Create an Authority Document
After an Authority Document is created, Citations with associated Controls and Policies can be uploaded and linked to the Authority Document.
Authority Documents consist of Citations. Citations are linked to Controls, and Controls are linked to Policies. External Controls are most likely driven by an Authority Document such as International Organization for Standardization (ISO), while internal Controls may not have an Authority Document unless your organization chooses to create one. Policies are business driven (example: How your organization will handle the Controls and how the Controls will be met).
To create an Authority Document:
Add Citations and link those to Controls until all Citations have a status of Evidence Not Required or Evidence Required and display in green.