Evidence from one access-review test must support several mapped regulatory citations. What architecture enables that?
Select an answer to reveal the explanation.
Short Explanation
One photo of the locked door can prove the rule to every inspector who cares about locks. Shared evidence hangs off the tested control that those citations map into. You do not need a private photo album per regulation.
Full Explanation
When citations map to a shared control objective and its generated controls, a single control test’s evidence can substantiate multiple obligations. That shared-evidence architecture reduces duplicate collection and keeps examiner packages consistent. Per-citation siloed uploads or email-only storage break traceability inside IRM.