A grant-funded municipal AI pilot must undergo authorized recon. The CISO asks how data-policy obligations should affect the engagement. What is the best practice?
Select an answer to reveal the explanation.
Short Explanation
Grant and privacy rules are the lane markers on the recon highway—you still drive the assessment, but you stay in the lanes. Scope techniques and data handling to the city's policy, don't dump packet captures in the shared drive or treat a final-report appendix as compliance by itself.
Full Explanation
A grant-funded municipal AI pilot undergoing authorized recon must keep techniques and data handling inside applicable civic data-policy and grant constraints while still meeting test objectives. Best practice is explicit scoping: approved environments, minimization of resident PII, retention rules for evidence, logging that satisfies audit obligations, and methods that do not violate grant privacy commitments. Professional offensive AI work in government is judged not only by findings produced but by lawful, policy-aligned execution.
Retaining detailed packet captures and query logs in the shared drive still fails data-handling discipline: bulk capture in an uncontrolled location can replicate regulated resident information beyond approved repositories, and grant auditability requires governed evidence retention, not indiscriminate storage in a shared drive. Documenting grant compliance only in the final report appendix fails the engagement itself: policy obligations must shape recon scoping and execution in real time, not merely appear as an after-the-fact appendix entry built from standard logs. Focusing active recon only on publicly exposed endpoints and published grant deliverables fails as a complete answer: reducing resident-data handling does not by itself satisfy civic data-policy or grant constraints, which still govern techniques, evidence handling, and approved scope throughout the engagement.
Exam caveat: When stems mention grants, privacy, or civic data policy alongside recon, choose “comply while still testing,” not shared-drive bulk capture, report-only compliance documentation, or public-endpoint-only scoping.
Operational check: MoU/RoE cite grant and privacy clauses; evidence stays in approved repositories; resident data used for tests is minimized or synthetic where required; and the final report includes a brief compliance attestation of how data was handled during recon.