Compliance authors a reusable outcome “Restrict privileged access” intended to satisfy multiple regulatory citations. Which content-chain record expresses that reusable outcome?
Select an answer to reveal the explanation.
Short Explanation
The control objective is the reusable “what good looks like” card—restrict privileged access—that can satisfy several citations at once. Map citations to that objective, then generate controls per entity. Don’t bury the outcome in a one-off test result.
Full Explanation
Control objectives (historically related to policy statements in classic naming) express reusable desired outcomes in the Policy and Compliance chain. One objective can map to many citations, enabling test-once/comply-many patterns when controls are later generated for entities. Test results and entity filters alone do not replace the objective layer in the content lifecycle.