Compliance authors a reusable outcome “Restrict privileged access” intended to satisfy multiple regulatory citations. Which content-chain record expresses that reusable outcome?
Select an answer to reveal the explanation.
Short Explanation
The control objective is the reusable “what good looks like” card—restrict privileged access—that can satisfy several citations at once. Map citations to that objective, then generate controls per entity. Don’t bury the outcome in a one-off test result.
Full Explanation
Control objectives express reusable desired outcomes in the Policy and Compliance chain and can map to multiple citations before generating scoped controls. When compliance authors a reusable outcome such as Restrict privileged access intended to satisfy multiple regulatory citations, the content-chain record that expresses that outcome is the control objective. A one-off control test result with no parent objective is evidence activity, not the reusable definition authors need. An entity class filter with no policy content attached does not express the outcome and belongs to entity architecture, not the mandate content chain. A retired authority document that no longer accepts citations cannot host the reusable requirement definition going forward. Exam caveat: one objective-to-many-citations mapping is a deliberate deduplication strategy—do not clone objectives per citation without cause, or municipal testing multiplies uselessly. Operational check: create the Restrict privileged access control objective, map multiple citations to it, scope to entity types, generate controls, and show city leadership that one well-designed test can support several obligations. Document the mapping rules in the content authoring standard and review mappings when new mandates arrive.