The city CISO team wants AI problems such as data leakage or biased outcomes handled consistently. What governance practice supports that?
Select an answer to reveal the explanation.
Short Explanation
A leaked casefile or a biased bot outcome deserves a real ticket, not a shrug. Put AI incidents on the same incident highway as the other bad days.
Full Explanation
The city CISO team should report and track AI problems such as data leakage or biased outcomes through the same incident processes used for other security and risk events. Formal tickets, severity, owners, timelines, and post-incident review create consistent handling whether the failure is a classic breach or an AI-mediated harm. That alignment keeps AI governance from becoming an informal side channel where serious events vanish into chat threads and never improve controls.
Ignoring biased outcomes unless a newspaper covers them delays remediation until reputational crisis and fails residents harmed quietly. Discussing leaks only in private chats with no tickets destroys auditability and organizational learning. Treating AI failures as purely marketing issues with no security follow-up misclassifies data leakage and safety harms that belong in security and risk workflows.
Exam caveat: same incident process means comparable intake and tracking—not that every AI bug is a Priority-1 breach; severity still differentiates noise from material harm. Operational check: add AI incident categories to the IR system, train staff to open tickets for leakage and harmful bias, include AI events in metrics reviewed by CISO leadership, and feed lessons into policy and model-change control.