As part of Compliance Process, once the Policy is published, all the control objectives of the policy becoming inactive. Due to this, Compliance Team unable to map the control objective to entity type or create controls.
In our organization, drafting the policies are conducted by Governance Team and Compliance is checked by another team. Also, while drafting the policies, they will not be able to create controls as this has to be done after the policies are finalized and responsibilities are assigned.
How we can overcome this scenario? We need the control objectives of policies to be active after policy is published.
