Policy and Compliance Implementation
About 25% of the CIS-RC exam — see all 7 domains.
Policy & Compliance Management (PCM) lets an organization create and manage policies, map them to external/internal mandates, define what "good" looks like, and continuously test that controls operate effectively.
The PCM content chain (memorize the order): Authority Document → Citation → Control Objective → Control → Control Test (and results).
- Authority Document. The external mandate: a regulation, standard, framework, or law (e.g., PCI DSS, ISO 27001, SOX, NIST). It is the "where the requirement comes from." Internal rules are policies, which group control objectives.
- Citation. A specific requirement/clause within an authority document (e.g., "PCI DSS Requirement 8.2"). Citations break a source into discrete, testable obligations.
- Control Objective. A statement of intent describing the desired outcome to satisfy one or more citations (the "what we want to achieve," e.g., "Access to cardholder data is restricted"). Control objectives map to citations.
- Control. The actual implemented safeguard/activity that satisfies a control objective for a given entity (the "how, here"). Controls are generated when a control objective (or its policy) is associated with an entity type, one control per entity. A control is the testable, owned instance.
- Control Test. The procedure used to evaluate whether a control is operating effectively, generated from a test plan (often from a reusable test template). It is closed with the control effectiveness set to Effective or Ineffective, and an Ineffective result creates an issue with remediation tasks. Attestations and indicators are separate ways to evidence control status, and their failures also create issues.
Policies and policy exceptions. Organizations store corporate policies and procedures; users can request policy exceptions that route through approval workflow and carry expiration.
Compliance scoping. Control objectives are associated with entity types (via entity scoping), which generates controls per in-scope entity. This is where Entity Scoping and PCM intersect, and it is heavily tested.
Attestation and indicators. Compliance can be evidenced through attestations (manual sign-off) or indicators (automated tests against platform data / configuration). Continuous configuration monitoring lets controls be evaluated automatically and on a schedule.
UCF and GRC content packs. The Unified Compliance Framework (UCF) Common Controls Hub supplies authority documents, citations, and control objectives as shared lists, mapping many regulations to a deduplicated set of common controls. UCF-imported records are read-only; extend them with your own content and mappings. GRC content packs are separate Store apps with prebuilt content (for example dashboards and frameworks). Shared testing of one control for many entities is the separate common control feature (a common control with reliant entities).
Exam gotchas:
- Control = scoped instance; Control Objective = reusable definition. Don't swap them.
- Citation lives inside an authority document; control objectives map to citations.
- Associating a control objective with an entity type is what creates controls.
Sample questions from this domain
Three of the 75 in this domain, with the reasoning. The full set is in the question bank.
In Policy and Compliance Management, what is an authority document?
- A. An internal statement of management intent, such as an acceptable use policy, that employees acknowledge
- B. A source of requirements such as a regulation, standard, or framework that organizations must comply with ✓
- C. A specific passage within a regulation that the business must comply with and that maps to control objectives
- D. A reusable statement of what a control should achieve, used to generate a control for each entity in scope
Why: An authority document represents a source of requirements such as a law, regulation, standard, or framework (for example PCI DSS, HIPAA, GDPR, or ISO 27001); these are usually external, although the Type field also offers values such as Organizational Directive and Contractual Obligation. An internal statement of management intent that employees acknowledge is a policy, which specifies how the business complies with authority documents. A specific passage within a regulation is a citation, the individual requirement held inside an authority document. A reusable statement of what a control should achieve is a control objective, from which controls are generated for the entities in scope.
What is a citation in Policy and Compliance Management?
- A. A reusable statement of intent from which entity controls are generated
- B. A regulation or standard, such as HIPAA, that the business follows
- C. A recorded gap raised when a control fails its attestation
- D. A specific requirement or section within an authority document ✓
Why: A citation is a specific requirement or section within an authority document (for example, encrypting cardholder data in transit under PCI DSS), and citations are mapped to control objectives and, optionally, directly to controls. A reusable statement of intent from which entity controls are generated is a control objective. The regulation or standard itself, such as HIPAA, is the authority document that contains the citations. A gap raised when a control fails its attestation is an issue.
What is the relationship between control objectives and controls in Policy and Compliance Management?
- A. A control is a reusable statement of intent; control objectives are the specific instances generated for each entity in the entity type
- B. A control objective is a reporting folder for controls; controls are created by hand for each entity and then filed under that objective
- C. A control objective is one requirement quoted from an authority document; controls are the attestations sent to each entity owner
- D. A control objective is a reusable statement of intent; controls are the specific instances generated for entities to meet that objective ✓
Why: A control objective is a reusable statement of intent, and controls are the specific implementations generated for entities (one control per entity when the objective, or its policy, is associated with an entity type). Reversing the two is the classic mistake: the control is the per-entity instance, not the reusable statement. Treating the objective as a reporting folder for hand-made controls ignores that associating an objective with an entity type generates the controls. A requirement quoted from an authority document is a citation, and attestations are questionnaires about a control, not the controls themselves.