Maps 4–6 — Restrictions, Activity Flow, Policy/Evidence
Map 4 — Restriction Stack
DATA ITEM / DATA SET
│
├─> Internal Confidentiality → ONE HIGHEST applicable level
│
└─> External Regulations / Contracts → ALL applicable categories
↓
ENTITLEMENT
↓
APPLY ALL REQUIRED PROTECTIONS
Answer check: confidentiality aggregates upward to one level; external categories accumulate.
Map 5 — Security Activity Flow
Identify Requirements
↓
Define Policy
↓
Define Standards
↓
Assess Current Risk
↓
Implement Controls / Procedures
↓
Manage + Monitor
↓
Independent Audit / Compliance
↓
Improve
Interpretation: controls do not come first. Requirements/classification/risk tell the organization what the control must accomplish.
Map 6 — Policy to Evidence
POLICY
high-level intent
↓
STANDARD
measurable rule
↓
CONTROL / PROCEDURE
enforce + operate
↓
LOG / EVIDENCE
prove what occurred
↓
INDEPENDENT AUDIT
assess against requirements
Exam discriminator: “we have a policy” is not proof. Auditable control needs observable evidence.
Source anchors: Chapter 7 classification and activities/policy sections, pp. 225–246.