School IT drafts a multi-year GenAI architecture plan. Which element best demonstrates long-term security capability building?

Long-term municipal GenAI security capability is built through phased control maturity with sequenced platform-security capabilities over multiple years. School IT’s architecture plan should show a staircase: identity and least privilege for model and data access; centralized logging and attribution; model and dataset inventory; evaluation and promotion gates; vendor diligence; RAG and vector-store controls; acceptable use and shadow-AI monitoring; and incident-to-risk-register feedback—each with milestones, owners, and dependencies. That sequencing demonstrates sustainable capability building rather than a one-time purchase narrative.

A one-week sprint that claims all GenAI risk is permanently closed is unrealistic, usually unverifiable, and invites audit skepticism. Buying GPUs with no identity, logging, or data-governance milestones funds compute without control capability and can accelerate unsafe usage. Deferring all security work until after the third superintendent change ties risk reduction to political churn instead of a managed multi-year roadmap and leaves students and staff exposed in the interim.

Exam caveat: maturity model names vary across frameworks; the exam concept is sequenced, multi-year capability building with measurable security milestones—not tool shopping or a single heroic sprint. Operational check: attach a phased GenAI security capability roadmap to the architecture plan with yearly outcomes, named owners, funding needs, and explicit dependencies on identity, logging, and data governance before expanding student-facing GenAI features.