A city wants its internal information-security policy to demonstrate alignment to several external regulations without rewriting the policy once per regulator. What crosswalk approach should it use?
Select an answer to reveal the explanation.
Short Explanation
One city playbook can satisfy many rulebooks if you build a crosswalk map. Point the policy’s objectives at each external citation instead of rewriting the policy for every regulator. Mapping beats duplication.
Full Explanation
A city that wants its internal information-security policy to demonstrate alignment to several external regulations without rewriting the policy once per regulator should map the internal policy's control objectives to external citations so one policy supports many obligations. That crosswalk keeps employee-facing standards stable while regulatory lineage stays structured in IRM. Cloning the policy into a separate document for each regulator's wording multiplies maintenance and drift across clones. Abandoning internal policies to store only raw citation text for employees removes actionable internal standards staff can follow day to day. Moving all regulatory text into Security Incident Response knowledge articles confuses SIR with Policy and Compliance content architecture and breaks generation patterns. Exam caveat: crosswalks require honest coverage analysis—mapping does not create compliance if the internal objective is weaker than the citation demands. Operational check: maintain one internal IS policy, author shared control objectives, map each relevant external citation to those objectives, generate entity controls once, and produce crosswalk reports for regulators and city leadership. Review mappings when either the internal policy or an external mandate revises, and record gap treatments where coverage is incomplete for the municipal program.