ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

A HIPAA Compliance Matrix-sometimes called a risk-control or compliance matrix-presents each business objective alongside the risks that could threaten it, the security controls selected to mitigate those risks, and the exact HIPAA clauses those controls satisfy. By cross-referencing these elements in one table, the matrix provides leadership with a concise, end-to-end view of how governance goals, risk treatments, and regulatory obligations are aligned.

The network vulnerability scan report highlights technical flaws but does not map them to governance objectives or regulations. An agile product backlog prioritizes features through user stories and acceptance criteria, yet it rarely traces items to specific controls or HIPAA clauses unless augmented for that purpose. A disaster-recovery and business-continuity runbook does link high-level governance and risk treatment for availability, but it is primarily an operational playbook and does not enumerate all project risks, controls, and HIPAA requirements across confidentiality, integrity, and privacy. Therefore, the compliance matrix remains the most comprehensive single artifact for an integrated GRC perspective.