A city wants the same ransomware wording assessed consistently across dozens of department applications. Which Risk architecture best enables that consistency?

Consistent ransomware wording across dozens of department applications is achieved by defining one reusable risk statement and generating entity-level risks from that statement for the scoped application set. Risk statements function as library content: a single canonical threat description yields comparable assessments, rollups, and treatment language while still allowing each civic application entity to carry its own residual, owners, and responses. That pattern is how municipal IRM keeps estate-wide threat language aligned without forcing every department to invent synonyms.

Asking each department to invent free-text risk titles preserves jargon at the expense of aggregation and comparability—the board cannot sum five differently worded ransomware risks cleanly. Creating a separate unrelated statement for every application when the threat is identical produces statement sprawl and double-counting in rollups. Storing ransomware only as a policy exception and never as a risk statement abandons Risk architecture entirely; exceptions are compliance objects, not a substitute for assessed technology risk.

Exam caveat: CIS-RC emphasizes statement libraries and generation to entities. Consistency comes from reuse and generation, not from proliferating near-duplicate statements or relocating the topic into Policy exceptions alone.

Operational check: locate the canonical ransomware statement; confirm scoping to public or department application entities; generate or verify entity risks share the same statement text; spot-check residual owners per entity; reject new free-text ransomware titles that duplicate the library item.