AI Risk Management and Strategic Application

GAIPS · 25 questions

• A city CIO wants structured threat modeling before launching a resident benefits GenAI portal. Which approach best fits Domain 8 responsible-AI planning?
• County counsel asks security to place GenAI platform risks on the existing municipal enterprise risk register. What is the sound strategic move?
• Transit leadership wants rapid GenAI pilots while security insists on stage gates tied to residual risk. How should planning balance agility with responsible AI?
• A housing authority plans a casework summarizer that may touch protected attributes but skips any privacy or impact assessment. What should strategic risk management require?
• A public-health GenAI program has no clear owner for model risk versus application security risk. What RACI clarification best supports strategic AI risk management?
• A school-district board wants metrics for responsible GenAI use that go beyond uptime SLAs. Which metric set best fits strategic AI risk oversight?
• Emergency management runs a tabletop but only models classic IT outages. What GenAI-specific scenario should strategic planning add?
• A city open-data AI strategy depends entirely on one commercial LLM vendor with no exit options. What strategic risk is missing from the plan?
• A permitting office accepts a GenAI vendor’s questionnaire answers at face value with no validation of AI-specific controls. What due-diligence improvement is needed?
• Court clerks paste sealed case text into public consumer LLMs because no acceptable-use policy exists. What strategic control should leadership prioritize?
• A water utility completes a classic STRIDE-style review of a GenAI ops assistant but omits misuse and data-poisoning classes. What should strategic threat modeling add?
• A library GenAI roadmap has no plan to retire models trained on donor data that later becomes restricted. What long-term security planning gap exists?
• 311 product owners call prompt injection a “content moderation issue” and keep it off the risk register. What strategic correction is required?
• A county board asks whether GenAI security investment should wait until federal AI rules fully settle. What is the best strategic response?
• A housing AI steering committee must decide control rigor for a FAQ chatbot versus an eligibility-scoring assistant. What strategic approach fits?
• Transit publishes an AI transparency note that boasts benefits but omits known residual security limitations. What responsible disclosure practice is missing?
• Public-health security’s annual plan still budgets zero hours for RAG and vector-database threat reviews. What roadmap update is needed?
• A city auditor asks for evidence that GenAI threat-model findings were closed before go-live. Which assurance practice answers that request?
• Parks department GenAI success metrics push maximizing personal data retention while privacy goals demand minimization. How should strategy resolve the conflict?
• Emergency operations needs a path when GenAI advice conflicts with the official Incident Action Plan. What governance control belongs in the strategy?
• School IT drafts a multi-year GenAI architecture plan. Which element best demonstrates long-term security capability building?
• A county risk committee compares inherent risk to residual risk after adding moderation and RAG ACL controls on a benefits assistant. What evaluation are they performing?
• The city CISO wants Protect-AI style GenAI security practices aligned with cloud and DevSecOps frameworks already adopted. What strategic integration is appropriate?
• After a housing-authority chatbot leak, the post-incident review never updates the AI risk register. What strategic feedback-loop step was missed?
• A municipal AI steering committee asks for a prioritized backlog of platform security epics derived from threat-model severity. What planning output meets that request?