Controls are moved to which state from the attestation phase?

• A. Retired
• B. Review
• C. Draft
• D. Monitor

Answer: (B)

In this lifecycle, the state shows where a control is in its governance process. After the attestation phase, when the control owner confirms its effectiveness and provides the required evidence, the next step is to have that attestation reviewed by the appropriate stakeholders. Moving the control into the Review state allows a formal validation of the attested information, ensuring that the evidence and assurances are checked, sign-offs are obtained, and any gaps are identified before the control proceeds to ongoing monitoring or retirement.

Draft is for creation and initial input, Monitor is for ongoing performance tracking, and Retired represents end-of-life for a control. The Review state is the natural next step after attestation because it provides the necessary validation and accountability before further action.