Between scheduled control tests, a hospital's continuous indicator shows repeated access-review breaches on a clinical application. What should happen in compliance?
Select an answer to reveal the explanation.
Short Explanation
Continuous indicators are the smoke alarm between fire drills. When they scream, open a compliance issue now — do not wait for the next scheduled test to notice the smoke.
Full Explanation
Continuous indicators that show repeated access-review breaches between scheduled tests should reopen or create compliance issues so gaps are worked before the next formal test. In a hospital clinical application protecting patient access, waiting for the attestation window allows prolonged exposure after the smoke alarm already sounded. Ignoring indicator breaches until the next formal attestation fails by concept because continuous monitoring exists precisely to detect issues between test cycles. Automatically marking related controls effective because continuous monitoring replaces testing fails by concept because indicators complement testing; they do not invent effectiveness when breaches are firing. Deleting the indicator so only manual tests create issues fails by concept because removing detection hides risk rather than governing it. Exam caveat: CIS-RC expects indicator breaches to drive compliance issues between scheduled tests, not to be ignored or used as a fake automatic pass. Operational check: review an access-review indicator breach on the clinical app, confirm a compliance issue opens or reopens, and verify owners receive actionable remediation tasks before the next formal test due date.