Two city departments argue whether a shared integration hub belongs in either department’s IRM scope. What is the soundest handling?
Select an answer to reveal the explanation.
Short Explanation
Shared hubs fall through the cracks when each team says “that’s theirs.” Put the integration hub on the map once, name an owner, and scope it deliberately. Shared tech still needs a single governed entity—not a polite shrug from both sides.
Full Explanation
Shared technology such as an integration hub should be treated as an entity that is explicitly scoped once with clear ownership rather than omitted by both departments. When two city departments each say “that’s theirs,” shared hubs fall through the cracks and create mutual exclusion gaps in risk and compliance coverage. Shared platforms still need a first-class governed object on the civic map. Leaving the hub out of all scopes because shared technology cannot be an entity invents a false limitation and guarantees blind spots. Duplicating the hub as two identical entities so each department can score it separately without coordination creates conflicting scores and evidence. Scoping the hub only inside Security Incident Response playbooks addresses incident response, not standing IRM entity governance. Exam caveat: shared services belong in Entity Framework with assigned ownership, not polite shrugs or duplicate twins. Operational check for the departments: create or select one entity for the integration hub, name a primary owner and supporting stakeholders, attach relevant risks and controls once, and prohibit a second duplicate entity for the same CI. Keep civic stakeholders aligned on the operating model, and verify platform records after each change before reporting posture to leadership. Revisit the design when CMDB classes, org structures, or program charters change.