After prompt-injection findings on a municipal assistant, how should the city map them into the AI risk register for governance?
Select an answer to reveal the explanation.
Short Explanation
Governance folks speak taxonomy—put injection findings next to the right OWASP LLM-style buckets so the register stays usable. CVSS scores, citizen-service complaints, and routine service desk tickets won't help the AI risk conversation.
Full Explanation
After prompt-injection findings on a municipal assistant, governance-ready mapping places those findings into standard LLM risk taxonomies such as OWASP LLM categories so the AI risk register remains comparable, auditable, and actionable across city programs. Taxonomy mapping lets CISOs, auditors, and product owners aggregate injection, insecure output handling, and related classes without inventing one-off labels that never enter enterprise risk language. Correct practice connects technical evidence to recognized categories and then to municipal owners and remediation tracks. Mapping findings to conventional infrastructure CVSS scores for patch prioritization workflows is a general vulnerability-scoring exercise with no bearing on how an injection finding should be categorized for AI governance. Filing findings as general citizen service complaints for staff performance review cycles is an HR and service-quality process, not a risk-taxonomy mapping exercise for the AI risk register. Logging findings as routine service desk tickets for general municipal IT troubleshooting workflows hides AI risk from the systems that fund and track security remediation. Exam caveat: taxonomy mapping supplements—not replaces—local operational impact notes; OWASP-style labels still need civic consequence text for city leadership. Operational check: assign each injection finding a primary LLM category, secondary municipal impact tag (e.g., 311 integrity, permitting), owner, and due date in the AI risk register, and verify register exports appear in governance reviews.