ISO 42001 mandates a systematic risk treatment process, involving identification of AI risks (e.g., bias, security), analysis of impacts, evaluation against criteria, and development of treatment plans like mitigation or acceptance. This ensures proactive management throughout the AI lifecycle. Exact extract: "ISO 42001 requires identifying, analyzing, and evaluating AI risks with appropriate treatment plans." (Reference: Cyber Security for AI by SISA Study Guide, Section on Risk Treatment in ISO 42001, Page 270-273).

Leveraging foundation models like GPT or BERT for fintech involves fine-tuning with sector-specific data, such as transaction logs or market trends, to tailor for tasks like risk prediction, ensuring high accuracy without the overhead of scratch-building. This approach maintains efficiency by reusing pretrained weights, reducing training time and resources in SDLC, while domain adaptation mitigates generalization issues. It outperforms unadapted general models or fragmented specifics by providing cohesive, scalable solutions. Security is enhanced through controlled fine-tuning datasets. Exact extract: "Adopting a Foundation Model and fine-tuning with domain-specific data is most effective for leveraging existing models in fintech, balancing efficiency and accuracy." (Reference: Cyber Security for AI by SISA Study Guide, Section on Model Adaptation in SDLC, Page 105-108).

Data leakage in LLMs occurs when sensitive information from training data is inadvertently revealed in outputs, posing privacy risks. Effective mitigation involves strict access controls, such as role-based permissions, and anonymization methods like differential privacy or tokenization to obscure personal data. These measures prevent extraction attacks while maintaining model utility. Regular audits and data minimization further strengthen defenses. Unlike obfuscation alone, which may not fully protect, combined controls ensure compliance with regulations like GDPR. Exact extract: "Applying rigorous access controls and anonymization techniques to training data is most effective in mitigating data leakage risks in LLMs." (Reference: Cyber Security for AI by SISA Study Guide, Section on Data Security in AI Models, Page 130-133).

The STRIDE model adapts to GenAI by evaluating threats across its categories: Spoofing (e.g., fake inputs), Tampering (e.g., data poisoning), Repudiation (e.g., untraceable generations), Information Disclosure (e.g., leakage from prompts), Denial of Service (e.g., resource exhaustion), and Elevation of Privilege (e.g., jailbreaking). This systematic threat modeling helps in designing resilient GenAI systems, incorporating AI-unique aspects like adversarial inputs. Exact extract: "STRIDE adapts to GenAI by applying its threat categories to AI components, assessing specific risks like tampering or disclosure." (Reference: Cyber Security for AI by SISA Study Guide, Section on Threat Modeling for GenAI, Page 240-243).

AI enhances retail CX through personalization, using analytics to recommend products based on behavior, preferences, and history, creating tailored experiences that boost satisfaction and loyalty. Tools like chatbots and predictive models enable real-time interactions, while security posture improves via fraud detection integrated into these systems. This data-driven approach ensures relevance, differentiating from generic methods. Automation supports but personalization drives engagement. Exact extract: "AI integrates personalized interactions with driven analytics to customize shopping experiences, thereby enhancing customer satisfaction in retail." (Reference: Cyber Security for AI by SISA Study Guide, Section on GenAI in Security and Customer Enhancement, Page 70-73).