The CIO wants automatic attention when residual scores rise above High. Which configuration implements that appetite rule?
Select an answer to reveal the explanation.
Short Explanation
Appetite thresholds are tripwires. Configure them so anything above High lights up review for the CIO instead of hoping someone remembers the rule in a standup.
Full Explanation
Automatic attention when residual rises above High is implemented by configuring risk appetite or tolerance thresholds so scores above High flag for CIO review through workflow or notification. Thresholds convert appetite statements into enforceable system behavior for municipal executives. Without configured thresholds, the High rule remains a verbal preference.
Asking owners to remember the High rule in standups fails as durable control. Lowering every score by one level so nothing exceeds High falsifies posture to avoid governance. Publishing the High rule only in a policy PDF without system thresholds separates documentation from operational enforcement.
Exam caveat: appetite must be configured as thresholds and workflow, not only as policy prose. CIS-RC repeatedly tests that distinction.
Operational check: set Above High → CIO review; raise a test residual into that band; confirm notification or approval task fires; verify scores were not globally depressed to dodge the rule.
Threshold configuration should name the CIO review group or approval authority explicitly, define whether notification alone or mandatory approval is required, and log the breach event against the risk for later board reporting. Test the path in subproduction with a synthetic Above High residual so municipal GRC can prove the tripwire before go-live. Pair the system threshold with a short appetite narrative in policy so executives see both the rule in prose and the enforced workflow in IRM—never prose alone.