Leadership asks whether Vendor Risk, Business Continuity, and Privacy apps invent their own unrelated data models. What accurate purpose-level answer should the CIS-RC implementer give?
Select an answer to reveal the explanation.
Short Explanation
Think of Vendor Risk, BCM, and Privacy as extra rooms on the same house, not separate cabins in the woods. They lean on the same entity, control, and issue foundations as core IRM. Purpose-level awareness beats diving into a full TPRM specialty exam.
Full Explanation
Vendor Risk, Business Continuity, and Privacy extended IRM apps are designed to share entity, control, and issue foundations with core Risk and Compliance rather than inventing a separate universe. Purpose-level architecture for a port or city is one house with additional rooms: extended apps reuse the civic entity framework and common remediation objects. CIS-RC expects that shared-foundation awareness without diving into specialty TPRM deep configuration.
Claiming each extended app must use only ITSM tables and never reference GRC entities denies the IRM data model. Saying Vendor Risk replaces Entity Framework entirely so Privacy and BCM must not use entities is false and destructive. Claiming those apps are out of IRM entirely and require a different product family with no shared objects misstates the platform family purpose.
Exam caveat: extended IRM apps share core GRC foundations. They are not ITSM-only, not entity-framework replacements, and not outside IRM.
Operational check: inspect entity and issue usage across Risk, Compliance, and one extended app (Vendor Risk, BCM, or Privacy) in the instance; document shared objects for architecture reviews; reject designs that clone a second entity universe per extended app.