Written for Administrators to look up the names
Control objective
A reusable statement of what must be true. It is the mapping hub: one objective can satisfy requirements from several frameworks and several policies.
Linked to many requirements and policies. Instantiated as one control per scope item.
Fields
| Field | Type | Meaning | Example 1 | Example 2 |
|---|---|---|---|---|
number | autonumber | Unique identifier | OBJ-021 | OBJ-034 |
statement | text | What must be true | Critical systems are backed up daily and a restore is tested every quarter | Access to systems holding personal data is reviewed every quarter |
category | choice | Control family | Resilience | Access management |
control_type | choice | Preventive, detective or corrective | Corrective | Detective |
test_frequency | choice | How often it is checked | Quarterly | Quarterly |
requirements | list to x_irm_requirement | Requirements it satisfies | REQ-014, REQ-102 | REQ-102 |
policies | list to x_irm_policy | Policies that mandate it | POL-011 | POL-003 |