Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
22 results for “Bias & Fairness Controls”
Fairness Definition Choice
Selecting which mathematical fairness criterion applies, given that the main criteria are provably incompatible and the choice is a value judgement.
Automation Bias
The tendency of a human reviewer to accept a system's output rather than evaluate it, which is what turns human oversight into a rubber stamp.
Compliance Framework
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
Control Test Automation
Executing a control's test continuously against the whole population rather than sampling it annually, which changes both the detection latency and the strength of the evidence.
Encryption at Rest and in Transit
Protecting stored data from disclosure if the medium is obtained, and network data from disclosure if the path is observed — two different controls against two different threats.
Governance Operating Model
The arrangement of decision rights, review points and automated controls through which architectural intent is maintained across an organisation.
Netflix Open Connect
Netflix built its own CDN and placed appliances inside ISP networks, turning the most expensive part of its cost structure into hardware it controls.
Operator Independence
The requirement that no foreign entity can be compelled to access or disclose data, which goes beyond where the bytes are stored to who controls the operator.
Privacy by Design
Building privacy protections into a system's structure from the start, rather than adding controls to a design that already collects and keeps everything.
Rate Limiting
Bounding how many requests a caller may make in a window, to protect capacity and enforce fair use.
Standard Change
A pre-authorised class of change whose risk controls are automated and evidenced, so it does not need per-instance approval.
Design rate limiting for a multi-tenant API where a single customer's traffic spike currently degrades service for everyone.
Name the problem precisely This is the noisy neighbour problem. Rate limiting is one control for it, and on its own it is incomplete — a customer within their l
One customer's batch job saturates a shared service and degrades everyone. Rate limiting them fixes it, until the next customer does the same. What is the structural answer?
Why per customer rate limits keep failing A static limit is set from what that customer was doing, not from what the service can serve. It is reactive — you dis
Quarterly access reviews take two weeks of manager time and everyone approves everything. How do you make this a real control?
Recognise what it currently is A review where everything is approved is not producing a decision; it is producing a record of a decision shaped activity. Two we
The business wants to deploy a model that ranks loan applications, with a credit officer making the final decision. What must the architecture provide, and what will you insist on before go-live?
Classify first, because it determines everything else This decides access to credit for individuals. Under any consequence based classification it is high risk:
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Architecture Governance
Preventive, automated controls rather than review meetings.
Change Management vs CD
Reconciling CAB-era controls with continuous delivery without pretending either away.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.
Sensitivity Labelling
Propagating a classification through joins and derived tables so controls follow the data.