The risk team wants residual context from how long critical vulnerabilities sit open—without turning the item into a Vulnerability Response implementation. Which configuration fits?
Select an answer to reveal the explanation.
Short Explanation
Think of vuln backlog age as a thermometer reading plugged into the risk record—not a full clinic rebuild. Configure an indicator for that signal and leave Vulnerability Response to handle remediation work.
Full Explanation
Residual context from how long critical vulnerabilities sit open can be captured with an automated risk indicator that pulls backlog-age or similar vulnerability signal as risk context, while Vulnerability Response remediation remains in its own process. This pattern informs ransomware or technology residual discussion without redesigning the CIS-RC item as a full VR implementation exam. IRM stays the risk system of record; VR stays the vuln fulfillment plane.
Rebuilding the entire VR group workflow inside the risk application invents a duplicate remediation factory. Replacing risk owners with vulnerability analysts as the only assessors collapses business ownership into tooling roles. Deleting qualitative assessments wherever any CVE exists overreacts: CVE presence informs, but does not universally abolish qualitative assessment.
Exam caveat: indicator consumption of security tooling signals ≠ implementing VR inside Risk. Keep product boundaries clear on the exam and in civic architecture.
Operational check: configure an indicator sourced from critical vuln age; attach it to the relevant technology risk; confirm VR still owns remediation tasks; keep qualitative assessment available alongside the indicator.