Entity Scoping
About 25% of the CIS-RC exam — see all 7 domains.
Entity scoping is the practice of defining what in the organization is subject to risk, control, and compliance activity, and how broadly GRC content applies. It is the backbone shared by every IRM application.
Profiles, Entities, and the common core. The GRC/IRM common framework supplies a shared data model used by Policy & Compliance, Risk, and Audit. The central record is the Profile — a GRC representation of something you want to govern (a business unit, application, vendor, facility, process, control set owner, etc.). Profiles connect organizational objects (often CMDB CIs, departments, or other tables) into the GRC world so that controls, risks, and audits can attach to them.
Entity. An entity is any object that GRC content can be applied to or scoped against — typically a record in a table that represents a real-world item (a server CI, a department, a vendor record). Entities are the instances.
Entity type. An entity type defines a class of entities by pointing to a specific table and (optionally) a condition/filter. It tells GRC "entities of this type live in this table and match these criteria." Entity types let you bulk-create profiles from records in any table. Example: an entity type "Critical Applications" sourced from cmdb_ci_appl with a condition business_criticality = 1.
Entity class. An entity class is a grouping/categorization layer used to organize entity types and profiles for scoping and reporting (e.g., classes such as Organization, Process, Asset, Vendor). Classes help you structure the profile hierarchy and drive how content is inherited and rolled up.
Profile types and profile classes. Profiles are categorized by profile type (which maps to an entity type) and grouped using profile classes, enabling hierarchical scoping — content applied at a parent level can cascade to children.
Scoping = applying GRC content to the right entities. When you attach an authoritative source, control objective, risk statement, or indicator to profiles/entities, you are scoping. Scoping can be done:
- Manually (attach a profile directly), or
- Dynamically via entity-type conditions so newly matching records automatically come into scope.
Implementation flow (typical): create entity classes/types → point them at source tables with conditions → generate profiles → organize profiles into hierarchy → attach content (citations, control objectives, risk statements, indicators) to scope it.
Key gotchas for the exam:
- Distinguish entity (instance) vs entity type (definition/table+filter) vs entity class (grouping).
- Profiles are the join point between org objects and GRC content; they are what controls/risks/indicators ultimately attach to.
- Dynamic scoping via entity-type conditions keeps scope current as data changes.
Sample questions from this domain
Three of the 75 in this domain, with the reasoning. The full set is in the question bank.
In the GRC framework, what is an entity?
- A. A control test result only
- B. A record representing something that can be scoped for compliance/risk, such as a business unit, application, or process ✓
- C. A user's login session
- D. A type of email notification
Why: An entity represents an item (business unit, application, facility, process, etc.) that can be scoped and associated with controls and risks. It is not a notification, a test result, or a login session.
In the GRC framework, what is a profile?
- A. A record that links an entity to GRC applications, enabling controls, risks, and other items to be associated with it ✓
- B. A user's personal preferences
- C. An authority document citation
- D. A risk score formula
Why: A profile connects an entity to the GRC applications so controls, risks, indicators, and assessments can be associated with it. It is not a user preference, a scoring formula, or a citation.
What is the role of a profile type in the GRC framework?
- A. It defines a user's security role
- B. It categorizes profiles and can drive which controls, risks, or content apply to profiles of that type ✓
- C. It stores attachment metadata
- D. It replaces the entity record entirely
Why: A profile type classifies profiles (e.g., Applications, Business Units) and helps determine which content (controls/risks) applies through scoping. It is not a security role, attachment metadata, or a replacement for the entity.