A county wants newly discovered critical business applications in the CMDB to become GRC entities without weekly spreadsheet imports. What integration pattern should the implementer use?
Select an answer to reveal the explanation.
Short Explanation
When CMDB learns about a hot new app, GRC should hear about it too. Wire entity generation or sync so critical apps become entities on their own. Typing them as citations or hiding in VR groups misses the entity framework.
Full Explanation
Newly discovered critical business applications in the CMDB should become GRC entities through configured entity generation or sync from CMDB so qualifying apps become entities automatically. That integration pattern keeps the county entity framework aligned with the authoritative CI landscape without weekly spreadsheet imports. Entity sync is foundational IRM hygiene for expanding civic application estates.
Hand-typing each new app as a policy citation instead of an entity confuses citations with entities. Ignoring CMDB and recreating application lists only inside SIR vulnerability groups misplaces entity management into VR constructs. Requiring CAD-level custom app development before any entity can reference a CI overstates implementation depth for a standard sync/generation pattern.
Exam caveat: CMDB→entity generation/sync is the expected pattern; citations and VR groups are not entity substitutes.
Operational check: define critical-app qualification rules; enable entity generation/sync; introduce a pilot CI; confirm a GRC entity appears without spreadsheet import.
Qualification rules for critical apps should combine CI class, business criticality, and service mapping so entity sync stays selective. Monitor a daily sync exception queue for failed generations and resolve data issues in CMDB rather than recreating lists inside VR groups.