Failed controls produced many open issues; some may miss dates and need formal risk acceptance. How should the backlog be managed?
Select an answer to reveal the explanation.
Short Explanation
A backlog without dates is a junk drawer. Track due dates, and if a fix will slip, park it with real risk acceptance—not delete-to-green or mass close theater. Forever exceptions for everything are not management either.
Full Explanation
Issue backlog management assigns accountability, due dates, and escalation or risk acceptance when remediation cannot meet the original timeline. Managing open issues from failed controls this way preserves visibility and governance for civic compliance debt instead of hiding it. Deleting overdue issues so dashboards stay green fails by concept because deleting work destroys the remediation trail and falsifies program health for leadership and examiners. Ignoring due dates and bulk-closing issues at quarter end without remediation fails by concept because cosmetic closure without fix or acceptance is not a compliance supporting process. Converting every issue into a permanent policy exception with no expiry fails by concept because mass everlasting exceptions abandon remediation discipline and dilute exception governance. Exam caveat: CIS-RC expects open issues to age with owners and due dates, using risk acceptance when delay is deliberate—not delete-to-green tactics. Operational check: review the open issue backlog for the civic scope, ensure each item has an owner and due date, and for any that will miss the date record risk acceptance or escalate rather than deleting or bulk-closing.