Emerging Technologies and Digital Transformation
This domain tests whether you can apply familiar principles - ownership, assurance, least privilege - to architectures that move control outside your perimeter. Questions typically ask who is responsible for a control in a cloud model, what governance an AI use case needs, or which risk a technology introduces.
Cloud
- Service models: IaaS (customer owns OS, middleware, runtime, apps, data), PaaS (customer owns apps, configuration, data), SaaS (customer owns data, identity configuration and usage governance). The provider always secures the underlying infrastructure; the customer always retains accountability for data classification, identity and access, and configuration.
- Shared responsibility is contractual and must be evidenced: read the SOC 2 report, subprocessor list, data residency terms, and exit/portability provisions.
- Deployment models: public, private, hybrid, multi-cloud - each adds identity sprawl and data-movement risk.
AI and model governance
- Model risk lifecycle: intended and prohibited use, data provenance and quality, bias and fairness testing, performance monitoring, human oversight, explainability proportionate to impact.
- The EU AI Act uses risk tiers: prohibited practices (e.g., social scoring), high-risk uses (employment, credit, critical infrastructure, biometric identification) with conformity assessment and documentation duties, limited-risk uses with transparency duties such as chatbot disclosure and synthetic-content labelling, and minimal-risk uses.
- Generative AI raises prompt data leakage, hallucination and IP risk; mitigate with enterprise tenants, DLP, acceptable-use policy and output review.
Other transformation themes
- IT/OT convergence - availability and safety outrank confidentiality; segment and avoid aggressive scanning of fragile industrial protocols.
- IoT - long patch cycles and default credentials; place on dedicated VLANs.
- DevSecOps - controls shift into pipelines (SAST/DAST, dependency scanning, IaC policy checks), so assurance inspects CI/CD logs rather than manual approvals.
- Post-quantum - inventory long-lived confidential data now and plan crypto-agility; harvest-now-decrypt-later is the driver.
- Shadow IT and third-party concentration risk are governance failures before they are technical ones.
Worked example
A business unit wants a SaaS HR analytics tool. Under shared responsibility the vendor secures the application and hosting, but the customer still owns identity federation (SSO/MFA), role design, data classification, retention and export. Assurance requires a SOC 2 Type II, a subprocessor review for cross-border transfers, and contractual breach notification. The risk is not "the cloud is insecure"; it is misconfigured access and unmanaged data flows.
Traps
- Assuming the provider secures customer data by default.
- Applying high-risk AI Act obligations to a minimal-risk chatbot.
- Deploying IT scanning policy onto OT networks.
- Ignoring exit strategy and data portability during vendor selection.