A municipal compliance issue needs a change window and assignment group that already live in ITSM for a firewall rule fix. How should IRM touch ITSM without turning the item into an ITSM-process exam?
Select an answer to reveal the explanation.
Short Explanation
GRC finds the gap; ITSM runs the wrench turn. Spawn or link a change/incident from the issue so the firewall fix lands in the queues people already work. Rewriting Change Management inside Policy is the long way around.
Full Explanation
When a municipal compliance issue needs a change window and assignment group that already live in ITSM for a firewall rule fix, IRM should create or link an ITSM change or incident from the GRC issue so remediation rides existing fulfillment queues. GRC finds and tracks the gap; ITSM executes the technical work. Linking preserves both lifecycles without rewriting Change Management inside Policy.
Rewriting the entire Change Management process inside the Policy application invents a parallel fulfillment factory. Closing the GRC issue with no fulfillment ticket because ITSM must never see GRC work strands remediation. Replacing IRM issues entirely with Problem Management as the only remediation object collapses distinct GRC issue semantics into ITSM problem alone.
Exam caveat: link IRM issues to ITSM change/incident for fulfillment; do not retire IRM issues or rebuild ITSM inside Policy.
Operational check: from a GRC issue, create/link a change for the firewall fix; confirm assignment group and window follow ITSM; keep the IRM issue open until remediation verifies.
Keep the IRM issue as the compliance/risk remediation tracker even after the ITSM change is created; close the issue only when verification evidence shows the firewall fix met the control intent. This two-object pattern is the civic standard: GRC accountability plus ITSM fulfillment.