When remediation closes a compliance issue, testers should automatically receive a follow-up verification task. What should be configured?
Select an answer to reveal the explanation.
Short Explanation
Fixing the leak is step one; checking the pipe again is step two. Auto-open a retest when the issue closes so verification is not optional folklore. Closing without a retest, hoping for someday, or spinning a full audit each time misses the point.
Full Explanation
Retest configuration after remediation confirms that corrective action restored control effectiveness. Automatically opening retest tasks when compliance issues close embeds that verification in the workflow for civic systems where a closed ticket alone is not proof the control works again. Closing the issue and the original failed test together with no further verification fails by concept because remediation without retest skips assurance that the fix held under operating conditions. Asking owners to optionally retest someday with no task in the system fails by concept because optional folklore retests are routinely skipped and leave no workflow evidence for examiners. Opening a new audit engagement for every remediated issue fails by concept because escalating every fix to full audit overburdens Internal Audit and misuses engagement scope for routine retests. Exam caveat: CIS-RC expects retest after remediation as a supporting process, distinct from launching a new audit engagement for each fix. Operational check: enable automatic retest on issue close, remediate and close a sample failed-control issue, and confirm a retest task opens against the control for verification before treating the control as effective again.