A civic IRM rollout has an authority document, citations, control objectives, generated controls, and open issues—but failed tests never create those issues. Which stage is missing in the chain?
Select an answer to reveal the explanation.
Short Explanation
The story goes mandate → citation → objective → control → test → issue. They built everything except the test that fails into an issue. Without that link, remediation never starts from compliance evidence.
Full Explanation
A civic IRM rollout that already has an authority document, citations, control objectives, generated controls, and open issues—but where failed tests never create those issues—is missing control testing that records results and drives issue creation on failure. The content chain is incomplete without the test activity that converts control execution into pass/fail evidence and remediation triggers owners can work. A separate CMDB class used only for compliance scoring does not create issues from failures. Replacing all internal control objectives with Vendor Risk questionnaires changes program scope rather than fixing the missing test-to-issue stage. Using Security Incident Response playbooks as the compliance evidence store confuses SIR with Policy and Compliance testing and breaks standard IRM reporting. Exam caveat: configure the fail-to-issue path deliberately—assuming issues appear magically after generation is a common implementation gap on CIS-RC style rollouts. Operational check: execute a deliberate failing test in subprod, confirm an issue is created with ownership, trace links from test to issue to control to citation, and document the path in the city's compliance SOP. Monitor production for failed tests without companion issues as a defect signal after go-live and fix workflow configuration promptly.