A hospital GRC lead wants generated access-review controls to appear only on applications classified as Critical Applications. How should the control objective be scoped?
Select an answer to reveal the explanation.
Short Explanation
Entity types are the mailing list for who gets which controls. Point the control objective at Critical Applications and generation drops the right controls on matching apps. Global-then-delete, one-off CI hacks, and exception templates are not how scoping is supposed to work.
Full Explanation
Control objectives are scoped to entity types (and related conditions) so Policy and Compliance generates controls only for matching civic entities. When a hospital GRC lead needs access-review controls only on applications classified as Critical Applications, scoping the control objective to that entity type ensures generation places controls on the right clinical and business applications and keeps lower-tier apps out of the mandatory review set. Leaving the objective global and manually deleting non-critical controls after each generation run fails by concept because cleanup is not durable scoping—the next generation recreates drift and missed deletions. Attaching the objective only to a single application CI ignores the entity-type model and fails by concept for fleet-scale hospital application estates that must stay consistent as apps are added. Publishing the objective as a policy exception template so critical apps opt in voluntarily fails by concept because exceptions govern deviations, not routine control generation for a classified population. Exam caveat: CIS-RC distinguishes entity-type–driven control generation from post-hoc cleanup and from exception workflows. Operational check: set the control objective entity type to Critical Applications, run generation for a sample of critical and non-critical apps, and confirm only critical entities receive the access-review controls.