A county purple-team checklist sequences an authorized AI-assisted phishing exercise end to end. Which order best reflects sound municipal practice?
Select an answer to reveal the explanation.
Short Explanation
Pick the right platform for the drill, let AI draft, let humans edit, lock the ROE, measure what happened, then coach. Surprise-send-before-paperwork is how counties earn unpleasant audits. Reveal-the-lure training first also ruins the test.
Full Explanation
A county purple-team checklist for an authorized AI-assisted phishing exercise should sequence work as: choose GoPhish or SET for the scope, draft with AI, human-edit, confirm ROE, measure outcomes, then deliver remediation training. Tool choice first aligns infrastructure to objectives. AI drafting accelerates content. Human editing enforces tone, privacy, and legal bounds. ROE confirmation authorizes the send. Measurement captures learning signal. Remediation training closes the loop without burning the test by revealing the lure too early. Sending first to capture surprise metrics, then selecting the platform, then requesting ROE approval afterward inverts governance and risks unauthorized impact. Skipping human editing whenever AI drafts pass a grammar checker, then measuring only after public disclosure, substitutes spelling for policy review and can contaminate results with premature reveal. Starting with remediation training announcements that reveal the exact lure, then generating content, then picking tooling last ruins the evaluative value of the simulation and reverses operational dependencies. Exam caveat: GOAA end-to-end sequencing items reward governance-before-send order for municipal AI phishing exercises. Operational check: enforce the checklist as a gated workflow in the county ticketing system so each stage blocks the next until complete.