A county configuration baseline for AI gateways is missing from the CMDB. What should the auditor emphasize?
Select an answer to reveal the explanation.
Short Explanation
If the AI gateway baseline is not in the CMDB, nobody knows what 'good' looked like last Tuesday. Put AI configs in configuration management like any other critical component. You can't treat performance dashboards and usage analytics as configuration baselines; they're for capacity reviews.
Full Explanation
AI gateways mediate models, prompts, logging, and often data egress for county workloads. When the configuration baseline for those gateways is missing from the CMDB, the county cannot reliably detect unauthorized change, recover known-good settings, or evidence what "approved" looked like. The auditor should emphasize including AI gateway configuration baselines in the CMDB as part of AI-specific configuration management—versioned settings, ownership, and linkage to services that depend on the gateway.
Registering AI gateway endpoint discovery records in the CMDB for operational service mapping fails because endpoint discovery records map service relationships; they are not versioned configuration baselines and do not establish ownership, approved settings, or recovery procedures. Logging AI gateway incident and change tickets in the CMDB as configuration baseline items fails because incident and change tickets record events and requests; they are not versioned, approved configuration baselines and cannot substitute for known-good settings. Storing AI gateway performance dashboards and usage analytics in the CMDB to support capacity management reviews fails because performance data and analytics describe operational usage, not configuration state; they do not provide the versioned baseline, ownership, or change history that configuration management requires.
Exam caveat: AAIA configuration management for AI includes gateways, models, and related baselines—not only traditional servers. Operational check: locate the AI gateway CI in the CMDB with a current baseline, last-change reference, and recovery procedure; if the baseline lives only in Slack or someone's laptop, treat that as a control gap.