A risk manager is reviewing an organization's AI incident response plan. Which element is MOST critical to include specifically for AI-related incidents that would not necessarily be required in a traditional cybersecurity incident response plan?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because AI-specific incident response must address two unique dimensions: first, the ability to revert to pre-AI decision processes (fallback mode) so decisions continue to be made while the AI is down or unreliable; and second, the retrospective assessment of how many past AI decisions may have been erroneous and require correction or remediation. These are unique to AI incidents where the model may have been producing wrong outputs for an extended period before detection.
Full explanation below image
Full Explanation
B is correct because AI-specific incident response must address two unique dimensions: first, the ability to revert to pre-AI decision processes (fallback mode) so decisions continue to be made while the AI is down or unreliable; and second, the retrospective assessment of how many past AI decisions may have been erroneous and require correction or remediation. These are unique to AI incidents where the model may have been producing wrong outputs for an extended period before detection. Escalation contacts (A), outage communication (C), and forensic procedures (D) apply to both IT and AI incidents.