We are implementing EA and IRM applications and one of the key ask is the ability to assign / flag the Business Applications with the different risk standards / regulations applicable to it. Which helps the IRM team to filter the Business Apps to assign required controls to it and also provides reporting capability. I am thinking of having a M2M table between the Business App and the Authority document to minimize introduction of any custom attribute on the Business App table. Following the EA and IRM recommended Architecture, if there are any OOB ways to achieve this, kindly share your insights.
