The city CISO maps MLSecOps controls onto existing SDLC stages for GenAI services rather than inventing a separate unchecked process. What integration goal is this?
Select an answer to reveal the explanation.
Short Explanation
GenAI pipelines still go through the city SDLC front door — map MLSecOps onto those stages instead of inventing a back alley. Integrate, do not exempt, wait for breaches, or shadow-duplicate without docs.
Full Explanation
When the city CISO maps MLSecOps controls onto existing SDLC stages for GenAI services rather than inventing a separate unchecked process, the integration goal is integrating MLSecOps controls with the municipal secure development lifecycle. Model scanning, signing, lineage, and promotion gates should appear at the same conceptual stages as other secure-development checkpoints—requirements, build, test, release, operate—so GenAI does not become a back alley around city policy. Integration improves auditability and prevents “AI exception culture.”
Exempting GenAI pipelines from every secure-development checkpoint fails because it creates an unprotected parallel path. Running ML security only after production incidents occur fails because it is purely reactive. Duplicating SDLC gates in an undocumented shadow process fails because shadow processes drift, lack ownership, and fail audits.
Exam caveat: the preferred municipal posture is map-and-integrate MLSecOps into SDLC, not exempt, wait-for-breach, or undocumented duplicate.
Operational check: publish a control mapping from MLSecOps activities to SDLC stages; require the same change tickets and evidence for GenAI releases; sample GenAI services for missing mapped controls; retire any informal AI-only promote path that bypasses the municipal SDLC.