The CISO must quantify and communicate AI output risk from civic bots to the mayor's office. Which approach best fits?
Select an answer to reveal the explanation.
Short Explanation
Mayors buy risk they can picture—likelihood, impact on city services, and what's missing in controls—said in plain talk. Benchmark metrics, vendor checklists, and raw logs won't show you what to fund.
Full Explanation
When the CISO must quantify and communicate AI output risk from civic bots to the mayor's office, the best fit is presenting scored impact, likelihood, and control gaps in plain executive language tied to city services. Leaders fund what they can picture: which resident services are affected, how likely abuse or failure is, and which controls are missing. Correct communication translates model-output risk into municipal decision inputs without requiring executives to read tensors. Reporting benchmark accuracy and latency metrics mapped to model versions suits engineering review, but it does not translate AI output risk into scored service impact, likelihood, and control gaps for the mayor's office. Summarizing vendor accuracy claims and compliance checklist results as formal risk quantification repeats vendor self-assessment rather than independently scoring civic impact, likelihood, and control gaps for mayoral decisions. Delivering detailed penetration test logs and raw citizen chat transcripts overwhelms executives with operational detail and omits the scored, service-level risk view needed for budget decisions. Exam caveat: quantification can be ordinal scores or calibrated estimates; perfect precision is less important than transparent assumptions tied to civic services. Operational check: produce a one-page executive risk view with impact, likelihood, control gaps, and owners for top civic bots; validate language with the mayor's staff for clarity; and track whether funded mitigations map to the scored gaps presented.