ServiceNow CIS-RC free question 4 / 10 · Domain 4: Policy and Compliance
A compliance team is adding the individual requirements of HIPAA to Policy and Compliance Management as citations. According to the structural overview, how can citation records be created?
- Created by hand, or brought in through a UCF import
- Created by hand, as UCF content arrives as controls instead
- Generated when a policy is associated with an entity type
- Generated for each entity when an entity type is created
Show the answer and explanation
Answer: A
Why this is correct
The structural overview defines a citation as a passage or an expression from an authority document, for example the Unified Compliance Framework (UCF), that the business must specifically comply with; it is an individual requirement within an authority document. The overview then says that citations can be created manually or imported via UCF. A team adding the HIPAA requirements can therefore enter them one by one or import them. The overview gives an example of one such requirement: encrypting transmission of cardholder data across public networks is one of the requirements of PCI DSS, an authority document meant to reduce payment card fraud.
Why the other options are wrong
"Generated for each entity when an entity type is created" … The overview says it is entities that are automatically generated when an entity type is created. Entities are what control tests are run against, such as people, departments, applications, or servers.
"Created by hand, as UCF content arrives as controls instead" … The overview gives UCF as a source of citations: they can be imported via UCF as well as created manually. Importing is one of the two ways it gives.
"Generated when a policy is associated with an entity type" … The overview says that associating a policy with an entity type generates controls, one for each entity listed in the entity type for the control objective. It produces controls, not citations.
Key point
Read the overview top down: an authority document such as HIPAA, GDPR, or PCI is an external regulation; a citation is one requirement inside it, such as the PCI DSS requirement to encrypt cardholder data sent across public networks; and controls are tested against entities such as people, departments, applications, or servers.
Go to the ServiceNow CIS-RC practice app (10 free questions; purchase unlocks all questions)