Controls are automatically moved to which state from the attestation phase?

The correct answer is that controls are automatically moved to the Review state from the attestation phase. In the context of ServiceNow's Risk and Compliance module, the attestation phase is a critical step where controls are being assessed for their effectiveness and compliance with established requirements. Once this attestation is completed, it is necessary for these controls to enter the Review state to facilitate further evaluation.

The Review state signifies that the controls have been formally assessed and are now subject to examination by relevant stakeholders or managers. This ensures that the organization can confirm that the controls are in place, functioning as intended, and addressing the pertinent risks effectively. Reviewing allows for an ongoing oversight process, enabling organizations to identify any gaps or areas for improvement.

In contrast, other states like Retired, Draft, or Monitor serve different purposes within the lifecycle of a control. Retired indicates that a control is no longer in use and has been phased out. Draft implies that a control is still under development and has not yet been finalized for implementation. Monitor usually represents an ongoing oversight or observation phase where established controls are actively monitored for performance and compliance, rather than moving from attestation. Thus, the pathway from attestation leads directly to the Review state to ensure that controls are evaluated appropriately after their