A utility publishes control objectives for encryption but never scopes them to entities. What happens architecturally?
Select an answer to reveal the explanation.
Short Explanation
A speed-limit sign with no roads attached does not ticket anyone. Control objectives need entities in scope before useful controls are generated and tested. Without that scoping, compliance stays theoretical.
Full Explanation
Policy and Compliance architecture depends on the entity framework: control objectives are scoped to entities (or entity types/classes) so the system can generate actionable controls. Objectives alone do not create operational test targets. Without entity scoping, there is no meaningful instance lifecycle for testing, ownership, or posture by business object.