A tax authority maps SOX, NIST, and local statute citations to one privileged-access control objective for the tax system. What should the compliance implementer configure?
Select an answer to reveal the explanation.
Short Explanation
Think of one lock that satisfies three building codes—you do not install three identical locks side by side. Map those citations onto the same privileged-access control objective and let one control carry the shared intent. Cloning a control per citation just multiplies busywork without changing the safeguard.
Full Explanation
In ServiceNow Policy and Compliance, authority citations map to control objectives so generated controls can satisfy multiple overlapping civic requirements without duplicating design. For a tax authority aligning SOX, NIST, and local statute language on privileged access, mapping all three citations to one privileged-access control objective preserves many-to-one traceability: examiners still see each authority covered while operators maintain a single control design, test cadence, and evidence package for the tax system. Creating three separate control objectives for an identical safeguard fails by concept because it multiplies redundant controls, tests, and owners for the same technical outcome and inflates false complexity. Storing citation text only in a knowledge article while leaving the objective unmapped fails by concept because knowledge content is not the citation-to-control relationship model examiners and dashboards rely on. Deleting two citations to force a single authority reference fails by concept because it erases legitimate multi-authority coverage the tax program must demonstrate. Exam caveat: CIS-RC expects many-to-one citation-to-control-objective mapping when the safeguard is substantively the same across authorities. Operational check: open the privileged-access control objective, confirm all three citations are related, generate or refresh controls for the tax-system entity, and verify the traceability report lists each citation against that one objective without duplicate privileged-access controls.