Google Secure AI Framework (SAIF): A GRC Guide

This course contains the use of artificial intelligence. Google's Secure AI Framework (SAIF) is the practitioner's blueprint for securing AI systems and agents across their lifecycle. This course turns SAIF into something you can actually run inside a security or GRC program — no ML engineering required.

Working through a single realistic model organization, Meridian (a regulated digital-banking firm rolling out a customer GenAI assistant and later an agentic workflow), you will move from first principles to a board-ready AI risk program. What the course coversThe six core elements of SAIF and why their order mattersThe SAIF risk map — the four components: Data, Infrastructure, Model, ApplicationAll 15 SAIF risks — from data poisoning and model exfiltration to prompt injection, sensitive data disclosure, and rogue actionsControls mapped to risks, and how to build a control-to-risk matrixSAIF 2. 0 — securing AI agents: human oversight, limited powers, observability, and the agent risk mapOperationalizing SAIF: the risk self-assessment, remediation roadmaps, governance, RACI, and CoSAIMapping SAIF to NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, and MITRE ATLAS, plus board and regulator reportingEvery section includes a quiz; six sections include worked assignments; and the course ends with a full capstone — a complete SAIF assessment, control plan, roadmap, and board memo for Meridian.

Who benefits: CISOs, security engineers, AI risk owners, and compliance and audit leads who need to secure AI without waiting for a standard to tell them how.