What are the key components of the recovery process after an AI incident?

• A. Ensure the threat is contained and eradicated.
• B. Rebuild the entire system from scratch without validation.
• C. Increase exposure to data.
• D. Ignore residual threats.

Answer: (A)

During the recovery phase after an AI incident, the priority is to contain and eradicate the threat so that operations can be restored safely. This involves stopping the attacker’s access, removing malicious code or compromised models, and replacing or repairing affected components with clean, validated equivalents. It also includes validating the integrity of data and model outputs, applying patches or configuration fixes, and enhancing monitoring and controls to detect any signs of lingering risk. Once the environment is confirmed clean and stable, recovery proceeds with reestablishing services, validating performance, and implementing improvements to prevent recurrence, along with post-incident review and updates to incident response playbooks.

Rebuilding the entire system from scratch without validation would ignore essential checks that ensure safety and integrity. Increasing exposure to data would raise risk and could violate governance and privacy controls. Ignoring residual threats leaves an open door for renewed compromise, undermining any recovery effort.