Why would you create Entity classes?

Entity classes are created to group similar types of items (entities) for GRC scoping. A primary function is to assign these classes to Control Objectives via an Entity Type. This action automatically generates individual, auditable controls for every entity (e.g., every server, application, or department) contained within that class. This mechanism ensures that compliance requirements are systematically applied and tracked across the organization's relevant assets and resources. While also used for risk scoping, control generation is a foundational use case.

A. This is too generic. While Entity Classes do show relationships, their specific purpose is for GRC scoping, not general relationship mapping like the CMDB.
B. This is also a correct function (for Risk Management), but control generation is an equally, if not more, fundamental use case in the context of Compliance Management.
D. This describes an incorrect data relationship. Entity Classes are not used to directly map Entities to Policies and Citations in this manner.

1. ServiceNow Product Documentation, "Create an entity class in Policy and Compliance Management." This document states, "Entity classes are used to group your assets for risk and compliance purposes."

2. ServiceNow Product Documentation, "Entity scoping for GRC." This guide explains the process: "When a control objective is associated with an entity type, controls are generated for all the entities that are associated with the entity type."