Application owners must confirm that backup restore tests occurred this period. Which Policy and Compliance configuration supports that verification pattern?
Select an answer to reveal the explanation.
Short Explanation
Sometimes the proof is a signed yes—did you actually restore from backup? Wire that ask into an attestation questionnaire on the control. Chat standups and orphaned change templates do not leave an examiner a trail.
Full Explanation
Attestation-based verification collects structured owner confirmation as compliance evidence on a control. When civic application owners must confirm that backup restore tests occurred this period, configuring an attestation questionnaire on the control that asks that confirmation produces examiner-ready, control-linked records in Policy and Compliance. Replacing technical indicators with a single enterprise risk register entry for backups fails by concept because a risk register entry is not a control attestation artifact and does not prove period restore testing. Deleting scheduled control tests and relying on verbal standup confirmation fails by concept because spoken assurances leave no durable evidence chain for health or municipal continuity exams. Creating a change request template labeled backup restore without linking it to compliance controls fails by concept because ITSM templates alone do not create control-linked attestation or test evidence for compliance reporting. Exam caveat: CIS-RC separates attestation questionnaires on controls from informal conversation and from unlinked ITSM artifacts. Operational check: attach an attestation questionnaire to the backup-related control asking whether restore tests occurred, have a sample owner submit a response, and confirm the attestation appears on the control evidence for the period.