In a SecAI+ risk assessment for a healthcare product, which combination best captures essential focus areas?

• A. Asset identification, data flows, threats to privacy and safety, regulatory requirements
• B. Only data storage method
• C. Only marketing risk
• D. Only energy use

Answer: (C)

In this SecAI+ risk assessment, you need a broad, integrated view of what must be protected and how rules apply. The essential focus areas are asset identification, data flows, threats to privacy and safety, and regulatory requirements. Identifying assets tells you what needs protection—data, models, hardware, and interfaces. Mapping data flows shows where information moves, how it’s transformed, and where exposures or trust boundaries exist. Considering threats to privacy and safety focuses on the real harm the system could cause clinicians, patients, and the organization if data is mishandled or AI decisions go wrong. Regulatory requirements ensure you’re designing and operating the product in compliance with laws and standards (privacy, medical device, AI governance, auditable controls). Together, these elements provide a complete picture of risk and enable effective prioritization of controls such as access management, encryption, data governance, model risk management, and traceability.

Focusing only on data storage misses how data travels and is used, which can introduce privacy and safety gaps. Focusing only on marketing risk ignores the core concerns of patient data privacy, clinical impact, and regulatory compliance. Focusing only on energy use neglects data handling, decision-making integrity, and governance that are central to SecAI+ risk.