A new IRM analyst asks for the end-to-end chain from reusable content to ongoing oversight for a civic cyber risk. Which sequence best matches the Risk and Advanced Risk lifecycle?

The end-to-end chain from reusable content to ongoing oversight for a civic cyber risk is Framework → risk statement → scoped risk → assess → respond → monitor. That sequence matches the Risk and Advanced Risk lifecycle from structure through continuous oversight. Monitoring first then inventing a framework after residual scores exist fails by concept because methodology and grouping must precede coherent scoring. Responding and closing then creating a risk statement only if auditors request it fails by concept because statements are foundational reusable content, not afterthoughts. Jumping from entity class to audit engagement to citation to policy exception only fails by concept because that chain skips the risk lifecycle entirely. Exam caveat: CIS-RC lifecycle order is framework, statement, scoped risk, assess, respond, monitor. Operational check: walk a pilot civic cyber risk through each stage in order in a subproduction instance, confirming each artifact exists before advancing, and screenshot the chain for training. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.