A city CISO needs to allocate limited AI control investment across departments. Which assessment approach best supports that prioritization?

A city CISO allocating scarce AI control investment needs comparative visibility into departmental AI risk. Cross-department AI risk heat maps support prioritization by placing civic portfolios on a shared severity and likelihood scale so funding follows higher residual exposure—public safety, benefits eligibility, or critical infrastructure AI—rather than politics or novelty. The approach works because portfolio risk assessment is how enterprise information security programs ration controls under constraint while remaining defensible to audit and council oversight.

Ranking departments by total AI model count fails because inventory size correlates with automation volume, not harm potential or residual control gaps; a small portfolio of high-impact civic AI can be far riskier than a large inventory of low-risk tools.

Sequencing control uplift by governance documentation maturity fails because paperwork maturity is a process indicator, not a risk measure; departments with polished documentation can still run high-impact, high-residual-risk civic AI, while under-documented portfolios may face the gravest exposure.

Targeting spend by vendor SOC 2 attestation gaps fails because supply-chain certification is not departmental risk prioritization; a well-certified vendor can still power high-consequence civic AI, and attestation gaps say nothing about residual risk, impact, or likelihood within the department.

Exam caveat: heat maps are only as good as consistent scoring criteria and complete AI inventories; incomplete shadow-AI discovery can understate true departmental heat. Operational check: publish a citywide AI inventory with impact tiers, score residual risk with a common rubric, rank control investments against the heat map, and require departments below the funding line to maintain minimum baseline controls while awaiting deeper investment.