Which of the following statements is true about control identification options for RAM?

• A. Controls are identified only from the library
• B. Controls are identified from related issues
• C. Controls are identified from the library
• D. Controls are identified from indicator results

Answer: (C)

The key idea is where RAM pulls the controls that mitigate a risk. In ServiceNow IRM RAM, you identify controls from the centralized controls library, which provides standard, reusable controls you can attach to risks. This library approach ensures consistency and speeds up risk treatment by using predefined controls rather than creating them anew each time.

Related issues reflect past problems that might inform remediation decisions, and indicator results show how well controls are performing. Neither of these sources is used to define which controls exist for a risk; they can influence decisions or highlight gaps, but the actual set of controls comes from the library.

So, identifying controls from the library is the correct concept.