A transit agency must map controls for both federal grant auditors and card-payment compliance. Which approach best structures governance?
Select an answer to reveal the explanation.
Short Explanation
Auditors hate scavenger hunts. A recognized framework is the filing cabinet; grant and card rules become labeled folders inside it. One-off checklists that vanish after each visit leave the next auditor — and your own team — starting from scratch.
Full Explanation
Structured governance prefers a recognized control framework as the organizing spine, then maps external obligations into it. For a transit agency facing both federal grant auditors and card-payment compliance, adopting something such as NIST CSF/SP 800-53 or ISO/IEC 27001 and mapping grant and payment requirements into that catalog beats inventing disposable checklists. The framework provides durable control IDs, ownership, and evidence expectations that multiple oversight audiences can reuse.
Writing a unique one-page checklist per auditor visit and discarding it afterward creates non-repeatable compliance theater and loses institutional memory. Relying only on verbal assurances from the payment processor leaves no control catalog, no testable evidence, and no defense when auditors ask for documented control design. Ignoring federal grant controls because PCI DSS alone covers every municipal system confuses payment-card scope with the broader grant and transit environment; one framework domain does not automatically satisfy another regulator's requirements.
Exam caveat: When multiple compliance drivers appear, choose integration into a recognized framework over one-off or single-standard myopia.
Operational check: Select an enterprise control baseline, crosswalk grant clauses and PCI requirements to control IDs, assign evidence owners, and maintain a living mapping so successive audits reuse the same catalog rather than reinventing checklists.