In which state is an attestation active and sent to the control owner?

An attestation is considered active and sent to the control owner when it is in the "Attest" state. This state signifies that the control owner has begun the attestation process, which usually involves evaluating the effectiveness of a control and confirming its operation during a designated time frame. Once in this state, the control owner receives communication regarding the expectations and requirements for the attestation, signaling a stage of accountability and oversight where they must affirm that the controls are working as intended.

In contrast, other states such as "Monitor" typically involve ongoing assessment and observation of controls, but do not indicate that an attestation has been formally sent out. The "Review" state may involve looking over the attestation results but would not mean that it is currently active and requiring a response. The "Draft" state indicates that the attestation is still being prepared and has not yet been finalized or sent to the control owner. Understanding these distinctions clarifies why "Attest" is the appropriate choice for active attestations.