A new municipal IRM rollout needs a starting set of IT risk statements quickly, then local tailoring. Which configuration path is sound?
Select an answer to reveal the explanation.
Short Explanation
Starter libraries are the prefab framing for the house—you still finish the rooms. Import a municipal IT statement set, then tailor before you generate risks across the estate.
Full Explanation
A new municipal IRM rollout should load or import a starter risk statement library for municipal IT risks, then tailor wording and scope before wide generation. Starter content accelerates consistency while local tailoring prevents generic language from misfitting civic services. Blank-page invention at scale produces uneven quality and delays.
Inventing every statement from blank forms with no starter content slows rollout and invites inconsistent threat language. Copying production SIR incident short descriptions into the statement table unchanged confuses incident symptoms with reusable risk statements. Skipping statements and generating risks only from random CI names abandons threat library architecture.
Exam caveat: content packs/starter libraries plus tailoring beat both empty-table heroics and raw incident-text imports.
Operational check: import the starter IT statement set; review and tailor top statements with city SMEs; scope carefully; generate for a pilot entity set before estate-wide generation.
Tailoring after import should adjust civic terminology, remove irrelevant commercial statements, and set initial scopes before generation so the first wave of risks matches city services. Establish a statement governance board that approves new library items and rejects raw incident short-description imports from SIR as statement candidates. Measure rollout success by percentage of generated risks tied to tailored library statements rather than free-text orphans.