A risk manager is reviewing an organization's AI incident response plan. Which element is MOST critical to include specifically for AI-related incidents that would not necessarily be required in a traditional cybersecurity incident response plan?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need procedures for reverting to pre-AI decision processes and assessing how many past AI decisions may have been wrong and need remediation. That's what makes AI incident response different, because models can keep making bad calls before anyone notices.
Full Explanation
The correct element is procedures for reverting to pre-AI decision processes, such as fallback to human review, and assessing the scope of potentially erroneous AI decisions that may require remediation. AI-specific incident response must address two unique dimensions: the ability to revert to pre-AI decision processes so decisions continue to be made while the AI is down or unreliable, and the retrospective assessment of how many past AI decisions may have been erroneous and require correction or remediation. These are unique to AI incidents where models may have been producing wrong outputs for an extended period before detection. Escalation contacts for the information security team and legal counsel, customer outage notification, and forensic procedures apply to both traditional cybersecurity incidents and AI incidents.