What table, along with the Policy table, is linked to the Control Objective table by a many-to-many relationship?

What table, along with the Policy table, is linked to the Control Objective table by a many-to-many relationship?

• A. Entity Class
• B. Citation
• C. Authority Documents
• D. Risk Framework

Answer: (B)

The linking concept is that a single control objective can be connected to many policies, and a policy can address multiple control objectives. This kind of cross-connection is stored in a junction table, which in ServiceNow IRM is the Citation table. It acts as the bridge that links a policy to a control objective (and can also reference the authoritative sources behind that linkage). This setup enables flexible, scalable associations and enables you to see which policies relate to which control objectives and vice versa. Other options don’t fit because Entity Class is for classifying entities, not linking policies to controls; Authority Documents store official references but aren’t the bridging mechanism; Risk Framework defines the overall risk methodology rather than the table that connects policies to control objectives.

The linking concept is that a single control objective can be connected to many policies, and a policy can address multiple control objectives. This kind of cross-connection is stored in a junction table, which in ServiceNow IRM is the Citation table. It acts as the bridge that links a policy to a control objective (and can also reference the authoritative sources behind that linkage). This setup enables flexible, scalable associations and enables you to see which policies relate to which control objectives and vice versa.

Other options don’t fit because Entity Class is for classifying entities, not linking policies to controls; Authority Documents store official references but aren’t the bridging mechanism; Risk Framework defines the overall risk methodology rather than the table that connects policies to control objectives.