frameworks

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

Knowing the acronym is the easy part. Mapping a real attack chain onto tactics, and saying what that mapping is useful for, is what gets scored.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

Naming Govern, Map, Measure and Manage takes five seconds. Saying what each one produces in your organisation is the answer.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

Seven characteristics that frame most AI governance conversations. The scored answer names them precisely and shows how security supports, and trades off against, the others.

Three frameworks, three different questions: what can go wrong in what we build, how attackers actually operate, and how the organisation manages the risk. Using one for another's job is the common mistake.