Evidence from one access-review test must support several mapped regulatory citations. What architecture enables that?
Select an answer to reveal the explanation.
Short Explanation
One photo of the locked door can prove the rule to every inspector who cares about locks. Shared evidence hangs off the tested control that those citations map into. You do not need a private photo album per regulation.
Full Explanation
Shared test evidence linked through the mapped control and its related citations enables one access-review test to support several mapped regulatory citations. Architecture should prefer that shared evidence path over separate manual uploads into each citation with no link to the test, storing evidence only in email so IRM stays empty for purported privacy reasons, or duplicating the test once per citation so each obligation has private screenshots. Email and unlinked uploads destroy retrievability and lineage for civic exams. Per-citation duplicate tests multiply work without improving assurance when the control already maps to many citations correctly. Exam caveat: evidence must still satisfy each citation's intent—shared storage does not excuse weak procedures that miss a mandate-specific nuance requiring extra steps. Operational check: perform one test on the mapped control, attach evidence once in IRM, verify each related citation can be traced to that test through relationships, and rehearse an examiner request that asks for proof against two different citations in one sitting. Document the shared-evidence pattern in the city's testing SOP, prohibit email-only evidence for in-scope controls, and sample quarterly that lineage reports still resolve attachments.