A new state privacy citation requires encryption, and an encryption control objective already exists. What is the preferred mapping approach?
Select an answer to reveal the explanation.
Short Explanation
New citation, same lock—do not build a second lock factory. Map the state privacy citation onto the encryption control objective you already have. Cloning forests of controls or twin objectives just doubles the homework.
Full Explanation
Extending citation mappings to an existing control objective reuses proven control design when authority requirements overlap. When a new state privacy citation requires encryption and an encryption control objective already exists for civic systems, mapping the new citation to that objective preserves many-to-one authority coverage without cloning controls or dual-testing identical safeguards. Cloning every encryption control for each entity solely to reference the new citation fails by concept because it multiplies redundant controls and testing load without improving encryption outcomes. Ignoring the citation until the next annual policy rewrite fails by concept because regulatory obligations attach when they take effect, not when a convenience calendar opens. Creating a parallel encryption control objective with identical design and dual-testing everything fails by concept because twin objectives inflate work and confuse ownership while adding no distinct safeguard. Exam caveat: CIS-RC prefers mapping new overlapping citations onto existing control objectives rather than cloning objectives or deferring remapping. Operational check: relate the new state privacy citation to the existing encryption control objective, regenerate or refresh mappings, and verify both prior and new citations appear against that single objective in a traceability export.