A cybersecurity requirement has no documented connection to an approved policy or external obligation. What is the main governance concern?

### Why this is right Standards should be traceable to policies and relevant external requirements. Without that link, stakeholders may question the requirement, and the organization may struggle to identify when it needs updating. ### The concept Traceability connects a standard to the direction or obligation that justifies it. It also assists audits and compliance management. A requirement may still be testable without a documented link, but its governance basis is weaker and its future maintenance is less reliable. ### The other options - **B. It automatically becomes a legal regulation**: internal documentation does not create a law or regulation. - **C. It can no longer be tested**: testing may still be possible if the outcome is clear. - **D. It must be implemented only by the audit department**: implementation normally involves the relevant business and operational stakeholders. ### Terms - **External obligation**: an applicable requirement from outside the enterprise, such as a regulatory requirement. - **Traceability**: a documented connection between a requirement and its source. ### Remember A clear requirement should have both a measurable outcome and a documented rationale.