Security review for a GenAI SaaS requires encryption, tenant isolation, and comprehensive logging before city use. What control specification practice is this?

Specifying required security controls—encryption, tenant isolation, and logging—for civic GenAI SaaS is the correct control-specification practice during security review. Municipal use of GenAI often involves sensitive prompts, resident data, or internal deliberations that demand encryption in transit and at rest, logical separation between tenants, and comprehensive logs for investigation and accountability. Writing those controls into the security requirements makes acceptance criteria explicit before city use rather than negotiating after data already flows. The practice works because civic GenAI SaaS without encryption, isolation, and logging cannot meet baseline municipal security expectations.

Accepting shared-tenant chat with no encryption or audit logs fails by concept: that posture lacks the confidentiality and accountability controls cities require. Deferring logging until after a breach investigation starts fails by concept and sequencing—logs must exist before an incident to support forensics and response. Allowing the vendor to skip isolation because municipal data is “mostly public” fails by concept: even partially public environments still contain nonpublic drafts, PII, and internal decision content that need tenant boundaries.

Exam caveat: specifying controls is about minimum security baselines for SaaS GenAI; exact crypto suites and log sinks follow local standards, but encryption, isolation, and logging remain core themes. Keep city security-review framing. Operational check: put encryption, tenant isolation, and logging in the security questionnaire and contract exhibits; validate with architecture review and sample log evidence; and block production use until those controls are confirmed.