Remediations for public-facing portals are overdue and need executive visibility. What supporting process should compliance use?
Select an answer to reveal the explanation.
Short Explanation
Public portals sitting broken past the due date belong on the CIO’s radar. Escalate those overdue remediations to the risk committee. Muting alerts, burying them in a mailbox, or quietly downgrading severity is how reputation risk grows.
Full Explanation
Escalation processes for overdue remediation elevate stalled issues to governance forums with authority to prioritize resources. Escalating overdue remediations for public-facing portals to the CIO risk committee gives executive visibility when citizen-facing compliance gaps linger past due. Muting overdue notifications and waiting for the next annual audit fails by concept because annual mention is not timely escalation for live public portals that residents use daily. Reassigning all portal issues to an unmonitored queue mailbox fails by concept because parking work where nobody watches is concealment, not escalation. Lowering severity on overdue items so they drop off executive reports fails by concept because severity downgrades to hide overdue work undermine accountability and distort risk reporting to civic leadership. Exam caveat: CIS-RC treats escalation of overdue civic remediations to governance committees as a supporting process, not mute/bury/downgrade tactics. Operational check: identify overdue public-portal remediation issues, execute the escalation path to the CIO risk committee, and confirm the items appear on the committee agenda or risk report with original severity intact.