You are responsible for documenting the security controls for an organization's information system. The information system processes sensitive financial data and Personally Identifiable Information (PII). Which of the following elements is MOST CRITICAL to include in the control documentation to ensure proper traceability and maintainability of the implemented security controls?