A hospital wants encryption-at-rest indicators to re-evaluate every week instead of waiting for quarterly attestations. What should the implementer configure?
Select an answer to reveal the explanation.
Short Explanation
Continuous monitoring is the smoke alarm that checks itself on a timer, not the yearly fire inspection. Schedule the encryption indicators to re-evaluate weekly and you get fresh signals without waiting for the quarterly clipboard exercise. That’s the continuous monitoring setup.
Full Explanation
Hospital encryption-at-rest indicators that must re-evaluate weekly instead of waiting for quarterly attestations need continuous monitoring schedules so those indicators run on a weekly cadence. Continuous monitoring is the timer that refreshes measurable control or risk signals between human attestation cycles. Civic clinical encryption posture should not be blind for an entire quarter when instrumentation exists.
Disabling indicators and relying only on annual external audit reports abandons ongoing assurance. A one-time Flow that runs once and then archives the indicator definition is not a recurring schedule. Manual spreadsheet imports every Monday with no indicator records recreate shadow monitoring outside IRM.
Exam caveat: continuous monitoring schedules drive recurring indicator evaluation; one-shot flows and spreadsheets are not substitutes.
Operational check: set weekly evaluation on encryption indicators; confirm runs and history update; keep quarterly attestations for process judgment where needed; remove Monday spreadsheet imports for the same measure.
Weekly schedules should be visible in indicator configuration history so hospital GRC can prove continuous monitoring is active between attestation cycles. Alert owners when consecutive weekly runs fail, and keep annual external audits as supplemental assurance—not the only encryption signal source for clinical systems.