Minimum number of Trusted Agents required on a CRI request spreadsheet?

• A. 2
• B. Anyone can request a CRI
• C. 1
• D. 3

Answer: (A)

The idea being tested is dual control and separation of duties in handling CRI requests. Requiring more than one trusted agent creates an independent check on the process, making it harder for a single person to misuse or accidentally mishandle a request.

In practice, having a minimum of two trusted agents means one person can enter or initiate the CRI details, while a second person reviews and approves or validates them. This pairing provides an audit trail, increases accuracy, and ensures adherence to security and compliance policies. If only one person handled everything, mistakes could go unnoticed or, in the worst case, manipulation could occur without oversight.

Saying that anyone can request a CRI would remove accountability and traceability. Having just one agent eliminates the necessary independent verification, increasing risk. Needing three might improve redundancy, but it isn’t the minimum requirement and adds unnecessary overhead unless policy specifies a higher standard.