A resident-data leak scare involving the 311 assistant requires one shared severity model. What should SOC and the privacy office do?
Select an answer to reveal the explanation.
Short Explanation
When the bot touches resident data, severity isn’t just about server uptime or model accuracy—extending a vulnerability score, calibrating from drift alerts, or using helpdesk urgency categories all miss the privacy and security blend you need. You and the privacy office must co-own one shared rubric that ranks incidents by resident data harm, not by technical or operational metrics alone.
Full Explanation
After a resident-data leak scare involving the 311 assistant, SOC and the privacy office should co-own one AI incident severity rubric that integrates security impacts (confidentiality, integrity, availability of civic systems) with privacy impacts (unauthorized disclosure of resident data, secondary use, retention exposure). A shared model prevents contradictory escalation: security might treat a prompt-leak of PII as medium because no ransomware was involved, while privacy correctly treats the same event as high because resident trust and legal notification duties are triggered. Joint severity criteria—what constitutes critical for 311 AI, which combinations of data classes and blast radius force immediate containment, who is notified—enable coherent playbooks, consistent reporting to leadership, and aligned evidence collection across prompts, tool traces, and access logs. Extending the vulnerability management risk score to rank AI privacy incident severity might sound structured, but it reduces a resident-data leak to a technical vulnerability metric, ignoring the privacy and trust harms that demand a shared rubric integrating both security and privacy impacts. Calibrating severity from model performance monitoring alerts for drift and accuracy degradation focuses on model health, not on the unauthorized disclosure of resident data, so it would fail to trigger the containment and notification duties that a shared severity rubric must capture. Prioritizing severity using helpdesk ticket urgency categories for 311 service restoration would conflate operational restoration speed with the severity of a privacy incident, missing the distinct legal and trust implications that require an integrated rubric co-owned by SOC and privacy. What's needed is one rubric both teams actually co-own, not parallel processes or a mismatched template. Exam caveat: items may offer separate 'privacy policy update' or 'SOC-only severity' options; the distinguishing answer is shared ownership of an integrated rubric for AI incidents that blend both harm types. Operational check: publish a one-page 311 AI severity matrix used by both SOC and privacy, tabletop an injection-plus-PII scenario, and confirm both teams assign the same severity band and execute the same escalation contacts within the agreed timeline.