A control requires a manager’s judgment that segregation of duties remains appropriate, while another control can be measured by an automated configuration check. How should evidence architecture differ?
Select an answer to reveal the explanation.
Short Explanation
Some locks need a person to say ‘still looks right,’ and some locks have a sensor. Attestations capture human judgment; indicators capture system-measurable signals. Pick the evidence style that matches how the control can actually be checked.
Full Explanation
Attestations and automated indicators are both valid evidence architectures in IRM. Human judgment and qualitative confirmation fit attestation campaigns; continuously or periodically measurable technical conditions fit indicators. Choosing based on measurability keeps evidence credible and avoids forcing automation where judgment is required—or manual attestations where telemetry already exists.