Three different testers evaluate the same encryption control at a water utility and produce inconsistent procedures and evidence. What should compliance maintain?
Select an answer to reveal the explanation.
Short Explanation
If every tester improvises, you get three different movies of the same scene. Keep a shared test-procedure library so anyone can run the same play and land comparable evidence.
Full Explanation
When three testers evaluate the same encryption control at a water utility with inconsistent procedures and evidence, compliance should maintain a library of standardized test procedures so different testers execute and document consistently. Standardization protects drinking-water OT assurance by making results comparable. Separate undocumented tester preferences as institutional knowledge fails by concept because tribal methods produce non-comparable evidence and break when staff leave. Only verbal walkthroughs with no stored procedures fails by concept because spoken steps cannot be versioned, trained, or examined reliably. A screenshot repository with no steps describing how evidence was obtained fails by concept because images without method do not prove the test design was followed. Exam caveat: CIS-RC expects standardized test procedures for consistent multi-tester execution and documentation. Operational check: publish a standard test procedure for the encryption control in the IRM library, have two testers execute against it on a sample CI, and confirm evidence artifacts and steps align to the procedure. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.