Failed compliance tests for an entity should open issues that land with the team that supports that entity. What configuration achieves this?
Select an answer to reveal the explanation.
Short Explanation
When a test fails, the ticket should walk itself to the folks who fix that system. Assignment rules keyed to the entity’s support group do that. One giant GRC pile, email-only alerts, or tribal-memory typing are how failures get lost.
Full Explanation
Issue assignment rules connect failed control tests to the operational groups responsible for remediation. Configuring rules so failed tests for an entity route issues to that entity’s support group aligns ownership with who maintains the civic system and shortens time-to-fix for citizen-facing applications. Assigning every failed-test issue to a single global GRC backlog regardless of entity fails by concept because a catch-all queue disconnects remediation from system operators and creates bottlenecks that hide entity-specific urgency. Emailing the failure to a distribution list and creating no issue record in IRM fails by concept because email without an issue destroys workflow, aging metrics, and examiner-visible remediation tracking. Requiring the tester to remember which group to type each time fails by concept because tribal memory assignment is inconsistent and error-prone under volume. Exam caveat: CIS-RC favors rule-driven issue assignment to entity support groups over global catch-alls and email-only alerts. Operational check: configure an assignment rule keyed to entity support group, fail a sample control test, and confirm the opened issue assigns to that entity’s support group automatically without manual retyping.