What happens when you assign an Entity Type to a Control Objective?

• A. An assessment is automatically generated to test each Entity listed in the Entity Type
• B. A policy is created automatically for every Entity listed in the Entity Type
• C. A control is automatically generated for every Entity listed in the Entity Type
• D. The Entity Type presents a compliance score and controls tied to it

Answer: (C)

When you assign an Entity Type to a Control Objective, the system creates a concrete control for every item in that Entity Type. The Entity Type defines the scope (for example, all applications or all business units), and mapping it to a Control Objective instantiates a separate control instance for each entity so you can assess and monitor compliance at the entity level. This makes it possible to track which specific entities meet the control objective, rather than evaluating the objective in the abstract.

Other options aren’t the direct outcome of this mapping. Assessments aren’t automatically generated for each entity just by linking the Entity Type to the Control Objective, and policies aren’t created automatically. Scores come from the results of those per-entity controls, not from the Entity Type alone.