[Verse 1] Start with policies in your compliance frame Three documents that set the business game Data protection, access control, disaster recovery too Now we trace them down to see what controls do Every policy statement needs a bridge to action Controls are the tools that give us satisfaction [Chorus] Policy to control, control to proof Three step traceability, that's the truth Statement leads to action, action shows evidence P-C-E methodology makes perfect sense Policy to control, control to proof Trace it down completely, that's the proof [Verse 2] Take your data policy, find the rule that states "Personal information has restricted access gates" Now identify the control that makes this real User authentication with approval seal Role-based permissions and encryption key That's how policy becomes reality [Chorus] Policy to control, control to proof Three step traceability, that's the truth Statement leads to action, action shows evidence P-C-E methodology makes perfect sense Policy to control, control to proof Trace it down completely, that's the proof [Verse 3] Controls need evidence to prove they work Logs and reports where the proof won't lurk Access reviews and audit trails so clean Testing results and metrics clearly seen Without this evidence your control's just words Documentation flies like singing birds [Bridge] Map it out completely, every single line Policy connects to control design Control connects to evidence so clear Management assurance crystal clear Three policies, three controls each one Nine pieces of evidence when you're done [Chorus] Policy to control, control to proof Three step traceability, that's the truth Statement leads to action, action shows evidence P-C-E methodology makes perfect sense Policy to control, control to proof Trace it down completely, that's the proof [Outro] When auditors come knocking at your door You'll have the trail they're looking for Policy to control to evidence chain Traceability keeps you in the game
← Exercise 1: Control Classification | Exercise 3: Framework Mapping →