An architect asks which core IRM applications the CIS-RC blueprint centers on for Risk and Compliance implementation. Which answer best reflects that core scope?
Select an answer to reveal the explanation.
Short Explanation
CIS-RC is about the GRC toolkit in the middle of the platform—policy, risk, entities, audit—not every nearby product badge. Adjacent suites like SIR or SAM may share the platform, but they are not the exam’s equal core. Keep the architect focused on those IRM apps and common elements.
Full Explanation
The CIS-RC blueprint centers on Policy and Compliance, Risk and Advanced Risk, Entity Framework, Audit, and shared GRC common elements—not every adjacent suite SKU as equal core. Architects should keep design decisions focused on those IRM applications and the framework that ties them together for civic risk-and-compliance outcomes. Sibling products may share the platform and even exchange data, but they are not equal pillars of the CIS-RC exam or of a Risk and Compliance charter. Keeping that boundary prevents endless scope creep into every ServiceNow badge in a vendor demo. Naming Security Incident Response, Vulnerability Response, and Software Asset Management as the three mandatory CIS-RC pillars substitutes neighboring certifications for Risk and Compliance. Centering only Customer Service Management workspaces and HR case types for employee attestations misses the GRC applications entirely. Treating Change, Incident, and Problem Management alone as the IRM control plane collapses IRM into ITSM process design. Exam caveat: know what is in the CIS-RC core versus what is merely nearby on the platform. Operational check for the architect: produce a one-page scope diagram listing P&C, Risk, Entity Framework, Audit, and common elements as in-scope, with SIR, VR, SAM, and ITSM marked adjacent or out-of-core for the CIS-RC implementation charter.