Week 9 self-check | AI GRCA Practice Lab

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

How should a confirmed incident feed back into MANAGE's broader risk treatment process?

Incidents only need to be reported to affected customers, nothing elseIncident learnings are only relevant to the specific engineer involvedIncidents should be resolved and then forgotten with no wider follow-upLessons from the incident should inform whether existing treatment, controls or monitoring need to be strengthened

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

What is a realistic early-warning 'risk indicator' MANAGE might monitor after release?

Only the company's stock priceA rising override or exception rate that could signal declining model reliabilityOnly office attendance figuresOnly marketing engagement metrics

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

'Release gates' in MANAGE function as:

Only relevant to hardware releasesA synonym for a risk register entryOptional suggestions with no real effectDefined checkpoints that must be passed before a system can be released or scaled

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

Which best reflects a 'reduce' treatment, as distinct from 'avoid'?

Reduce means keeping the system but adding controls that lower the risk to an acceptable levelAvoid and reduce are identical strategiesReduce is only used for low-severity risksReduce means not building the system at all

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

A rollback plan is important because:

It's never actually neededIt lets the organisation revert to a safe prior state if a release causes harmIt replaces the need for testingIt's only relevant to database migrations

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

Why might 'geographic restriction' be a more proportionate response than full deactivation?

Geographic restriction and deactivation are the same actionGeographic restriction is never a valid optionIt can address a region-specific legal or risk issue without disrupting service where the issue doesn't applyFull deactivation is always the only valid response to any issue

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

What is the primary purpose of the MANAGE function?

Prioritising risk and deciding treatment, release controls and monitoringWriting test scriptsBoard induction trainingDefining intended use

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

A 'localisation/geographic restriction policy' addresses:

Only applies to hardwareOnly translation qualityRestricting where data or system operation occurs, often for legal or risk reasonsOnly marketing localisation