One quarterly access-review control must satisfy ISO, a state privacy citation, and an internal policy. What architecture should the city implement?
Select an answer to reveal the explanation.
Short Explanation
One good fire drill can satisfy the fire marshal, the insurance rider, and the school handbook. Map every overlapping obligation to the same objective, then test once and comply many.
Full Explanation
Test-once / comply-many depends on many-to-many citation mapping into shared control objectives (and thus shared generated controls and tests). Evidence from one well-designed access-review test can demonstrate effectiveness for ISO, regulatory, and internal-policy citations simultaneously. Duplicating controls per citation multiplies effort and risks inconsistent results.