Examiners ask how each mapped citation is satisfied by the control design. What should compliance configure for traceability?
Select an answer to reveal the explanation.
Short Explanation
Examiners want the story in writing: this control covers that citation because…. Put that rationale in the documentation fields on the mapping. Hallway tours, hidden mappings, and brochure paste are not traceability.
Full Explanation
Traceability documentation on citation-to-control mappings records how a control satisfies each authority requirement. Configuring residual documentation fields for examiner-facing explanations strengthens audit readiness. Verbal-only rationales, suppressing mappings, or unrelated attachments do not provide durable, reviewable mapping justification.