The institution's security policy together with a mapping that links each implemented control to the specific policy requirement is correct.

The institution's security policy together with a mapping that links each implemented control to the specific policy requirement provides the traceability that auditors and maintainers need. The security policy and mapping show which policy objective each control addresses and they allow teams to perform targeted reviews and updates when requirements or risks change. That linkage supports gap analysis, evidence collection, and ongoing maintenance of the control set.

Cloud Audit Logs are valuable for monitoring and investigation but they do not document how each control implements a specific policy requirement and they do not by themselves provide the governance level mapping needed for traceability and maintenance.

A complete inventory of all physical assets including office furnishings is useful for asset management but it is not focused on linking implemented security controls to policy requirements and it will not enable auditors to trace controls back to governance objectives.

A registry of all software licenses and vendor support agreements helps with licensing compliance and vendor management but it does not create the mapping between controls and policy obligations that is required for traceability and ongoing control maintenance.

Full AWS Practitioner Certification Question