A new privacy regulation adds obligations that do not map cleanly to the city's current citation library. What should the compliance content team do first?
Select an answer to reveal the explanation.
Short Explanation
New rules mean new map pins. Track the regulatory change, then remapping citations and controls — do not wait three years or throw the whole library in the trash.
Full Explanation
When a new privacy regulation adds obligations that do not map cleanly to the city’s citation library, the compliance content team should first track the regulatory change and remapping work so new citations and control objectives can be created or updated. Ignoring the regulation until a three-year policy rewrite fails by concept because legal obligations attach on the effective date, not on an internal rewrite calendar. Deleting all existing citations to start empty for every regulation fails by concept because wholesale deletion destroys prior mappings and historical traceability for other frameworks. Asking auditors to invent mappings during fieldwork without updating IRM content fails by concept because examiners assess the program; they are not the ongoing content maintenance process. Exam caveat: CIS-RC expects regulatory change tracking and remapping as content work inside IRM, not deferral, library wipeouts, or auditor improvisation. Operational check: open a regulatory-change tracking item for the new privacy rule, identify gap citations, create or update citations and control objective mappings, and verify a gap report no longer shows the unmapped obligations for in-scope civic entities. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.