One quarterly access-review control must satisfy ISO, a state privacy citation, and an internal policy. What architecture should the city implement?
Select an answer to reveal the explanation.
Short Explanation
One good fire drill can satisfy the fire marshal, the insurance rider, and the school handbook. Map every overlapping obligation to the same objective, then test once and comply many.
Full Explanation
When one quarterly access-review control must satisfy ISO, a state privacy citation, and an internal policy, the city should map all three obligations to one control objective so a single control test supports multiple mandates. That common-control pattern reduces duplicate testing, keeps evidence coherent, and matches how overlapping regulations share outcomes in mature IRM designs. Three identical controls tested on three calendars with separate evidence folders multiply cost and invite drift between supposedly identical tests. Ignoring the ISO and state citations to test only the internal policy wording leaves external obligations uncovered. Publishing three authority documents with no citations and relying on narrative reports abandons structured lineage examiners expect. Exam caveat: mapping requires genuine coverage of each obligation's intent—force-fitting dissimilar requirements into one objective creates false assurance and findings later. Operational check: map the three sources to one access-review control objective, generate one control per in-scope entity, perform one test with shared evidence, demonstrate citation lineage reports to auditors, and record coverage analysis showing how the single test meets each mandate's access-review expectation for the municipal program.