Examiners request a file showing how payments-environment citations map to controls. What should compliance provide?
Select an answer to reveal the explanation.
Short Explanation
Examiners like a clean map, not a scavenger hunt. Export the citation-to-control mappings for the payments environment and hand it over. Slogan slides, “trust us,” or giving them admin keys are the wrong package.
Full Explanation
Examiner-ready traceability reporting exports citation-to-control relationships for a defined scope such as the payments environment. Providing that export satisfies common examination requests for authority coverage evidence in civic payment processing where public funds and cardholder data may be in play. A slide with marketing slogans and no citation or control identifiers fails by concept because slogans are not mappable evidence and cannot prove coverage. Verbal assurance that mappings exist somewhere in the instance fails by concept because examiners need a portable, scoped package—not a scavenger hunt through production. Granting read-only admin credentials so examiners discover mappings themselves fails by concept because broad admin access expands insider and operational risk and substitutes exploration for a prepared evidence package. Exam caveat: CIS-RC expects scoped citation-to-control exports as examination deliverables rather than marketing, verbal claims, or admin handoffs. Operational check: export citation-to-control mappings filtered to the payments environment, spot-check identifiers and relationships, and deliver the file as the examiner package without granting admin roles.