Controls are generated from a Control Objective when what is applied to it?

Controls are generated from a Control Objective when what is applied to it?

• A. Policy
• B. Citation
• C. Indicator template
• D. Entity Type

Answer: (D)

Controls are created from a control objective when you apply that objective to a specific entity type. In IRM, the control objective states what needs to be achieved, but to turn that into actionable controls you tie it to an entity type—the asset or process the control will protect. Once the objective is applied to that entity type, the system instantiates the concrete controls tailored to that scope, turning high-level requirements into implementable safeguards for that particular asset class. Policies, citations, and indicator templates don’t trigger this instantiation in the same way: a policy governs rules, a citation references a standard, and an indicator template defines how you measure things, but they don’t automatically generate the concrete controls tied to a specific asset type.

Controls are created from a control objective when you apply that objective to a specific entity type. In IRM, the control objective states what needs to be achieved, but to turn that into actionable controls you tie it to an entity type—the asset or process the control will protect. Once the objective is applied to that entity type, the system instantiates the concrete controls tailored to that scope, turning high-level requirements into implementable safeguards for that particular asset class.

Policies, citations, and indicator templates don’t trigger this instantiation in the same way: a policy governs rules, a citation references a standard, and an indicator template defines how you measure things, but they don’t automatically generate the concrete controls tied to a specific asset type.