A lead asks what a control objective means versus a control in IRM. Which statement is accurate?
Select an answer to reveal the explanation.
Short Explanation
The objective is the reusable goal—like keep privileged access reviewed. The control is that goal planted on a specific entity with owners and tests.
Full Explanation
A control objective is a reusable desired outcome; a control is the scoped instance of that safeguard on an entity. Like the risk-statement-versus-risk pair, IRM keeps library language portable while instances carry ownership, testing, and evidence for a specific civic object. “Keep privileged access reviewed” can live as an objective once and then become controls on multiple applications or facilities with different owners. That pattern prevents rewriting the same requirement as unrelated one-off text for every department. Calling a control objective a scored residual-risk number and a control an authority document mixes risk scoring and mandate objects into the control hierarchy. Saying control objectives and controls are identical records with two display names erases the definition-versus-instance pattern. Limiting controls to audit and control objectives to Vulnerability Response parks the pair in the wrong modules. Exam caveat: control objective versus control is core CIS-RC terminology and mirrors other content pairs throughout the blueprint. Operational check for the lead: author or select one control objective, scope it to two different entities, and confirm two control records appear with distinct owners while sharing the same objective definition.