A health department can auto-check encryption settings daily but still needs annual human review of exception handling. Which architecture fits?
Select an answer to reveal the explanation.
Short Explanation
Sensors watch the fridge temperature all day; once a year a dietitian still checks the menu. Indicators handle the measurable stuff continuously, while periodic human tests cover judgment calls. Use both—do not force one to replace the other.
Full Explanation
A health department that can auto-check encryption settings daily but still needs annual human review of exception handling should pair continuous monitoring indicators with periodic human tests where judgment is still required. Hybrid evidence matches hybrid risk. Replacing every human test with indicators and retiring periodic reviews drops judgment domains examiners still ask about. Using only annual manual tests and ignoring available automation wastes continuous assurance the platform can provide. Disabling indicators because continuous monitoring is supposedly out of scope for CIS-RC misreads modern IRM practice and the value of entity-centric monitoring hooks. Exam caveat: hybrid designs need clarity on which failures auto-open issues versus which await scheduled human testing—ambiguous ownership creates gaps between daily signals and annual reviews. Operational check: attach encryption configuration indicators to relevant controls and entities, schedule annual exception-handling tests, verify both evidence types appear in posture reporting, and document the hybrid model for health compliance leadership. Review indicator thresholds and human test procedures jointly each year as systems and exception volumes change across clinics.