A city wants its internal information-security policy to demonstrat…

Question

A city wants its internal information-security policy to demonstrate alignment to several external regulations without rewriting the policy once per regulator. What crosswalk approach should it use?

Accepted Answer

Map the internal policy’s control objectives to external citations so one policy supports many obligations. — One city playbook can satisfy many rulebooks if you build a crosswalk map. Point the policy’s objectives at each external citation instead of rewriting the policy for every regulator. Mapping beats duplication.

Answer

Clone the policy into a separate document for each regulator’s wording.

Answer

Abandon internal policies and store only raw citation text for employees.

Answer

Move all regulatory text into Security Incident Response knowledge articles.

A city wants its internal information-security policy to demonstrate alignment to several external regulations without rewriting the policy once per regulator. What crosswalk approach should it use?

Short Explanation

Full Explanation