risk management

Every senior security engineer has one. The scored answer shows you reduced the risk, made the residual visible, got the right owner to accept it, and kept watching.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Write a release record with consequence-specific requirements, enforcement assumptions, measured task quality and unresolved outcomes. Name the decision owner and reopening conditions.

Naming Govern, Map, Measure and Manage takes five seconds. Saying what each one produces in your organisation is the answer.

A policy that says 'AI systems shall be secure' changes nothing. A release gate that blocks deployment until the red-team regression suite passes changes everything.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.