The city CISO wants Protect-AI style GenAI security practices aligned with cloud and DevSecOps frameworks already adopted. What strategic integration is appropriate?
Select an answer to reveal the explanation.
Short Explanation
GenAI security should plug into the frameworks you already run—not live on an island or throw out cloud/DevSecOps. Map Protect-AI style practices into the enterprise stack; meme accounts are not a strategy office.
Full Explanation
Strategic integration maps Protect-AI-style GenAI security practices into the city’s existing enterprise security frameworks (cloud security, DevSecOps, SDLC, IR, vendor risk) rather than inventing an isolated silo. Shared language, gates, tooling, and accountability reduce duplicate process, close gaps between “AI team” and “security team,” and make GenAI auditable under frameworks staff already know. GenAI adds new control content; it should not orphan itself from enterprise practice.
Creating a completely separate GenAI security program that never shares controls or language with existing frameworks duplicates effort and creates inconsistent assurance. Discarding cloud and DevSecOps controls because GenAI “makes them obsolete” throws away still-necessary identity, network, CI/CD, and logging foundations. Outsourcing strategy to a meme account that posts AI tips is not municipal governance.
Exam caveat: mapping into existing frameworks still requires AI-specific control overlays (prompt injection, model governance, RAG ACLs)—integration is not “GenAI needs nothing new.” Operational check: produce a control-mapping matrix from GenAI practices to the city’s adopted cloud/DevSecOps framework with owners and gap remediations.