ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Moving the workload to a cloud service alters control ownership and the data sources used for evidence collection. The continuous monitoring strategy (or plan) is the authoritative document that defines what will be monitored, how often, and by whom. Updating it ensures all stakeholders understand the new metrics, shared-responsibility boundaries, and reporting mechanisms. A configuration-management register tracks individual system changes, not an enterprise monitoring methodology. Incident response playbooks address detection and handling of events, not day-to-day evidence collection. A business impact analysis focuses on mission impacts and recovery priorities, not ongoing monitoring requirements.