AI Risk and Threat Management

CRAGE · 24 questions

• A city SOC briefs the AI board on threats to the 311 GenAI assistant. Which governance-level recognition is most appropriate?
• County threat briefings cover fraud models trained partly on public form submissions. What AI threat should leaders recognize?
• Transit security reviews a proprietary ridership predictor hosted with a vendor. Which risk belongs on the AI threat register?
• Housing analysts build an AI risk taxonomy for an eligibility screener. What category should sit alongside cybersecurity risks?
• A water utility is formalizing AI risk management. Which artifact best captures identified risks?
• Emergency management must prioritize AI risks under limited resources. Which prioritization approach best fits civic public-safety outcomes?
• Courts IT assesses GenAI that drafts clerk responses citing municipal code. Which operational AI risk should be explicitly assessed?
• A library scores risks for a RAG assistant over patron-related corpora. Which risk belongs in the assessment?
• City GRC wants framework structure for AI risks already identified. What mapping best applies NIST AI RMF thinking?
• A county adopts ISO/IEC 42001-aligned AI risk treatment. Which set of options should decision records support?
• Public health threat-models a triage chatbot before launch. Which oversight-level coverage is most appropriate?
• A permitting office analyzes AI system attack surface for governance review. Which inventory is most complete?
• Fire/EMS evaluates risks to computer-vision fire-spotting cameras. Which threat recognition is appropriate at governance level?
• A 311 product risk workshop adapts structured threat modeling to AI. Which approach best fits?
• A utility risk team reviews AI dependencies beyond traditional app CVEs. Which systemic AI risk should they add?
• An elections office rates threats to public communications integrity before election season. Which AI-related risk belongs on the register?
• An assessor’s office evaluates what happens if valuation AI systematically skews one district. Which impact dimensions should the risk assessment capture?
• A parks department still sees known false positives from trail-cam AI after controls. What governance outcome should be logged?
• City GRC adds human review and rate limits to a GenAI service desk. How should risk scores be compared?
• County ERM wants AI risks visible to executives alongside other enterprise risks. What practice best fits?
• A public hospital district ranks AI risks across clinical and administrative tools. Which prioritization is most appropriate?
• Transit reviews what happens if one GenAI vendor outage blocks rider-facing chat. Which risk should be assessed?
• Code enforcement notices construction patterns changing after a new zoning code. Which AI risk should they flag?
• City counsel reviews who must own residual risk statements on the AI risk register. What accountability rule fits?