After hardening the open-data RAG portal, residual risk remains. What should the project present to the risk committee?
Select an answer to reveal the explanation.
Short Explanation
Hardening doesn’t mean zero risk—tell the committee what’s left, who owns it, and whether to accept it. A vulnerability scan summary isn’t a residual-risk memo.
Full Explanation
After hardening the open-data RAG portal, residual risk remains and the project should present the risk committee a clear residual-risk statement with owners and acceptance options. Hardening reduces but does not eliminate risks such as retrieval of mislabeled sensitive documents, prompt-injection via public corpora, citation gaps, or cost/availability abuse of the LLM backend. Governance needs an honest articulation of what is left, estimated likelihood and impact in municipal terms, who owns each residual item, and whether leadership will accept, further mitigate, transfer, or avoid. That statement turns technical work into accountable decision-making rather than a vulnerability scan summary with remediation timelines that leaves ownership and acceptance unaddressed. Presenting residual risk with options also creates an audit trail for later incidents: the city can show what was known, who accepted it, and when it should be revisited after corpus or model changes. A detailed hardening log with control test evidence is useful for audit assurance, but it is operational documentation, not the residual-risk governance artifact being asked for. A vulnerability scan summary with remediation timelines supports continuous monitoring, but it is not a substitute for the residual-risk statement with owners and acceptance options the committee needs. An updated threat model with attack paths helps engineering plan the backlog, but it is a technical planning artifact, not the committee-facing residual-risk statement with owners and acceptance options. The committee needs an honest statement of what remains, who owns it, and what to do about it now—not a hardening log, a scan summary, or a threat model substituting for a governance decision. Exam caveat: do not pick a hardening log, a vulnerability scan summary, or a threat model when the stem asks for the governance artifact; the governance artifact is a residual-risk statement with owners and accept/mitigate choices. Operational check: deliver a one-page residual-risk brief to the committee listing top remaining AI threats for the RAG portal, named owners, proposed dispositions, and a review trigger (e.g., major corpus refresh or model upgrade).