service stays secure.

Section: Involve cyber security professionals

Read this in Service Manual: Using artificial intelligence (AI) in services (opens in new tab)

Secondary (normative) Code of Practice for the Cyber Security of AI

AI stakeholders should view this document as an addendum to the Software Code of Practice.

Section: Introduction

Read this in Code of Practice for the Cyber Security of AI (opens in new tab)

Related questions