A continuous monitoring indicator for backup success fails mid-quarter for the water utility SCADA support entity. What should happen next in a well-designed IRM setup?
Select an answer to reveal the explanation.
Short Explanation
If the smoke alarm goes off in July, you don’t wait for the December inspection form. Continuous monitoring should open an issue when a signal fails so someone fixes the backup gap now. That’s the whole point of not relying only on quarterly attestations.
Full Explanation
When a continuous monitoring indicator for backup success fails mid-quarter for a water-utility SCADA support entity, a well-designed IRM setup should automatically open or queue an issue from the monitoring failure so remediation starts without waiting for quarterly attestation. The point of continuous monitoring is timely remediation triggers, not decorative dashboards that wait for clipboard season. Civic OT support entities especially need failure-to-issue wiring.
Waiting until the next quarterly attestation window before recording a problem reintroduces the lag continuous monitoring exists to remove. Closing the related control as ineffective permanently with no issue record skips remediation tracking. Opening a security incident only and never creating an IRM issue may be appropriate for true incidents but does not replace IRM issue remediation for control/risk monitoring failures by default.
Exam caveat: indicator failure → IRM issue (or queue) is the expected continuous-monitoring response pattern; waiting for attestation is the anti-pattern.
Operational check: force a backup-success indicator fail in subprod; confirm an IRM issue opens linked to the control/risk/entity; assign remediation; verify quarterly attestation is not the first place the failure appears.