Leadership asks “what are we governing?” before loading ISO control citations into ServiceNow IRM. What should the implementation team establish first?
Select an answer to reveal the explanation.
Short Explanation
Before you stock the pantry with recipes, decide whose kitchen you are cooking for. Leadership’s “what are we governing?” question is about entities—departments, apps, facilities—not dumping ISO text. Nail the scope map first; then citations and controls have somewhere meaningful to land.
Full Explanation
Entity scoping is a prerequisite to useful policy, risk, and audit content. Without a clear answer to which services, org units, and other objects are in scope, control libraries become orphaned reference text. Implementations that load citations before designing entity populations often rework associations later under pressure. Establishing scoped entity populations first lets subsequent content attach once and report consistently.