The National Institute of Standards and Technology is revising a map to link its core security controls, Special Publication 800-53 Rev. 4: Security and Privacy ...
Group regulatory expectations into a small set of stable control families and types, then run your program around those, not around clauses, articles and acronyms.