Implementation Planning
About 10% of the CIS-RC exam — see all 7 domains.
Covers how to scope and deliver an IRM implementation: requirements gathering, identifying which applications (Policy & Compliance, Risk, Audit, Advanced Risk, Third-party Risk) the customer needs, phasing, data sources (CMDB, HR, vendor data) feeding entities, plugin activation, and roles.
Common roles: GRC Admin, GRC Manager, Risk Manager, Compliance Manager, Audit Manager, plus reader/user roles. Match the role to the application and least-privilege principle.
Now Create / best practices: scope narrowly first, use out-of-box content packs, design the entity model early (it drives everything downstream), and plan integrations (CMDB, identity, ticketing) and reporting (Performance Analytics) up front.
Sample questions from this domain
Three of the 30 in this domain, with the reasoning. The full set is in the question bank.
During GRC implementation planning, what is the recommended first step before configuring entity types and entities?
- A. Import UCF shared lists for the frameworks under evaluation
- B. Define the organization's GRC scope, objectives, and stakeholders ✓
- C. Create entity filters on the CMDB and department tables
- D. Build the risk assessment methodology and its scoring factors
Why: Successful implementations begin by defining scope, objectives, and stakeholders so configuration aligns to business needs. Importing UCF shared lists before scope is agreed loads read-only content that may not apply. Entity filters are part of entity type configuration, the very step that should follow scoping. A risk assessment methodology and its factors are detailed Advanced Risk design that depends on agreed objectives, so building it first is premature.
A consultant needs to set GRC properties and create entity tiers during a GRC implementation. Which common GRC role is required for this configuration?
- A. sn_grc.manager
- B. sn_grc.user
- C. sn_grc.admin ✓
- D. sn_grc.reader
Why: The GRC Admin role (sn_grc.admin) provides administrative access to the GRC suite of applications and modules; the documented procedures for GRC Properties and entity tiers require it, and it can configure Tasks Page Configuration records in all workspaces. sn_grc.manager provides management access (for example entity classes, entity filters, and the GRC Workbench) and is contained in sn_grc.admin, but it is not the administrative role. sn_grc.user is the standard working role (contained in sn_grc.manager), and sn_grc.reader provides read access only.
Which activities belong in the planning/design phase of a GRC implementation? (Choose two)
- A. Running user acceptance testing on the configured attestations
- B. Importing UCF shared lists into the production instance
- C. Defining the entity classes and entity types to be used ✓
- D. Identifying authority documents and frameworks in scope ✓
- E. Promoting the update sets for entity filters to production
Why: Planning should identify which authority documents and frameworks are in scope and define the entity classes and entity types that structure the data model. User acceptance testing of configured attestations happens in the test phase, after the build. Importing UCF shared lists into production and promoting entity filter update sets are build and deployment activities that depend on the design being agreed first.