A security architect proposes storing all control-test evidence only in email threads. What should the IRM implementer recommend instead?
Select an answer to reveal the explanation.
Short Explanation
Email is a hallway full of sticky notes—easy to lose and hard to audit. IRM wants the test results, attestations, and issues sitting in the platform where owners, dates, and history stick. That is how a regulated org proves what was checked and when.
Full Explanation
IRM is designed so control tests, attestations, and related issues live as platform records with ownership, workflow, and history. Email archives and ad-hoc personal stores fragment evidence and weaken defensibility. Implementers should establish the IRM instance as the system of record for those GRC artifacts rather than SIR playbooks or informal conversation logs.