A utility publishes control objectives for encryption but never scopes them to entities. What happens architecturally?
Select an answer to reveal the explanation.
Short Explanation
A speed-limit sign with no roads attached does not ticket anyone. Control objectives need entities in scope before useful controls are generated and tested. Without that scoping, compliance stays theoretical.
Full Explanation
Control objectives without entity scoping generate nothing useful for operational compliance testing. When a utility publishes encryption control objectives but never scopes them to entities, owners receive no entity-level controls to test, attest, or remediate, and dashboards stay empty despite a polished library. The platform does not auto-create one control for every CI in the global CMDB merely because an objective exists. Citations do not convert into risks automatically so Advanced Risk covers the compliance gap. Authority documents do not become self-testing without controls and ownership. Publishing unscoping content feels like project progress, yet the civic operating model still lacks work items. Exam caveat: association to entity types or entities is the scoping act that enables item generation—publication of the objective alone is insufficient. Operational check: take the encryption objectives, associate them to in-scope entity types for systems that store sensitive data, run item generation, confirm controls appear with owners, and only then schedule testing. Update the utility's content authoring checklist so publish-without-scope cannot be marked complete in status reports, and audit objectives monthly for missing entity associations before leadership reviews.