County IR must triage AI failures consistently. How should AI incidents be classified?
Select an answer to reveal the explanation.
Short Explanation
Not every AI mess is the same fire. Classify by privacy leak, safety harm, bias surge, or availability loss so triage matches the burn.
Full Explanation
County IR must triage AI failures by severity classes such as privacy leak, safety harm, bias surge, and availability loss because each class implies different urgency, stakeholders, containment, and notification duties. Consistent classification prevents every AI ticket from being treated as a vague “bot glitch” and aligns response with resident harm type. A privacy leak may trigger legal notice clocks; a safety harm may require immediate channel disablement; a bias surge may need model hold and equity review; availability loss may invoke continuity failovers without implying a data breach.
Classifying only as network outages regardless of AI harm type fails because privacy and safety events may leave the network “up” while still injuring people or rights. Treating incidents as low priority whenever a vendor logo is involved fails accountability; outsourcing does not reduce municipal duty to triage by impact. Omitting labels so every ticket looks identical fails operationally: without classes, SLAs, paging, and escalation paths cannot match the burn.
Exam caveat: AI IR taxonomies emphasize harm and data-impact categories beyond classic CIA outage labels. Operational check: encode severity classes in the IR ticket taxonomy, map each class to playbooks and notification matrices, train helpdesk on first-pass labeling, and audit misclassified tickets after major events.