A county compliance program already runs automated encryption indicators and still needs owners to confirm process controls that cannot be fully instrumented. Which assurance design fits?
Select an answer to reveal the explanation.
Short Explanation
Some doors get electronic sensors; some still need a human to confirm the lock turned. Hybrid assurance keeps continuous indicators for what machines can measure and periodic attestations for process judgment. Dropping either side leaves blind spots.
Full Explanation
County compliance programs that already run automated encryption indicators and still need owners to confirm process controls that cannot be fully instrumented should combine continuous indicators with periodic human attestations for hybrid assurance. Machines measure what they can; humans attest to judgment-based process controls. Hybrid design is the mature civic pattern—not an either/or choice.
Retiring all attestations because any indicator exists leaves process controls unassured. Using only annual policy acknowledgments and ignoring both indicators and control attestations reduces assurance to handbook reading. Replacing indicators and attestations with a single ITSM problem ticket per year provides neither continuous signal nor recurring control evidence.
Exam caveat: hybrid assurance = continuous indicators + periodic attestations. Acknowledgments and yearly problems are insufficient substitutes.
Operational check: inventory controls as instrumentable versus judgment-based; keep indicators on the former and attestations on the latter; report combined assurance status to the compliance committee without dropping either channel.
Hybrid assurance dashboards should show indicator status beside attestation completion so committees see both automated and human evidence streams. When instrumentation later covers a formerly judgment-based control, migrate carefully rather than abruptly deleting attestation history needed for examiners.