in v10: No requirements should dictate scope
In the requirement, "Risk designations are assigned for all positions in the organization", a scope of the whole organization is forced through the wording. In v10, no requirements should dictate scope in and of themselves and should instead be written in such a way that they can be tested to the assessment's scope.
4
votes
AdminJeremy Huval
(Chief Innovation Officer, HITRUST)
shared this idea