Finance process owners need 'payment processing' governed in IRM, but they reject server-level entities as meaningless to them. What entity-type approach fits?
Select an answer to reveal the explanation.
Short Explanation
If the thing owners care about is the payment process—not a blade in the rack—then the entity should be that process. GRC sticks to what people can attest to. Capability and process entities keep non-technical owners in the game.
Full Explanation
IRM entity design is not limited to infrastructure CIs. Process and business-capability entity types are appropriate when that is the object process owners manage for risk and compliance. Forcing infrastructure-only entities alienates non-technical owners and weakens attestation quality. Tags and clerk-level user entities do not replace a clear process scope object for control and risk attachment.