Which of the following controls would MOST effectively mitigate worst-case service disruption scenarios affecting an AI-based application system?

A Disaster Recovery Plan (DRP) is the foundational control for mitigating the impact of significant service disruptions. For an AI-based system, which has unique failure modes like model poisoning, catastrophic forgetting, or adversarial attacks, a generic DRP is insufficient. Including a range of specific AI disruption scenarios within the DRP ensures that the organization has pre-planned, tested, and resourced procedures to recover from worst-case events. This proactive and comprehensive planning is the most effective strategy for ensuring timely and orderly restoration of services, thereby minimizing business impact. It is more encompassing than reactive measures or testing activities alone.

A. Performing periodic tabletop exercises is a method to test and validate a plan. The plan itself is the primary mitigation control, not the exercise used to test it.

B. A kill chain or kill switch is a reactive containment mechanism. While critical, it is only one component of a full disaster recovery process, not the entire mitigation strategy.

C. Updating key risk indicators (KRIs) is a monitoring activity. KRIs provide early warnings of increasing risk but do not constitute a plan for recovering from an actual disruption.

1. ISACA

Auditing Artificial Intelligence

2023: Chapter 5

"AI Risk Management

" emphasizes the need to update business continuity and disaster recovery plans (BCP/DRP) to address unique AI-related risks. It states that traditional DRPs may not cover scenarios like model degradation or data poisoning

making it essential to explicitly include them.

2. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems

September 2010: Section 2.2

"Contingency Planning

" defines contingency planning as the development of "a formal plan that prepares organizations to respond to system disruptions." This establishes the DRP as the core control for managing disruptions.

3. NIST

AI Risk Management Framework (AI RMF 1.0)

January 2023: The "Govern" function (GOV 4.2) discusses establishing policies for AI system failures and incidents. The "Manage" function (MANAGE 2.3) covers identifying and documenting AI risks

which would inform the specific scenarios to be included in a DRP.