A municipal compliance issue needs a change window and assignment group that already live in ITSM for a firewall rule fix. How should IRM touch ITSM without turning the item into an ITSM-process exam?
Select an answer to reveal the explanation.
Short Explanation
GRC finds the gap; ITSM runs the wrench turn. Spawn or link a change/incident from the issue so the firewall fix lands in the queues people already work. Rewriting Change Management inside Policy is the long way around.
Full Explanation
IRM commonly integrates with ITSM so GRC issues can create or relate changes and incidents for remediation. That touchpoint reuses assignment and change discipline without relocating GRC ownership into ITSM process design. The exam focus remains the integration purpose, not CIS-ITSM depth.