AI Governance and Program Management

AAISM · 62 questions

• A city CIO briefs the mayor’s cabinet on anchoring the municipal AI charter. Which action best aligns stakeholder expectations with industry AI security governance?
• County counsel asks how EU AI Act–style risk-tier thinking should shape a resident benefits-triage chatbot. What is the most appropriate governance response?
• Public-health leadership wants NIST AI RMF language in the department’s AI oversight board charter. Which outcome does that primarily achieve?
• A transit board will approve an AI scheduling pilot only after roles are clear. What should security leadership do first?
• An elections office is drafting an RFP for a ballot-help assistant. How should leading ethical AI principles influence procurement governance?
• A housing authority privacy officer asks how ISO AI management standards relate to existing ISO 27001 controls for tenant-data AI tools. What is the soundest guidance?
• City council auditors ask who must be consulted before expanding a 311 generative assistant citywide. Which consultation set best reflects stakeholder considerations?
• A school-district security manager maps state student-privacy rules to an AI tutoring vendor’s data practices. What should drive the governance decision?
• Fire/EMS leadership compares a triage LLM that drafts clinical-style advice with one that only answers station routing FAQs. How should governance prioritize them?
• A water utility board must approve a leak-prediction model. What should be the governance baseline for AI security expectations?
• Municipal open-data stewards will publish model cards for city datasets used with public AI tools. Which constraint best reflects responsible-use principles?
• A courts administrator asks which external parties care about AI used in case-status messaging. Which answer best identifies relevant oversight stakeholders?
• County IT asks whether AI Fundamentals training alone satisfies management accountability for the AI steering committee. What is the correct distinction?
• A city information-security office must guide staff using generative tools on permit files. What is the most appropriate first policy action?
• Public libraries need a way to handle prompts that would summarize confidential donor notes. Which action best operationalizes AI policy?
• A permitting director wants AI to reduce fraud without bypassing human plan reviewers. Which strategy choice best fits?
• County HR asks security to cover generative AI on telework laptops. How should AI-specific policy content be maintained?
• A 311 manager needs a path when the chatbot gives unsafe answers about hazardous waste drop-off. What should procedures define?
• Transit security must stop staff from pasting badge-access logs into public LLM chatbots. Which artifact best translates policy into practice?
• A parks department proposes AI for turf irrigation scheduling. What should security require before capability rollout?
• Emergency management will use AI to draft after-action reports. What should standard operating procedures govern before public release?
• A housing authority discovers caseworkers used unsanctioned AI on personal tenant chats. What is the most appropriate strategy response?
• City legal and security co-author go-live rules for resident-facing AI. Which procedure requirement is most appropriate?
• School-district security sees teachers installing classroom AI agents without review. What procedural control should be embedded?
• A water utility’s AI security policy addresses models that recommend valve actions. Which policy stance best enforces control for high-impact operations?
• A municipal IT strategy committee wants to reduce exposure of housing and benefits case notes to consumer AI services. Which strategy choice best supports that goal?
• A city permitting office discovers multiple generative assistants and vector stores with no single owner list. What should security establish first for AI asset lifecycle management?
• Public-health leadership plans a fine-tuning experiment using extracts from clinic notes. What lifecycle action should security require before the experiment proceeds?
• Courts IT is retiring an obsolete case-summarization model that stored embeddings derived from sealed records. What lifecycle control should security prioritize?
• A transit authority wants assurance that datasets feeding an on-time prediction model are governed from collection through deletion. Which management approach best demonstrates that control?
• 311 operations finds duplicate chatbot agents in the municipal CMDB with unclear ownership. What should the AI security program require?
• A housing authority uses synthetic tenant profiles for model evaluation alongside a smaller set of real PII records. How should these be reflected in the AI data inventory?
• Library digital services collect prompt and response logs that include cardholder research queries. What lifecycle decision must security drive?
• Emergency management relies on a third-party foundation model hosted outside city infrastructure for draft situation summaries. How should the AI asset inventory treat that model?
• An assessor’s office uses parcel imagery datasets to power an AI valuation helper. Which lifecycle practice best strengthens AI data management?
• Parks department staff find an abandoned fine-tuned model still reachable with an old API key. What decommissioning control should security enforce?
• County IT builds RAG corpora from building-code PDFs and from resident complaint emails. What inventory action is most appropriate?
• A water utility proposes feeding SCADA historian data into a generative training pipeline without OT security review. What lifecycle gate should AI security enforce?
• A city CISO wants AI security managed as more than ad-hoc project advice. Which program action best establishes sustained coverage?
• Public-health security needs visibility into whether AI controls are operating. Which program management practice best provides that visibility?
• Transit leadership funds copilots for dispatch supervisors. What AI security program element should accompany that rollout?
• Courts administration asks how AI security tooling should be introduced. Which approach best fits AI security program management?
• A permitting office wants assurance that chatbot owners keep AI security controls current. Which program cadence best supports that goal?
• A county CIO wants AI security risk visible alongside other cyber risk. How should the AI security program be structured for reporting?
• Housing authority caseworkers increasingly use generative tools on tenant communications. What should the AI security program maintain?
• Emergency management is updating its annual security program maturity assessment. How should AI systems be included?
• School-district security has limited AI program capacity. Which roadmap prioritization best reflects AI security program management?
• A library consortium deploys shared AI assistants across city branches with unclear who approves changes. What program artifact should security establish?
• A water utility board understands NIST Cybersecurity Framework categories but is new to AI controls. How should security present AI program coverage?
• City security operations wants the information security program to cover misuse of municipal generative assistants. Which program action best expands detection coverage?
• A city updates its incident response plan after a permitting chatbot may have leaked resident PII. Which action best establishes AI-specific incident handling?
• Public-health business continuity planning must address flu-season surge if an AI triage helper goes offline. Which BC action best addresses that AI availability risk?
• Transit incident response playbooks must cover adversarial model drift that misroutes accessible-service vans. Which IR update best supports AI-specific investigation and reporting?
• Courts define response when an AI case-status messenger unexpectedly shows sealed-case content. Which action best establishes escalation for that AI security incident?
• Emergency management uses an AI tool to draft public alerts and depends on a model provider. Which DR/BC action best treats that third-party AI dependency?
• 311 operations must keep answering residents when the generative assistant is taken offline during an incident. Which continuity measure best supports that need?
• A housing authority suspects data poisoning against a tenant-services model and opens an incident. Which IR requirement best supports investigation?
• A water utility runs a tabletop that assumes the AI leak-detection model fails. Which exercise outcome best validates BC readiness for that AI failure mode?
• School-district security finds a malicious plugin inside a classroom agent. Which IR phase action best completes eradication and recovery for that AI compromise?
• A parks department AI map assistant posts incorrect trail closures to the public. Which incident action best addresses notification for that integrity failure?
• County counsel wants vendor-model breach notice timelines reflected in operations. Which IR runbook update best aligns AI incident reporting with those requirements?
• Fire/EMS leadership sees an AI assistant invent hydrant locations during drills. Which action best treats that integrity failure in municipal incident taxonomy?