We have a new requirement to assess business applications on a repeated interval to determine their ability to comply with public records requests. Questions that need to be answered for each business application includes "Does the application support searching data using keywords, etc...", "Can a subset of data be preserved indefinitely in its original form...", and so on.
I understand that there are tools in the Public Sector space to manage each public records request, but this is more about assessing our business applications for their readiness to comply with those requests.
Do you have a similar requirement to assess business applications? How are you doing that? Are you using GRC tools for it? How to you gather the answers from the application owners? How do you score their answers? How does reporting on that data work?
Thanks for your insights and experience!
