Several encryption and access controls for a county EHR need recurring evidence from the same system owners. Which common IRM capability should the implementer rely on?
Select an answer to reveal the explanation.
Short Explanation
Attestations are like a reusable checklist clipboard you hand the same owners for different controls. One common evidence mechanism, many controls—without reinventing a survey for every row. That’s the shared attestation idea in IRM common elements.
Full Explanation
Recurring evidence from the same system owners for several county EHR encryption and access controls should rely on attestations as a shared evidence mechanism reusable across controls and owners. Attestations provide a common task model: ask owners structured confirmation on a cadence, link results to controls, and reuse the pattern instead of inventing a unique survey per row. That common element reduces owner fatigue while preserving examinable proof for clinical systems.
One-time PDF uploads stored only on each control with no reusable task model do not scale recurring proof and drift out of date. A separate survey application outside GRC for every control with no entity link creates shadow compliance. Security incident playbooks that double as quarterly compliance proof confuse incident response with control attestation.
Exam caveat: attestations are the shared IRM evidence mechanism for recurring owner confirmation—not ad hoc PDFs, external surveys, or SIR playbooks.
Operational check: configure attestation campaigns for the EHR encryption/access control set; assign the same owners across related controls where appropriate; verify completed attestations link to controls; retire parallel external survey tools for the same proof.