A county privacy office loads a new state privacy citation and finds an existing control objective already covers the same access-review requirement. What should the compliance lead do?
Select an answer to reveal the explanation.
Short Explanation
Think of citations as sticky notes pointing at the same homework assignment. If the work is already defined, you point the new sticky note at it—you do not rewrite the assignment. Mapping reuses the objective so testers stay focused on one control design.
Full Explanation
When a county privacy office loads a new state privacy citation and finds an existing control objective already covers the same access-review requirement, the compliance lead should map the new citation to the existing control objective instead of spawning a duplicate. Deduplicated mapping keeps one testable outcome supporting multiple obligations and reduces owner fatigue. Creating a duplicate control objective so each citation has a private copy multiplies identical testing. Retiring the existing objective to write a new one labeled only for the state rule discards reusable content without need. Deleting the citation and relying on the authority document header alone loses discrete obligation tracking examiners expect. Exam caveat: mapping requires true coverage—if the existing objective is narrower than the new citation, extend or add intentionally rather than falsely claiming coverage. Operational check: compare citation text to the objective, document coverage rationale, create the citation-to-objective map, verify lineage reports, and brief privacy and IT owners that one access-review control still satisfies both mandates. Retain the coverage analysis with the content change record for the county program.