IT maps confidentiality, integrity, and availability threats for a city council agenda drafter that uses GenAI. Which mapping best reflects GenAI-specific failure modes?
Select an answer to reveal the explanation.
Short Explanation
CIA still works for GenAI — secrets leaking from prompts, made-up agenda text, and the model being down are still C, I, and A. You are just applying the triad to new failure modes. Badge readers and chamber power are not the whole story.
Full Explanation
CIA still applies to GenAI, with failure modes mapped to new components. Confidentiality includes leakage of sensitive prompts, retrieved records, and telemetry. Integrity includes hallucinations, prompt-injected policy bypass, and tampering with RAG corpora. Availability includes model endpoint outages, dependency rate limits, and cascading failures when the agenda drafter cannot reach its LLM or tools. Mapping city council agenda drafting this way keeps risk analysis familiar while remaining GenAI-specific.
Saying confidentiality only covers badge readers and that GenAI has no CIA relevance wrongly excludes AI systems from standard risk framing. Reducing integrity uniquely to disk encryption of PDF archives ignores content integrity of generated agenda text. Claiming availability only fails when chambers lose power ignores service and model dependency outages that block drafting even if the building has power.
Exam caveat: a fluent but wrong agenda item is an integrity issue even when confidentiality and availability are fine. Over-focusing on GPU uptime can miss silent integrity failures. Confidentiality can fail via verbose logs without an external "breach" of the model vendor.
Operational check: include GenAI in system risk assessments; define controls per CIA axis (redaction, grounding/human review, failover); test agenda workflows under vendor outage; and assign owners for prompt logging versus content approval. Council support staff should know whether a failure is "model down," "wrong content," or "sensitive text leaked."