Question

Employees across several business units have rapidly begun using a third-party generative AI service to accelerate their work. The information security manager becomes aware of this trend but has no formal record of the tool in the risk register or any assessment of its data handling. Which action should the information security manager take FIRST to address this emerging risk?

Accepted Answer

Identify and document how the AI service is being used and what data is being exposed to it

Answer

Immediately block access to the AI service at the network perimeter

Answer

Purchase cyber insurance coverage that includes AI-related data exposure

Answer

Add a clause to the acceptable use policy prohibiting all AI tools