Block release pending remediation decision: What is the most direct missing control?
Known red-team findings require remediation or documented residual-risk authorization before release, regardless of favorable benchmark results.
The question
During procurement of a software-assistance model, red-team testing identifies prompt-injection and confidential-data leakage paths. The supplier provides a favorable benchmark, but remediation evidence and residual-risk acceptance are absent. All other procurement controls are satisfied. What is the most direct missing control?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Block release pending remediation decision ✓Documented red-team findings require remediation or an authorized residual-risk decision before release, rather than allowing benchmark results to close the gap.
- Add quarterly supplier performance reportingPeriodic reporting supports ongoing oversight, but the immediate release decision requires treatment or explicit acceptance of known findings.
- Expand employee training on secure promptingTraining may reduce some misuse, but it cannot by itself address confidential-data leakage paths or document residual-risk authorization.
- Request a larger supplier benchmarkA larger benchmark may add evidence, but it does not resolve known injection and leakage findings or establish risk acceptance.
The trap
Known high-consequence findings outweigh generic benchmark comfort until treatment or accountable risk acceptance is documented. How to remember it
Known red-team findings require remediation or documented residual-risk authorization before release, regardless of favorable benchmark results.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Development questions
- Revalidate the changed version against contextual: What control is most directly missing before release? →
- Contain affected decisions while preserving evidence: What should happen first? →
- Test rollback against retained claims data: Which missing control is most direct? →
- All 426 Understanding How to Govern AI Development questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Development ·
Every answer, right and wrong, comes with its own explanation.
