nist

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

Seven characteristics that frame most AI governance conversations. The scored answer names them precisely and shows how security supports, and trades off against, the others.

Regulation does not tell you how to red-team, but it decides what you must be able to show. The scored answer maps programme outputs to the evidence each framework expects.