A passed access-review control test needs durable proof for later review. What supporting process should the tester follow?
Select an answer to reveal the explanation.
Short Explanation
Passed still needs a paper trail. Attach the screenshots and ticket exports to that access-review test. Memory, overwriting last period, or personal email folders are how evidence vanishes before exam day.
Full Explanation
Evidence collection supporting compliance tests attaches artifacts to the test record for retention and examiner review. Collecting screenshots and ticket exports on a passed access-review test documents how the pass was determined for civic identity and access governance. Telling the GRC lead the test passed and storing nothing on the test record fails by concept because verbal notice is not durable evidence on the control test examiners will request. Overwriting the prior period’s evidence with this period’s files to save space fails by concept because prior-period packages must remain reconstructable for multi-year exams of public programs. Emailing screenshots to a personal inbox and leaving the control test empty fails by concept because personal mailboxes are not the system of record and vanish with staff turnover. Exam caveat: CIS-RC requires evidence on the test record itself, retained per period, including for passed tests that support access governance. Operational check: attach screenshots and ticket exports to a passed access-review test, move to the next period without deleting prior attachments, and confirm both periods’ evidence remain retrievable from the respective test records.