Which option describes the correct mapping for Authority Documents in policy and compliance tracking?

Which option describes the correct mapping for Authority Documents in policy and compliance tracking?

• A. Citations mapped to control objectives and tested as compliant or non-compliant
• B. Authority Documents mapped to policies tested as compliant or non-compliant
• C. Citations mapped to entity-scoped controls tested as compliant or non-compliant
• D. Citations mapped to control objectives, and compliance is checked when controls are tested as compliant or non-compliant.

Answer: (D)

Authority Documents are the sources of truth, and each citation within them is linked to a specific control objective that expresses what must be achieved. The real measure of compliance comes from testing the actual controls, which yields a compliant or non-compliant result. This creates a clear chain from the authoritative citation to the control objective and then to the testing outcome. That combination—citations mapped to control objectives, with compliance assessed when controls are tested—best captures how policy and compliance tracking should work.

Authority Documents are the sources of truth, and each citation within them is linked to a specific control objective that expresses what must be achieved. The real measure of compliance comes from testing the actual controls, which yields a compliant or non-compliant result. This creates a clear chain from the authoritative citation to the control objective and then to the testing outcome. That combination—citations mapped to control objectives, with compliance assessed when controls are tested—best captures how policy and compliance tracking should work.