CMDB and HR integrations continuously add new configuration items and org units, but GRC entities used for control scoping lag weeks behind. What should the entity architecture include?
Select an answer to reveal the explanation.
Short Explanation
If the CMDB grows every night but entities only wake up once a year, compliance is governing yesterday’s city. Wire a refresh cadence so new CIs and org units become entities on purpose. Stale entity lists are how controls miss the new ERP node everyone just stood up.
Full Explanation
Entity architecture must keep governable objects synchronized with their source tables. When CMDB and HR integrations continuously add configuration items and org units but GRC entities lag weeks behind, include a refresh or generation cadence tied to source-data changes so entities stay aligned with upstream systems. Civic compliance scope cannot freeze while the city keeps hiring and deploying systems. A one-time manual import with no scheduled refresh after go-live guarantees drift. Freezing membership permanently once the first control is generated blocks legitimate new in-scope objects. Requiring owners to recreate every entity from scratch each quarter without automation does not scale and invites errors. Exam caveat: refresh cadence must respect scope filters—faster sync of bad or out-of-scope data still creates noise; pair cadence with quality and scope gates. Operational check: define refresh frequency or event triggers from CMDB/HR feeds, measure entity lag for a pilot bureau, alert when lag exceeds the municipal SLA, and document the cadence in the IRM runbook. After the next integration surge, confirm new org units and CIs appear as entities before control campaigns launch.