A water utility’s automated retraining job can swap the SCADA anomaly-detection model in production with no drift check or human approval. What lifecycle control is missing?
Select an answer to reveal the explanation.
Short Explanation
Auto-swapping OT-adjacent models without a look-before-you-leap gate is like changing the plant’s gauges while nobody watches. Check drift and get approval. Public dumps, killing rollback, and blind swaps are the opposite of control.
Full Explanation
A water utility’s automated retraining job that can swap the SCADA anomaly-detection model in production with no drift check or human approval is missing lifecycle control: drift evaluation and an approval gate before production model swap. OT-adjacent civic detections influence operator trust and potentially plant response. Unsupervised cutovers can introduce false negatives that miss real anomalies or false positives that desensitize operators. Drift and performance evaluation plus an explicit approval gate create a look-before-you-leap boundary appropriate for safety-relevant municipal models.
Nightly full SCADA database dumps into the public open-data portal fails because it is a severe confidentiality and operational-security failure, not a lifecycle gate. Removing all rollback paths so only the newest model remains fails because it eliminates recovery when the swap is bad. Disabling monitoring so operators are not alerted during swaps fails because it hides the very signals needed to detect harm.
Exam caveat: for OT-adjacent ML, “fully automated promote” is rarely the desired answer; exams expect evaluation plus human (or policy) approval and preserved rollback.
Operational check: require drift/regression reports attached to the change ticket; block auto-swap without approval; keep the prior artifact tagged known-good; rehearse rollback during a maintenance window with operators watching anomaly dashboards.